airflow-pytest-plugin 0.1.0__tar.gz → 0.2.0__tar.gz

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airflow-pytest-plugin
-Version: 0.1.0
+Version: 0.2.0
 Summary: View airflow-pytest-operator results in the Airflow 3 web UI.
 Project-URL: Homepage, https://github.com/IKrysanov/airflow-pytest-plugin
 Project-URL: Repository, https://github.com/IKrysanov/airflow-pytest-plugin
@@ -76,9 +76,37 @@ It has two halves that share one on-disk layout:
 
 | Side | Where it runs | What it is |
 | --- | --- | --- |
-| **Producer** | the worker | `ArchivingJUnitResultParser`, a drop-in `parser=` for `PytestOperator` |
+| **Producer** | the worker | `ArchivingResultParser`, a drop-in `parser=` for `PytestOperator` |
 | **Reader** | the API server | a FastAPI app + single-page viewer, registered as an Airflow plugin |
 
+## Contents
+
+- [Screenshots](#screenshots)
+- [Install](#install)
+- [Quickstart](#quickstart)
+- [Do I need `cleanup="never"`?](#do-i-need-cleanupnever)
+- [How it works](#how-it-works)
+- [HTTP API](#http-api)
+- [Access control (RBAC)](#access-control-rbac)
+- [Configuration](#configuration)
+- [Architecture (SOLID)](#architecture-solid)
+- [Development](#development)
+- [License](#license)
+
+## Screenshots
+
+**Overview** — the run list with the historical chart (per-status legend
+toggles, run numbers, and a carousel beyond 30 runs), KPI cards, and Airflow-
+matched colours and font:
+
+![Pytest Reports — overview](https://raw.githubusercontent.com/IKrysanov/airflow-pytest-plugin/main/docs/screenshots/overview.png)
+
+**A single run** — a clickable success donut (pass-rate in the centre; click a
+slice to filter by status), the counts, and every test's captured output on
+expand:
+
+![Pytest Reports — a single run](https://raw.githubusercontent.com/IKrysanov/airflow-pytest-plugin/main/docs/screenshots/detail.png)
+
 ---
 
 ## Install
@@ -97,12 +125,12 @@ enough there too; the `[web]` extra only adds the standalone dev server.
 
 ```python
 from airflow_pytest_operator import PytestOperator
-from airflow_pytest_plugin import ArchivingJUnitResultParser
+from airflow_pytest_plugin import ArchivingResultParser
 
 PytestOperator(
     task_id="run_tests",
     test_path="tests/",
-    parser=ArchivingJUnitResultParser(),   # was JUnitResultParser()
+    parser=ArchivingResultParser(),   # was JUnitResultParser()
 )
 ```
 
@@ -140,7 +168,7 @@ python -m airflow_pytest_plugin.web --root ./pytest-reports --port 8000
 
