canvas 0.15.0__py3-none-any.whl → 0.17.0__py3-none-any.whl

plugin_runner/plugin_installer.py

@@ -14,9 +14,17 @@ import requests
 from psycopg import Connection
 from psycopg.rows import dict_row
 
-import settings
 from plugin_runner.aws_headers import aws_sig_v4_headers
 from plugin_runner.exceptions import InvalidPluginFormat, PluginInstallationError
+from settings import (
+    AWS_ACCESS_KEY_ID,
+    AWS_REGION,
+    AWS_SECRET_ACCESS_KEY,
+    CUSTOMER_IDENTIFIER,
+    MEDIA_S3_BUCKET_NAME,
+    PLUGIN_DIRECTORY,
+    SECRETS_FILE_NAME,
+)
 
 # Plugin "packages" include this prefix in the database record for the plugin and the S3 bucket key.
 UPLOAD_TO_PREFIX = "plugins"
@@ -100,19 +108,19 @@ def _extract_rows_to_dict(rows: list) -> dict[str, PluginAttributes]:
 def download_plugin(plugin_package: str) -> Generator[Path, None, None]:
     """Download the plugin package from the S3 bucket."""
     method = "GET"
-    host = f"s3-{settings.AWS_REGION}.amazonaws.com"
-    bucket = settings.MEDIA_S3_BUCKET_NAME
-    customer_identifier = settings.CUSTOMER_IDENTIFIER
+    host = f"s3-{AWS_REGION}.amazonaws.com"
+    bucket = MEDIA_S3_BUCKET_NAME
+    customer_identifier = CUSTOMER_IDENTIFIER
     path = f"/{bucket}/{customer_identifier}/{plugin_package}"
     payload = b"This is required for the AWS headers because it is part of the signature"
     pre_auth_headers: dict[str, str] = {}
     query: dict[str, str] = {}
     headers = aws_sig_v4_headers(
-        settings.AWS_ACCESS_KEY_ID,
-        settings.AWS_SECRET_ACCESS_KEY,
+        AWS_ACCESS_KEY_ID,
+        AWS_SECRET_ACCESS_KEY,
         pre_auth_headers,
         "s3",
-        settings.AWS_REGION,
+        AWS_REGION,
         host,
         method,
         path,
@@ -135,7 +143,7 @@ def install_plugin(plugin_name: str, attributes: PluginAttributes) -> None:
     try:
         print(f"Installing plugin '{plugin_name}'")
 
-        plugin_installation_path = Path(settings.PLUGIN_DIRECTORY) / plugin_name
+        plugin_installation_path = Path(PLUGIN_DIRECTORY) / plugin_name
 
         # if plugin exists, first uninstall it
         if plugin_installation_path.exists():
@@ -175,7 +183,7 @@ def install_plugin_secrets(plugin_name: str, secrets: dict[str, str]) -> None:
     """Write the plugin's secrets to disk in the package's directory."""
     print(f"Writing plugin secrets for '{plugin_name}'")
 
-    secrets_path = Path(settings.PLUGIN_DIRECTORY) / plugin_name / settings.SECRETS_FILE_NAME
+    secrets_path = Path(PLUGIN_DIRECTORY) / plugin_name / SECRETS_FILE_NAME
 
     # Did the plugin ship a secrets.json? TOO BAD, IT'S GONE NOW.
     if Path(secrets_path).exists():
@@ -199,7 +207,7 @@ def disable_plugin(plugin_name: str) -> None:
 
 def uninstall_plugin(plugin_name: str) -> None:
     """Remove the plugin from the filesystem."""
-    plugin_path = Path(settings.PLUGIN_DIRECTORY) / plugin_name
+    plugin_path = Path(PLUGIN_DIRECTORY) / plugin_name
 
     if plugin_path.exists():
         shutil.rmtree(plugin_path)
@@ -207,10 +215,10 @@ def uninstall_plugin(plugin_name: str) -> None:
 
 def install_plugins() -> None:
     """Install all enabled plugins."""
-    if Path(settings.PLUGIN_DIRECTORY).exists():
-        shutil.rmtree(settings.PLUGIN_DIRECTORY)
+    if Path(PLUGIN_DIRECTORY).exists():
+        shutil.rmtree(PLUGIN_DIRECTORY)
 
