feat(lapis): remove protected OpennessLevel

[fengelniederhammer]

resolves #1498

I still left the opennessLevel field in the database config, since we might need it we implement proper authorization. Or do you think we should remove it now?

I also didn't label this as breaking (althought it technically is) since noone was using it and it was an intentionally undocumented feature. Or should we even mark it as chore so that it doesn't show up in the changelog?

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by an appropriate test.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
lapis	Ready	Preview, Comment	Jan 12, 2026 8:25am

[github-actions]

This is a preview of the changelog of the next release. If this branch is not up-to-date with the current main branch, the changelog may not be accurate. Rebase your branch on the main branch to get the most accurate changelog.

Note that this might contain changes that are on main, but not yet released.

Changelog:

0.6.4 (2026-01-12)

Features

• lapis: remove protected OpennessLevel (5e94d9d), closes #1498

[Copilot]

Pull request overview

This PR removes the PROTECTED OpennessLevel from LAPIS, simplifying the authorization model by eliminating the access key-based protection system.

Changes:

• Removed the PROTECTED enum value from OpennessLevel and all associated authorization logic
• Deleted access key configuration files, readers, and authorization filters
• Removed test coverage for protected routes and access key validation
• Cleaned up OpenAPI schema generation to no longer support protected mode

Reviewed changes

Copilot reviewed 32 out of 33 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lapis/src/main/kotlin/org/genspectrum/lapis/config/DatabaseConfig.kt	Removed PROTECTED enum value from OpennessLevel
lapis/src/main/kotlin/org/genspectrum/lapis/config/AccessKeys.kt	Deleted entire file containing access key data structures and reader
lapis/src/main/kotlin/org/genspectrum/lapis/auth/DataOpennessAuthorizationFilter.kt	Removed ProtectedDataAuthorizationFilter class and simplified factory
lapis/src/main/kotlin/org/genspectrum/lapis/silo/SiloClient.kt	Removed checkProtection parameter from query methods
lapis/src/main/kotlin/org/genspectrum/lapis/openApi/OpenApiDocs.kt	Removed access key schema and databaseConfig parameters from schema builders
lapis/src/main/kotlin/org/genspectrum/lapis/openApi/Schemas.kt	Deleted access key description constant
lapis/src/main/kotlin/org/genspectrum/lapis/openApi/AccessKeyParameterCustomizer.kt	Deleted entire customizer class
lapis/src/main/kotlin/org/genspectrum/lapis/request/SpecialProperties.kt	Removed ACCESS_KEY_PROPERTY constant and related mappings
lapis/src/test/kotlin/org/genspectrum/lapis/auth/ProtectedDataAuthorizationTest.kt	Deleted comprehensive test suite for protected authorization
lapis/src/test/kotlin/org/genspectrum/lapis/config/AccessKeysReaderTest.kt	Deleted access key reader tests
lapis/src/test/resources/config/testAccessKeys.yaml	Deleted test access keys configuration
lapis/src/test/resources/config/protectedDataDatabaseConfig.yaml	Deleted protected database configuration
lapis/src/test/resources/application-test.properties	Removed access keys path property
lapis/src/main/resources/application-docker.properties	Removed access keys path property
lapis/build.gradle	Removed opennessLevel parameter from OpenAPI generation
lapis/README.md	Removed documentation for generating protected OpenAPI docs
lapis/.gitignore	Removed protected OpenAPI file entries
lapis/docker-compose.yml	Removed lapisProtected service definition
lapis-e2e/testData/singleSegmented/protectedTestDatabaseConfig.yaml	Deleted protected test configuration
lapis-e2e/test/protectedRoutes.spec.ts	Deleted end-to-end tests for protected routes
lapis-e2e/test/common.ts	Removed protected client references
lapis-e2e/package.json	Removed protected client generation scripts
lapis-e2e/generateOpenApiClients.sh	Removed protected OpenAPI generation command
lapis-e2e/.prettierignore	Removed protected client path
lapis-docs/src/components/ConfigGenerator/configContext.tsx	Removed PROTECTED from openness level schema

Files not reviewed (1)

• .idea/runConfigurations/LapisProtected.xml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fhennig]

LGTM!

I think 'feat' is fine, and also making it non-breaking. This way we can find it in the changelog, but yes, it's undocumented so it's not breaking, fine for me.

[chaoran-chen]

Thanks, sounds all good to me!