 **No.** In the operator, the *parser* owns the report location, and a
 **parser-supplied directory is never deleted by the runner under any cleanup
-policy**. `ArchivingJUnitResultParser` supplies its own directory, so reports
+policy**. `ArchivingResultParser` supplies its own directory, so reports
 always survive regardless of the runner's `cleanup` setting. `cleanup="never"`
 only matters when you let the runner use throwaway temp dirs — which is exactly
 the fragile path (random names, no `dag/run/task` association, not visible to
@@ -152,7 +180,7 @@ other workers) this plugin replaces.
 worker                              shared volume                 API server
 ──────                              ─────────────                 ──────────
 PytestOperator                      {root}/{dag}/{run}/           FastAPI app
-  └─ ArchivingJUnitResultParser ──▶   {task}/t{try}/        ◀──── FileSystemReportSource
+  └─ ArchivingResultParser ──▶   {task}/t{try}/        ◀──── FileSystemReportSource
        report_request() → path          ├─ junit.xml              └─ lists meta.json,
        parse()          → meta.json     └─ meta.json                 parses junit.xml
 ```
@@ -180,9 +208,59 @@ runtime. Endpoints (relative to the mount):
 | `GET /` | the single-page viewer (HTML) |
 | `GET /api/reports?dag_id=&run_id=` | summaries, newest first |
 | `GET /api/reports/{report_id}` | one report with per-case rows |
+| `DELETE /api/reports/{report_id}` | delete a report (RBAC-gated) |
+| `GET /api/reports/{report_id}/allure.zip` | raw Allure results as a zip (if any) |
 | `GET /api/health` | `{"status": "ok"}` |
 | `GET /api/docs` | OpenAPI docs |
 
+The reads (`GET`) and the delete are gated by Airflow RBAC — see below.
+
+## Access control (RBAC)
+
+Access is enforced the way Airflow 3 enforces it: every check goes through
+Airflow's **auth manager** (`is_authorized_dag(...)`) — the same call Airflow's
+own DAG-run endpoints make — keyed by the report's `dag_id` and the
+authenticated user. Two permissions are checked:
+
+| Action | Airflow 3.x check | Airflow 2.x (FAB) equivalent |
+| --- | --- | --- |
+| **See / open a report** | `is_authorized_dag(method="GET", access_entity=RUN)` | `can_read` on the DAG |
+| **Delete a report** | `is_authorized_dag(method="POST", access_entity=RUN)` (may trigger the DAG) | trigger / `can_create` on the DAG |
+
+The report list is filtered to the DAGs you may read, opening a report you can't
+read returns `403`, and deleting one requires permission to **trigger** its DAG.
+Every check **fails closed**: if the auth manager can't be consulted, access is
+denied.
+
+**Airflow 2 → 3 mapping.** Airflow 2's FAB used `(action, resource)` pairs —
+`can_read` / `can_edit` / `can_delete` / `can_create` on a resource such as
+`DAG:<id>`. Airflow 3 replaced these with the auth manager's `method`: `GET` ↔
+read, `POST` ↔ create, `PUT` ↔ edit, `DELETE` ↔ delete, `MENU` ↔ menu access.
+This plugin maps **read → `GET`** and **delete → `POST`** (trigger), so it
+inherits your existing per-DAG roles with no extra configuration.
+
+**Plugin visibility.** The nav entry is an Airflow `external_views` item, which
+has no per-permission gate, so the menu link is visible to every signed-in user;
+access is enforced on the **content** (a user who may read no DAG sees an empty
+list and `403` on direct links). The standalone dev server (no Airflow auth)
+allows everything.
+
+## Allure / TestOps export
+
+Opt in per task and install [`allure-pytest`](https://pypi.org/project/allure-pytest/)
+on the worker:
+
+```python
+parser=ArchivingResultParser(allure=True)
+```
+
+The parser then adds `--alluredir` (pytest errors with *unrecognized arguments*
+if `allure-pytest` is missing), so the **raw Allure results** are archived next to
+the report, with an `executor.json` linking the launch back to the Airflow run.
+Download them from a report's detail view, or `GET
+/api/reports/{id}/allure.zip` — then upload to [Allure TestOps](https://qameta.io/)
+(`allurectl upload …`). The JUnit viewer is unaffected; both artifacts coexist.
+
 ## Configuration
 
 | Setting | Default | Purpose |
@@ -198,7 +276,7 @@ Mirrors the operator's layering — each piece has one reason to change:
 | Module | Responsibility |
 | --- | --- |
 | `layout.ReportLayout` | the single `ReportRef → directory` mapping, shared by both sides |
-| `producer.ArchivingJUnitResultParser` | write JUnit XML + `meta.json` (extends the operator's parser) |
+| `producer.ArchivingResultParser` | write JUnit XML + `meta.json` (extends the operator's parser) |
 | `sources.ReportSource` / `FileSystemReportSource` | read/index reports behind an interface (Dependency Inversion) |
 | `web.create_app` | map HTTP onto a `ReportSource` — knows nothing about the filesystem |
 | `plugin.PytestReportsPlugin` | register the app with Airflow |

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/README.md

@@ -32,9 +32,37 @@ It has two halves that share one on-disk layout:
 
 | Side | Where it runs | What it is |
 | --- | --- | --- |
-| **Producer** | the worker | `ArchivingJUnitResultParser`, a drop-in `parser=` for `PytestOperator` |
+| **Producer** | the worker | `ArchivingResultParser`, a drop-in `parser=` for `PytestOperator` |
 | **Reader** | the API server | a FastAPI app + single-page viewer, registered as an Airflow plugin |
 
+## Contents
+
+- [Screenshots](#screenshots)
+- [Install](#install)
+- [Quickstart](#quickstart)
+- [Do I need `cleanup="never"`?](#do-i-need-cleanupnever)
+- [How it works](#how-it-works)
+- [HTTP API](#http-api)
+- [Access control (RBAC)](#access-control-rbac)
+- [Configuration](#configuration)
+- [Architecture (SOLID)](#architecture-solid)
+- [Development](#development)
+- [License](#license)
+
+## Screenshots
+
+**Overview** — the run list with the historical chart (per-status legend
+toggles, run numbers, and a carousel beyond 30 runs), KPI cards, and Airflow-
+matched colours and font:
+
+![Pytest Reports — overview](https://raw.githubusercontent.com/IKrysanov/airflow-pytest-plugin/main/docs/screenshots/overview.png)
+
+**A single run** — a clickable success donut (pass-rate in the centre; click a
+slice to filter by status), the counts, and every test's captured output on
+expand:
+
+![Pytest Reports — a single run](https://raw.githubusercontent.com/IKrysanov/airflow-pytest-plugin/main/docs/screenshots/detail.png)
+
 ---
 
 ## Install
@@ -53,12 +81,12 @@ enough there too; the `[web]` extra only adds the standalone dev server.
 