-    os.mkdir(settings.PLUGIN_DIRECTORY)
+    os.mkdir(PLUGIN_DIRECTORY)
 
     for plugin_name, attributes in enabled_plugins().items():
         try:

plugin_runner/plugin_runner.py

@@ -2,17 +2,17 @@ import asyncio
 import json
 import os
 import pathlib
+import pickle
 import pkgutil
-import signal
 import sys
 import time
 import traceback
 from collections import defaultdict
 from collections.abc import AsyncGenerator
-from types import FrameType
 from typing import Any, TypedDict
 
 import grpc
+import redis.asyncio as redis
 import statsd
 
 from canvas_generated.messages.effects_pb2 import EffectType
@@ -30,9 +30,15 @@ from canvas_sdk.protocols import ClinicalQualityMeasure
 from canvas_sdk.utils.stats import get_duration_ms, tags_to_line_protocol
 from logger import log
 from plugin_runner.authentication import token_for_plugin
-from plugin_runner.plugin_synchronizer import publish_message
+from plugin_runner.plugin_installer import install_plugins
 from plugin_runner.sandbox import Sandbox
-from settings import MANIFEST_FILE_NAME, PLUGIN_DIRECTORY, SECRETS_FILE_NAME
+from settings import (
+    CHANNEL_NAME,
+    MANIFEST_FILE_NAME,
+    PLUGIN_DIRECTORY,
+    REDIS_ENDPOINT,
+    SECRETS_FILE_NAME,
+)
 
 # when we import plugins we'll use the module name directly so we need to add the plugin
 # directory to the path
@@ -192,14 +198,50 @@ class PluginRunner(PluginRunnerServicer):
         self, request: ReloadPluginsRequest, context: Any
     ) -> AsyncGenerator[ReloadPluginsResponse, None]:
         """This is invoked when we need to reload plugins."""
+        log.info("Reloading plugins...")
         try:
-            publish_message({"action": "restart"})
+            await publish_message(message={"action": "reload"})
         except ImportError:
             yield ReloadPluginsResponse(success=False)
         else:
             yield ReloadPluginsResponse(success=True)
 
 
+async def synchronize_plugins(max_iterations: None | int = None) -> None:
+    """Listen for messages on the pubsub channel that will indicate it is necessary to reinstall and reload plugins."""
+    client, pubsub = get_client()
+    await pubsub.psubscribe(CHANNEL_NAME)
+    log.info("Listening for messages on pubsub channel")
+    iterations: int = 0
+    while (
+        max_iterations is None or iterations < max_iterations
+    ):  # max_iterations == -1 means infinite iterations
+        iterations += 1
+        message = await pubsub.get_message(ignore_subscribe_messages=True, timeout=None)
+        if message is not None:
+            log.info("Received message from pubsub channel")
+
+            message_type = message.get("type", "")
+
+            if message_type != "pmessage":
+                continue
+
+            data = pickle.loads(message.get("data", pickle.dumps({})))
+
+            if "action" not in data:
+                continue
+
+            if data["action"] == "reload":
+                try:
+                    log.info(
+                        "plugin-synchronizer: installing and reloading plugins after receiving command"
+                    )
+                    install_plugins()
+                    load_plugins()
+                except Exception as e:
+                    print("plugin-synchronizer: `install_plugins` failed:", e)
+
+
 def validate_effects(effects: list[Effect]) -> list[Effect]:
     """Validates the effects based on predefined rules.
     Keeps only the first AUTOCOMPLETE_SEARCH_RESULTS effect and preserve all non-search-related effects.
@@ -237,12 +279,6 @@ def apply_effects_to_context(effects: list[Effect], event: Event) -> Event:
     return event
 
 
-def handle_hup_cb(_signum: int, _frame: FrameType | None) -> None:
-    """handle_hup_cb."""
-    log.info("Received SIGHUP, reloading plugins...")
-    load_plugins()
-
-
 def find_modules(base_path: pathlib.Path, prefix: str | None = None) -> list[str]:
     """Find all modules in the specified package path."""
     modules: list[str] = []
@@ -273,6 +309,22 @@ def sandbox_from_module(base_path: pathlib.Path, module_name: str) -> Any:
     return sandbox.execute()
 
