Glossary¶

Short definitions of terms used throughout AntFlow. For explanations of their relationships, see Concepts.

Access token: An OAuth credential authorizing API requests. The UI sends the identity provider's access token to AntFlow, not its ID token or refresh token. See Authentication and project access.
Application package: A workflow description, referenced files, runtime image references, and metadata used to share and execute an application.
Asset: A data resource described in a STAC item, such as a published output file.
Backend: The launcher's integration with an execution environment, such as a local host, Kubernetes, or Slurm.
Container image: Packaged application software and dependencies used by a processing tool. The image is distinct from the CWL definition that invokes its command.
CORS (Cross-Origin Resource Sharing): A browser mechanism controlling whether scripts can access resources from another origin. API CORS and bucket CORS are separate from authentication.
CWL (Common Workflow Language): An open standard describing computational tools, workflows, and their input/output dependencies.
Execution: A run of a process or workflow, separate from authoring or publishing its definition. An AntFlow-submitted execution is tracked as a job.
Execution engine: Software that interprets CWL and coordinates processing tools, such as cwltool, Calrissian, or Toil. It is distinct from the launcher and its backend.
Flavor: A label describing launcher capabilities used to determine eligibility. A label alone does not provision the resource it names.
Git reference: A branch, tag, or commit selecting a repository revision. Branch references can change as new commits are pushed.
Group claim: Identity-provider information listing a user's group memberships. AntFlow reads Keycloak groups from the access token to apply group-restricted access.
ID token: An OIDC token describing the signed-in user to the client. It is not the credential the UI sends to AntFlow's API.
Job: The record of one process execution, with a job ID, input values, and lifecycle status.
Job result: Output values or data references associated with an execution. Published outputs can also have STAC metadata.
JWK (JSON Web Key): A JSON representation of a cryptographic key. AntFlow exposes a public JWK for secret encryption; the private key remains on the server. A JWKS is a set of JWKs, used by the identity provider to expose signing keys.
JWT (JSON Web Token): A token format carrying claims. AntFlow verifies Keycloak access-token JWTs using the realm's signing keys and reads identity and groups from the claims.
Launcher: The registered component that fetches and runs AntFlow jobs on an execution environment and reports progress and results.
Launcher token: A credential issued when registering a launcher, authorizing its worker API requests. It is separate from the user's API credential.
OAuth 2.0: An authorization framework through which a client obtains access tokens for API requests. OIDC adds a sign-in and identity layer to OAuth 2.0.
OGC API - Processes: An OGC web API standard for process discovery, descriptions, execution, job monitoring, and result retrieval, subject to supported conformance classes.
OGC EO Application Package: An Earth Observation application-packaging approach documented in an OGC Best Practice, using CWL, image references, and metadata.
OIDC (OpenID Connect): An identity layer on OAuth 2.0 used by the UI to sign in through GitLab or Keycloak. OIDC distinguishes access tokens, ID tokens, and refresh tokens.
Personal access token (PAT): A GitLab credential created by a user for API access, with selected scopes and that user's permissions. It is distinct from an OAuth access token.
Personal launcher: A launcher registration owned by a user, rather than shared across users.
PKCE (Proof Key for Code Exchange): Protection for the OAuth authorization-code flow, used by the UI's public client without embedding a client secret in the browser.
Presigned URL: A temporary signed object-storage URL authorizing a particular operation. Treat it as sensitive until it expires.
Process: The available input/output interface to a workflow, not a particular run. AntFlow derives process descriptions from discovered CWL workflows.
Project: A GitLab project containing workflow definitions and related metadata. AntFlow discovers processes within accessible projects.
Publication: Depending on context, making workflows discoverable, an administrator publishing a project in AntFlow, or archiving and cataloging job outputs. None of these is the same as executing the workflow.
Refresh token: An OAuth credential used by the client to obtain new tokens from the identity provider, when available. It is not sent to AntFlow's API.
Runner: The launcher configuration term for an execution backend, selected by cwl_runner, such as local, k8s, or toil_slurm. The backend invokes the corresponding CWL execution engine.
S3-compatible storage: Object storage providing an S3-compatible API. AntFlow uses a configured bucket for workflow outputs, logs, and static STAC files.
Scope: A requested OAuth permission or category of OIDC information. GitLab's read_api scope authorizes API reads; openid, profile, and email concern the UI's OIDC sign-in.
Secret alias: A name used to select an encrypted vault entry without putting its real value in the execution form or reusable input file.
Shared (transverse) launcher: A launcher registration shared across users, rather than owned by one user. Administrators create it with is_transverse: true and can restrict it to authentication groups.
STAC (SpatioTemporal Asset Catalog): A specification describing geospatial data and assets through catalog, collection, and item metadata. AntFlow can use it to catalog job outputs.
Step: A node in a CWL workflow that invokes a tool or subworkflow using declared input/output connections.
TLS (Transport Layer Security): The protocol securing HTTPS connections. Clients must trust the certificate chain presented by the service they contact.
TTL (Time to Live): The configured lifetime of data or state, such as cached records. Its exact meaning depends on the setting; cache lifetime and launcher activity windows are not interchangeable.
Userinfo: An OIDC endpoint called with an access token. AntFlow uses Keycloak's userinfo response to retrieve encrypted GitLab-token and user-secret attributes, not to read group claims.
Vault: The user's named encrypted secret entries, stored in the Keycloak profile. Workflows select entries through secret aliases, not plaintext values.
Workflow: The authored processing definition. Publication exposes an interface as a process; execution creates a job.