 ```python
 from airflow_pytest_operator import PytestOperator
-from airflow_pytest_plugin import ArchivingJUnitResultParser
+from airflow_pytest_plugin import ArchivingResultParser
 
 PytestOperator(
     task_id="run_tests",
     test_path="tests/",
-    parser=ArchivingJUnitResultParser(),   # was JUnitResultParser()
+    parser=ArchivingResultParser(),   # was JUnitResultParser()
 )
 ```
 
@@ -96,7 +124,7 @@ python -m airflow_pytest_plugin.web --root ./pytest-reports --port 8000
 
 **No.** In the operator, the *parser* owns the report location, and a
 **parser-supplied directory is never deleted by the runner under any cleanup
-policy**. `ArchivingJUnitResultParser` supplies its own directory, so reports
+policy**. `ArchivingResultParser` supplies its own directory, so reports
 always survive regardless of the runner's `cleanup` setting. `cleanup="never"`
 only matters when you let the runner use throwaway temp dirs — which is exactly
 the fragile path (random names, no `dag/run/task` association, not visible to
@@ -108,7 +136,7 @@ other workers) this plugin replaces.
 worker                              shared volume                 API server
 ──────                              ─────────────                 ──────────
 PytestOperator                      {root}/{dag}/{run}/           FastAPI app
-  └─ ArchivingJUnitResultParser ──▶   {task}/t{try}/        ◀──── FileSystemReportSource
+  └─ ArchivingResultParser ──▶   {task}/t{try}/        ◀──── FileSystemReportSource
        report_request() → path          ├─ junit.xml              └─ lists meta.json,
        parse()          → meta.json     └─ meta.json                 parses junit.xml
 ```
@@ -136,9 +164,59 @@ runtime. Endpoints (relative to the mount):
 | `GET /` | the single-page viewer (HTML) |
 | `GET /api/reports?dag_id=&run_id=` | summaries, newest first |
 | `GET /api/reports/{report_id}` | one report with per-case rows |
+| `DELETE /api/reports/{report_id}` | delete a report (RBAC-gated) |
+| `GET /api/reports/{report_id}/allure.zip` | raw Allure results as a zip (if any) |
 | `GET /api/health` | `{"status": "ok"}` |
 | `GET /api/docs` | OpenAPI docs |
 