 
+async def publish_message(message: dict) -> None:
+    """Publish a message to the pubsub channel."""
+    log.info("Publishing message to pubsub channel")
+    client, _ = get_client()
+
+    await client.publish(CHANNEL_NAME, pickle.dumps(message))
+
+
+def get_client() -> tuple[redis.Redis, redis.client.PubSub]:
+    """Return an async Redis client and pubsub object."""
+    client = redis.Redis.from_url(REDIS_ENDPOINT)
+    pubsub = client.pubsub()
+
+    return client, pubsub
+
+
 def load_or_reload_plugin(path: pathlib.Path) -> None:
     """Given a path, load or reload a plugin."""
     log.info(f"Loading {path}")
@@ -415,6 +467,7 @@ async def serve(specified_plugin_paths: list[str] | None = None) -> None:
 
     log.info(f"Starting server, listening on port {port}")
 
+    install_plugins()
     load_plugins(specified_plugin_paths)
 
     await server.start()
@@ -434,10 +487,10 @@ def run_server(specified_plugin_paths: list[str] | None = None) -> None:
 
     asyncio.set_event_loop(loop)
 
-    signal.signal(signal.SIGHUP, handle_hup_cb)
-
     try:
-        loop.run_until_complete(serve(specified_plugin_paths))
+        loop.run_until_complete(
+            asyncio.gather(serve(specified_plugin_paths), synchronize_plugins())
+        )
     except KeyboardInterrupt:
         pass
     finally:

plugin_runner/sandbox.py

@@ -46,6 +46,7 @@ ALLOWED_MODULES = frozenset(
         "canvas_sdk.handlers",
         "canvas_sdk.protocols",
         "canvas_sdk.utils",
+        "canvas_sdk.templates",
         "canvas_sdk.v1",
         "canvas_sdk.value_set",
         "canvas_sdk.views",
@@ -81,6 +82,14 @@ ALLOWED_MODULES = frozenset(
 )
 
 
+##
+# FORBIDDEN_ASSIGNMENTS
+#
+# The names in this list are forbidden to be assigned to in a sandboxed runtime.
+#
+FORBIDDEN_ASSIGNMENTS = frozenset(["__name__", "__is_plugin__"])
+
+
 def _is_known_module(name: str) -> bool:
     return any(name.startswith(m) for m in ALLOWED_MODULES)
 
@@ -174,6 +183,24 @@ class Sandbox:
             elif name in FORBIDDEN_FUNC_NAMES:
                 self.error(node, f'"{name}" is a reserved name.')
 
+        def visit_Assign(self, node: ast.Assign) -> ast.AST:
+            """Check for forbidden assignments."""
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id in FORBIDDEN_ASSIGNMENTS:
+                    self.error(node, f"Assignments to '{target.id}' are not allowed.")
+                elif isinstance(target, ast.Tuple | ast.List):
+                    self.check_for_name_in_iterable(target)
+
+            return super().visit_Assign(node)
+
+        def check_for_name_in_iterable(self, iterable_node: ast.Tuple | ast.List) -> None:
+            """Check if any element of an iterable is a forbidden assignment."""
+            for elt in iterable_node.elts:
+                if isinstance(elt, ast.Name) and elt.id in FORBIDDEN_ASSIGNMENTS:
+                    self.error(iterable_node, f"Assignments to '{elt.id}' are not allowed.")
+                elif isinstance(elt, ast.Tuple | ast.List):
+                    self.check_for_name_in_iterable(elt)
+
         def visit_Attribute(self, node: ast.Attribute) -> ast.AST:
             """Checks and mutates attribute access/assignment.
 
@@ -272,6 +299,7 @@ class Sandbox:
             },
             "__metaclass__": type,
             "__name__": self.namespace,
+            "__is_plugin__": True,
             "_write_": _unrestricted,
             "_getiter_": _unrestricted,
             "_getitem_": default_guarded_getitem,

plugin_runner/tests/fixtures/plugins/test_render_template/CANVAS_MANIFEST.json

@@ -0,0 +1,47 @@
+{
+    "sdk_version": "0.1.4",
+    "plugin_version": "0.0.1",
+    "name": "test_render_template",
+    "description": "Edit the description in CANVAS_MANIFEST.json",
+    "components": {
+        "protocols": [
+            {
+                "class": "test_render_template.protocols.my_protocol:ValidTemplate",
+                "description": "A protocol that does xyz...",
+                "data_access": {
+                    "event": "",
+                    "read": [],
+                    "write": []
+                }
+            },
+             {
+                "class": "test_render_template.protocols.my_protocol:InvalidTemplate",
+                "description": "A protocol that does xyz...",
+                "data_access": {
+                    "event": "",
+                    "read": [],
+                    "write": []
+                }
+            },
+             {
+                "class": "test_render_template.protocols.my_protocol:ForbiddenTemplate",
+                "description": "A protocol that does xyz...",
+                "data_access": {
+                    "event": "",
+                    "read": [],
+                    "write": []
+                }
+            }
+        ],
+        "commands": [],
+        "content": [],
+        "effects": [],
+        "views": []
+    },
+    "secrets": [],
+    "tags": {},
+    "references": [],
+    "license": "",
+    "diagram": false,
+    "readme": "./README.md"
+}