+The reads (`GET`) and the delete are gated by Airflow RBAC — see below.
+
+## Access control (RBAC)
+
+Access is enforced the way Airflow 3 enforces it: every check goes through
+Airflow's **auth manager** (`is_authorized_dag(...)`) — the same call Airflow's
+own DAG-run endpoints make — keyed by the report's `dag_id` and the
+authenticated user. Two permissions are checked:
+
+| Action | Airflow 3.x check | Airflow 2.x (FAB) equivalent |
+| --- | --- | --- |
+| **See / open a report** | `is_authorized_dag(method="GET", access_entity=RUN)` | `can_read` on the DAG |
+| **Delete a report** | `is_authorized_dag(method="POST", access_entity=RUN)` (may trigger the DAG) | trigger / `can_create` on the DAG |
+
+The report list is filtered to the DAGs you may read, opening a report you can't
+read returns `403`, and deleting one requires permission to **trigger** its DAG.
+Every check **fails closed**: if the auth manager can't be consulted, access is
+denied.
+
+**Airflow 2 → 3 mapping.** Airflow 2's FAB used `(action, resource)` pairs —
+`can_read` / `can_edit` / `can_delete` / `can_create` on a resource such as
+`DAG:<id>`. Airflow 3 replaced these with the auth manager's `method`: `GET` ↔
+read, `POST` ↔ create, `PUT` ↔ edit, `DELETE` ↔ delete, `MENU` ↔ menu access.
+This plugin maps **read → `GET`** and **delete → `POST`** (trigger), so it
+inherits your existing per-DAG roles with no extra configuration.
+
+**Plugin visibility.** The nav entry is an Airflow `external_views` item, which
+has no per-permission gate, so the menu link is visible to every signed-in user;
+access is enforced on the **content** (a user who may read no DAG sees an empty
+list and `403` on direct links). The standalone dev server (no Airflow auth)
+allows everything.
+
+## Allure / TestOps export
+
+Opt in per task and install [`allure-pytest`](https://pypi.org/project/allure-pytest/)
+on the worker:
+
+```python
+parser=ArchivingResultParser(allure=True)
+```
+
+The parser then adds `--alluredir` (pytest errors with *unrecognized arguments*
+if `allure-pytest` is missing), so the **raw Allure results** are archived next to
+the report, with an `executor.json` linking the launch back to the Airflow run.
+Download them from a report's detail view, or `GET
+/api/reports/{id}/allure.zip` — then upload to [Allure TestOps](https://qameta.io/)
+(`allurectl upload …`). The JUnit viewer is unaffected; both artifacts coexist.
+
 ## Configuration
 
 | Setting | Default | Purpose |
@@ -154,7 +232,7 @@ Mirrors the operator's layering — each piece has one reason to change:
 | Module | Responsibility |
 | --- | --- |
 | `layout.ReportLayout` | the single `ReportRef → directory` mapping, shared by both sides |
-| `producer.ArchivingJUnitResultParser` | write JUnit XML + `meta.json` (extends the operator's parser) |
+| `producer.ArchivingResultParser` | write JUnit XML + `meta.json` (extends the operator's parser) |
 | `sources.ReportSource` / `FileSystemReportSource` | read/index reports behind an interface (Dependency Inversion) |
 | `web.create_app` | map HTTP onto a `ReportSource` — knows nothing about the filesystem |
 | `plugin.PytestReportsPlugin` | register the app with Airflow |

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/examples/example_dag.py

@@ -15,7 +15,7 @@
 """Minimal DAG wiring the archiving parser into a PytestOperator.
 
 The only change from a plain operator setup is the ``parser=`` argument: swap
-``JUnitResultParser`` for ``ArchivingJUnitResultParser`` and every run is
+``JUnitResultParser`` for ``ArchivingResultParser`` and every run is
 archived where the Pytest Reports UI can find it. No ``cleanup`` tuning needed
 -- a parser-supplied directory is never removed by the runner.
 """
@@ -26,7 +26,7 @@ import pendulum
 from airflow import DAG
 from airflow_pytest_operator import PytestOperator
 
-from airflow_pytest_plugin import ArchivingJUnitResultParser
+from airflow_pytest_plugin import ArchivingResultParser
 
 with DAG(
     dag_id="pytest_reports_example",
@@ -40,7 +40,7 @@ with DAG(
         test_path="tests/",
         # report_root defaults to AIRFLOW_PYTEST_REPORTS_ROOT / the
         # [pytest_reports] reports_root config / /opt/airflow/pytest-reports.
-        parser=ArchivingJUnitResultParser(),
+        parser=ArchivingResultParser(allure=False),
         # Tests failing should not abort the pipeline here; the outcome is in
         # XCom and in the reports UI either way.
         fail_on_test_failure=False,

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "airflow-pytest-plugin"
-version = "0.1.0"
+version = "0.2.0"
 description = "View airflow-pytest-operator results in the Airflow 3 web UI."
 readme = "README.md"
 requires-python = ">=3.10"

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/src/airflow_pytest_plugin/__init__.py

@@ -12,19 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""View airflow-pytest-operator results in the Airflow 3 web UI.
-
-A producer-side parser archives each JUnit report plus a ``meta.json`` sidecar;
-a reader-side source and a FastAPI plugin serve a viewer over them.
-
-Public API:
-    ArchivingJUnitResultParser -- producer-side parser (use as ``parser=``)
-    ReportSource / FileSystemReportSource -- reader interface + default source
-    ReportRef / ReportSummary / ReportDetail / CaseView -- view models
-    ReportLayout       -- the shared on-disk layout
-    get_reports_root   -- resolve the report root (env/conf/default)
-    create_app         -- build the FastAPI app (lazy; needs FastAPI)
-"""
+"""View airflow-pytest-operator results in the Airflow 3 web UI."""
 
 from __future__ import annotations
 
@@ -33,18 +21,16 @@ from typing import TYPE_CHECKING
 from .config import get_reports_root
 from .layout import ReportLayout
 from .models import CaseView, ReportDetail, ReportRef, ReportSummary
-from .producer import ArchivingJUnitResultParser
+from .producer import ArchivingResultParser
 from .sources import FileSystemReportSource, ReportSource
 from .version import __version__ as __version__
 
 if TYPE_CHECKING:
-    # Exposed lazily via __getattr__ so importing the package never eagerly
-    # imports FastAPI (the producer-side parser must import cleanly on a worker
-    # that has no web stack).
+    # Exposed lazily via __getattr__ so importing the package never imports FastAPI.
     from .web import create_app as create_app
 
 __all__ = [
-    "ArchivingJUnitResultParser",
+    "ArchivingResultParser",
     "ReportSource",
     "FileSystemReportSource",
     "ReportRef",

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/src/airflow_pytest_plugin/compat/__init__.py

@@ -17,13 +17,21 @@
 from __future__ import annotations
 
 from .airflow import (
+    airflow_auth_available,
     get_airflow_plugin_base,
     get_conf_value,
     get_current_context,
+    get_user_dependency,
+    is_authorized_to_read,
+    is_authorized_to_trigger,
 )
 
 __all__ = [
     "get_current_context",
     "get_airflow_plugin_base",
     "get_conf_value",
+    "airflow_auth_available",
+    "get_user_dependency",
+    "is_authorized_to_read",
+    "is_authorized_to_trigger",
 ]