plugin_runner/tests/fixtures/plugins/test_render_template/README.md

@@ -0,0 +1,11 @@
+test_render_template
+====================
+
+## Description
+
+A description of this plugin
+
+### Important Note!
+
+The CANVAS_MANIFEST.json is used when installing your plugin. Please ensure it
+gets updated if you add, remove, or rename protocols.

plugin_runner/tests/fixtures/plugins/test_render_template/protocols/my_protocol.py

@@ -0,0 +1,43 @@
+from canvas_sdk.effects import Effect, EffectType
+from canvas_sdk.events import EventType
+from canvas_sdk.protocols import BaseProtocol
+from canvas_sdk.templates import render_to_string
+
+
+class ValidTemplate(BaseProtocol):
+    """You should put a helpful description of this protocol's behavior here."""
+
+    RESPONDS_TO = [EventType.Name(EventType.UNKNOWN)]
+
+    def compute(self) -> list[Effect]:
+        """This method gets called when an event of the type RESPONDS_TO is fired."""
+        return [
+            Effect(type=EffectType.LOG, payload=render_to_string("templates/template.html", None))
+        ]
+
+
+class InvalidTemplate(BaseProtocol):
+    """You should put a helpful description of this protocol's behavior here."""
+
+    RESPONDS_TO = [EventType.Name(EventType.UNKNOWN)]
+
+    def compute(self) -> list[Effect]:
+        """This method gets called when an event of the type RESPONDS_TO is fired."""
+        return [
+            Effect(type=EffectType.LOG, payload=render_to_string("templates/template1.html", None))
+        ]
+
+
+class ForbiddenTemplate(BaseProtocol):
+    """You should put a helpful description of this protocol's behavior here."""
+
+    RESPONDS_TO = [EventType.Name(EventType.UNKNOWN)]
+
+    def compute(self) -> list[Effect]:
+        """This method gets called when an event of the type RESPONDS_TO is fired."""
+        return [
+            Effect(
+                type=EffectType.LOG,
+                payload=render_to_string("../../templates/template.html", None),
+            )
+        ]

plugin_runner/tests/fixtures/plugins/test_render_template/templates/template.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <title>Title</title>
+  </head>
+  <body>
+
+  </body>
+</html>

plugin_runner/tests/test_plugin_runner.py

@@ -1,8 +1,9 @@
+import asyncio
 import logging
+import pickle
 import shutil
-from collections.abc import Generator
 from pathlib import Path
-from unittest.mock import MagicMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
@@ -15,54 +16,10 @@ from plugin_runner.plugin_runner import (
     PluginRunner,
     load_or_reload_plugin,
     load_plugins,
+    synchronize_plugins,
 )
 
 
-@pytest.fixture
-def install_test_plugin(request: pytest.FixtureRequest) -> Generator[Path, None, None]:
-    """Copies a specified plugin from the fixtures directory to the data directory
-    and removes it after the test.
-
-    Parameters:
-    - request.param: The name of the plugin package to copy.
-
-    Yields:
-    - Path to the copied plugin directory.
-    """
-    # Define base directories
-    base_dir = Path("./plugin_runner/tests")
-    fixture_plugin_dir = base_dir / "fixtures" / "plugins"
-    data_plugin_dir = base_dir / "data" / "plugins"
-
-    # The plugin name should be passed as a parameter to the fixture
-    plugin_name = request.param  # Expected to be a str
-    src_plugin_path = fixture_plugin_dir / plugin_name
-    dest_plugin_path = data_plugin_dir / plugin_name
-
-    # Ensure the data plugin directory exists
-    data_plugin_dir.mkdir(parents=True, exist_ok=True)
-
-    # Copy the specific plugin from fixtures to data
-    try:
-        shutil.copytree(src_plugin_path, dest_plugin_path)
-        yield dest_plugin_path  # Provide the path to the test
-    finally:
-        # Cleanup: remove data/plugins directory after the test
-        if dest_plugin_path.exists():
-            shutil.rmtree(dest_plugin_path)
-
-
-@pytest.fixture
-def load_test_plugins() -> Generator[None, None, None]:
-    """Manages the lifecycle of test plugins by loading and unloading them."""
-    try:
-        load_plugins()
-        yield
-    finally:
-        LOADED_PLUGINS.clear()
-        EVENT_HANDLER_MAP.clear()
-
-
 @pytest.fixture
 def plugin_runner() -> PluginRunner:
     """Fixture to initialize PluginRunner with mocks."""
@@ -275,24 +232,53 @@ async def test_handle_plugin_event_returns_expected_result(
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize("install_test_plugin", ["example_plugin"], indirect=True)
 async def test_reload_plugins_event_handler_successfully_publishes_message(
-    install_test_plugin: Path, plugin_runner: PluginRunner
+    plugin_runner: PluginRunner,
 ) -> None:
     """Test ReloadPlugins Event handler successfully publishes a message with restart action."""
-    with patch("plugin_runner.plugin_runner.publish_message", MagicMock()) as mock_publish_message:
+    with patch(
+        "plugin_runner.plugin_runner.publish_message", new_callable=AsyncMock
+    ) as mock_publish_message:
         request = ReloadPluginsRequest()
 
         result = []
         async for response in plugin_runner.ReloadPlugins(request, None):
             result.append(response)
 
-        mock_publish_message.assert_called_once_with({"action": "restart"})
+        mock_publish_message.assert_called_once_with(message={"action": "reload"})
 
     assert len(result) == 1
     assert result[0].success is True
 
 
+@pytest.mark.asyncio
+async def test_synchronize_plugins_calls_install_and_load_plugins() -> None:
+    """Test that synchronize_plugins calls install_plugins and load_plugins."""
+    with (
+        patch("plugin_runner.plugin_runner.get_client", new_callable=MagicMock) as mock_get_client,
+        patch(
+            "plugin_runner.plugin_runner.install_plugins", new_callable=AsyncMock
+        ) as mock_install_plugins,
+        patch(
+            "plugin_runner.plugin_runner.load_plugins", new_callable=AsyncMock
+        ) as mock_load_plugins,
+    ):
+        mock_client = AsyncMock()
+        mock_pubsub = AsyncMock()
+        mock_get_client.return_value = (mock_client, mock_pubsub)
+        mock_pubsub.get_message.return_value = {
+            "type": "pmessage",
+            "data": pickle.dumps({"action": "reload"}),
+        }
+
+        task = asyncio.create_task(synchronize_plugins(max_iterations=1))
+        await asyncio.sleep(0.1)  # Give some time for the coroutine to run
+        task.cancel()
+
+        mock_install_plugins.assert_called_once()
+        mock_load_plugins.assert_called_once()
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("install_test_plugin", ["test_module_imports_plugin"], indirect=True)
 async def test_changes_to_plugin_modules_should_be_reflected_after_reload(

plugin_runner/tests/test_sandbox.py

@@ -1,6 +1,6 @@
 import pytest
 
-from plugin_runner.sandbox import Sandbox
+from plugin_runner.sandbox import FORBIDDEN_ASSIGNMENTS, Sandbox
 
 # Sample code strings for testing various scenarios
 VALID_CODE = """
@@ -33,6 +33,18 @@ import module.b
 result = module.b
 """
 
+CODE_WITH_FORBIDDEN_ASSIGNMENTS = [
+    code
+    for var in FORBIDDEN_ASSIGNMENTS
+    for code in [
+        f"{var} = 'test'",
+        f"test = {var} = 'test'",
+        f"test = {var} = test2 = 'test'",
+        f"(a, (b, c), (d, ({var}, f))) = (1, (2, 3), (4, (5, 6)))",
+        f"(a, (b, c), (d, [{var}, f])) = (1, (2, 3), (4, [5, 6]))",
+    ]
+]
+
 
 def test_valid_code_execution() -> None:
     """Test execution of valid code in the sandbox."""
@@ -69,6 +81,14 @@ def test_forbidden_name() -> None:
         sandbox.execute()
 
 
+@pytest.mark.parametrize("code", CODE_WITH_FORBIDDEN_ASSIGNMENTS)
+def test_forbidden_assignment(code: str) -> None:
+    """Test that forbidden assignments are blocked by Transformer."""
+    sandbox = Sandbox(code)
+    with pytest.raises(RuntimeError, match="Code is invalid"):
+        sandbox.execute()
+
+
 def test_code_with_warnings() -> None:
     """Test that the sandbox captures warnings for restricted names or usage."""
     code_with_warning = """