airflow_pytest_plugin-0.2.0/src/airflow_pytest_plugin/compat/airflow.py

@@ -0,0 +1,128 @@
+# Copyright 2026 the airflow-pytest-plugin contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Airflow version compatibility shim -- the only module that imports Airflow.
+
+Every Airflow import is lazy (inside a function) so importing the plugin never
+drags in the Task SDK. 2.x/3.x differences resolved here, degrading gracefully
+when Airflow is absent.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, cast
+
+_log = logging.getLogger(__name__)
+
+
+def get_current_context() -> dict[str, Any] | None:
+    """Return the running task's Airflow context, or ``None`` if unavailable."""
+    # Airflow 3.x (Task SDK), then 2.x.
+    try:
+        from airflow.sdk import get_current_context as _gcc3
+
+        return dict(_gcc3())
+    except Exception:
+        pass
+    try:
+        from airflow.operators.python import get_current_context as _gcc2
+
+        return dict(_gcc2())
+    except Exception:
+        return None
+
+
+def get_airflow_plugin_base() -> type[Any]:
+    """Return ``airflow.plugins_manager.AirflowPlugin`` (raises if Airflow absent)."""
+    from airflow.plugins_manager import AirflowPlugin
+
+    return cast("type[Any]", AirflowPlugin)
+
+
+def get_conf_value(section: str, key: str) -> str | None:
+    """Read a value from ``airflow.cfg`` / env, or ``None`` if unset/absent."""
+    try:
+        from airflow.configuration import conf
+
+        # Annotate rather than cast: clean whether conf.get is typed str | None or Any.
+        value: str | None = conf.get(section, key, fallback=None)
+        return value
+    except Exception:
+        return None
+
+
+def airflow_auth_available() -> bool:
+    """True if Airflow 3's FastAPI auth (current-user dependency) is importable."""
+    try:
+        from airflow.api_fastapi.core_api.security import get_user  # noqa: F401
+
+        return True
+    except Exception:
+        return False
+
+
+def get_user_dependency() -> Any:
+    """Return Airflow's ``get_user`` FastAPI dependency (call only when auth available)."""
+    from airflow.api_fastapi.core_api.security import get_user
+
+    return get_user
+
+
+def is_authorized_to_trigger(dag_id: str, user: Any) -> bool:
+    """True if ``user`` may trigger ``dag_id`` (gates report deletion)."""
+    return _is_authorized_dag("POST", dag_id, user)
+
+
+def is_authorized_to_read(dag_id: str, user: Any) -> bool:
+    """True if ``user`` may read ``dag_id`` (gates listing / detail)."""
+    return _is_authorized_dag("GET", dag_id, user)
+
+
+def _is_authorized_dag(method: str, dag_id: str, user: Any) -> bool:
+    """Ask the Airflow auth manager about a DAG-run action. Fails **closed**."""
+    try:
+        from airflow.api_fastapi.auth.managers.models.resource_details import (
+            DagAccessEntity,
+            DagDetails,
+        )
+
+        manager = _resolve_auth_manager()
+        return bool(
+            manager.is_authorized_dag(
+                method=method,
+                access_entity=DagAccessEntity.RUN,
+                details=DagDetails(id=dag_id),
+                user=user,
+            )
+        )
+    except Exception:
+        _log.warning(
+            "DAG authorization check (%s) failed; denying", method, exc_info=True
+        )
+        return False
+
+
+def _resolve_auth_manager() -> Any:
+    """Return the active Airflow auth manager across known import locations."""
+    for module_name in (
+        "airflow.api_fastapi.app",
+        "airflow.www.extensions.init_auth_manager",
+    ):
+        try:
+            module = __import__(module_name, fromlist=["get_auth_manager"])
+            return module.get_auth_manager()
+        except Exception:
+            continue
+    raise RuntimeError("could not resolve the Airflow auth manager")

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/src/airflow_pytest_plugin/config.py

@@ -12,14 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Resolve the report root -- the same way on producer and reader.
-
-Precedence, highest first:
-1. an explicit argument in code (handled by the caller);
-2. ``AIRFLOW_PYTEST_REPORTS_ROOT`` (env);
-3. ``[pytest_reports] reports_root`` (Airflow config);
-4. the default ``/opt/airflow/pytest-reports``.
-"""
+"""Resolve the report root (env, then Airflow config, then default)."""
 
 from __future__ import annotations
 

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/src/airflow_pytest_plugin/layout.py

@@ -12,14 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""The on-disk layout -- the one place that knows where a report lives.
-
-Shared by the producer (which asks where to write) and the reader (where to read
-a report, and how to discover all of them via :data:`META_FILENAME`), so the two
-can never drift. The directory is a human-friendly container; the authoritative
-identity lives in ``meta.json`` / the :class:`ReportRef` token, so the path
-sanitisation below can be lossy without losing information.
-"""
+"""The on-disk layout: maps a report to its directory, shared by producer and reader."""
 
 from __future__ import annotations
 
@@ -32,29 +25,26 @@ from .models import ReportRef
 REPORT_FILENAME = "junit.xml"
 #: The sidecar identity+summary file. Its presence marks a stored report.
 META_FILENAME = "meta.json"
+#: Subdir of a report holding raw Allure results (for Allure TestOps export).
+ALLURE_DIRNAME = "allure-results"
 
-# Filesystem-safe component encoder. Airflow ``run_id`` values routinely carry
-# ``:`` and ``+`` (e.g. ``scheduled__2024-01-01T00:00:00+00:00``), which are
-# awkward or illegal on some filesystems. We map anything outside a conservative
-# safe set to ``_``. This is intentionally lossy: the true, exact identity is
-# preserved in meta.json / the ReportRef token, never recovered from the path.
+# Map filesystem-unsafe chars to ``_``. Intentionally lossy; exact identity lives
+# in meta.json / the ReportRef token, never recovered from the path.
 _UNSAFE = re.compile(r"[^A-Za-z0-9._=+-]")
 
 
 def _safe(component: str) -> str:
     cleaned = _UNSAFE.sub("_", component)
-    # Guard against empty / dot components producing a path that escapes root.
-    return cleaned or "_"
+    # Neutralise empty / dot-only components so a path-traversal segment can never escape the root.
+    if not cleaned or set(cleaned) <= {"."}:
+        return "_"
+    return cleaned
 
 
 class ReportLayout:
     """Maps a :class:`ReportRef` to its directory under a report root::
 
-        {root}/{dag_id}/{run_id}/{task_id}/t{try_number}[/m{map_index}]
-
-    The ``m{map_index}`` segment is added only for mapped tasks. A pure function
-    of its inputs, so the reader can locate a report from a token without
-    scanning the filesystem.
+    {root}/{dag_id}/{run_id}/{task_id}/t{try_number}[/m{map_index}]
     """
 
     def dir_for(self, root: str, ref: ReportRef) -> str:

{airflow_pytest_plugin-0.1.0 → airflow_pytest_plugin-0.2.0}/src/airflow_pytest_plugin/models.py

@@ -12,14 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""View models for the reports UI.
-
-JSON-serializable domain types that sit above the operator's ``TestRunResult`` /
-``CaseResult`` (used only for parsing), so the web layer never sees operator
-types. A report is identified by its Airflow coordinates (:class:`ReportRef`);
-its :pyattr:`token` is an opaque, reversible id used in the HTTP API, so an
-endpoint can rebuild the ref (and on-disk location) without scanning.
-"""
+"""JSON-serializable view models for the reports UI."""
 
 from __future__ import annotations
 
@@ -44,9 +37,8 @@ def _decode_token(token: str) -> dict[str, Any]:
 class ReportRef:
     """The Airflow coordinates that uniquely identify one stored report.
 
-    ``map_index`` is ``-1`` for an ordinary (non-mapped) task instance, matching
-    Airflow's own convention, and ``>= 0`` for a single expanded element of a
-    dynamically-mapped task.
+    ``map_index`` is ``-1`` for a non-mapped task (Airflow's convention), ``>= 0``
+    for one expanded element of a mapped task.
     """
 
     dag_id: str
@@ -57,7 +49,7 @@ class ReportRef:
 
     @property
     def token(self) -> str:
-        """An opaque, URL-safe, reversible id for use in the HTTP API."""
+        """An opaque, URL-safe, reversible id for the HTTP API."""
         return _encode_token(
             {
                 "d": self.dag_id,
@@ -73,12 +65,16 @@ class ReportRef:
         """Inverse of :pyattr:`token`. Raises ``ValueError`` on a bad token."""
         try:
             d = _decode_token(token)
+            try_number = int(d["n"])
+            map_index = int(d["m"])
+            if try_number < 0 or map_index < -1:
+                raise ValueError("out-of-range try_number/map_index")
             return cls(
                 dag_id=str(d["d"]),
                 run_id=str(d["r"]),
                 task_id=str(d["t"]),
-                try_number=int(d["n"]),
-                map_index=int(d["m"]),
+                try_number=try_number,
+                map_index=map_index,
             )
         except (KeyError, ValueError, TypeError, json.JSONDecodeError) as exc:
             raise ValueError(f"malformed report token: {token!r}") from exc
@@ -86,10 +82,7 @@ class ReportRef:
 
 @dataclass(frozen=True)
 class ReportSummary:
-    """The headline numbers for one run -- enough to render a list row.
-
-    Built directly from ``meta.json`` so listing never has to parse XML.
-    """
+    """The headline numbers for one run, built from ``meta.json`` (no XML parse)."""
 
     ref: ReportRef
     total: int
@@ -101,6 +94,7 @@ class ReportSummary:
     success: bool
     created_at: str | None = None
     logical_date: str | None = None
+    has_allure: bool = False
 
     def to_dict(self) -> dict[str, Any]:
         return {
@@ -119,6 +113,7 @@ class ReportSummary:
             "success": self.success,
             "created_at": self.created_at,
             "logical_date": self.logical_date,
+            "has_allure": self.has_allure,
         }