chalkcompute 2.2.0__tar.gz → 2.3.0__tar.gz

{chalkcompute-2.2.0 → chalkcompute-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chalkcompute
-Version: 2.2.0
+Version: 2.3.0
 Requires-Dist: grpcio>=1.60.0
 Requires-Dist: protobuf>=4.25.0
 Requires-Dist: httpx>=0.25.0

{chalkcompute-2.2.0 → chalkcompute-2.3.0}/chalkcompute/__init__.py

@@ -16,12 +16,10 @@ _LAZY_MAP: dict[str, tuple[str, str]] = {
     "ContainerSession": ("chalkcompute._container", "ContainerSession"),
     "ContainerSecurityPolicy": ("chalkcompute._container", "ContainerSecurityPolicy"),
     "ContainerExecResult": ("chalkcompute._container", "ExecResult"),
-    "AllowedRoute": ("chalkcompute._container", "AllowedRoute"),
     "ImageBuildError": ("chalkcompute._container", "ImageBuildError"),
     "KernelPolicy": ("chalkcompute._container", "KernelPolicy"),
     "ComputeClass": ("chalkcompute._container", "ComputeClass"),
     "NetworkPolicy": ("chalkcompute._container", "NetworkPolicy"),
-    "PortRange": ("chalkcompute._container", "PortRange"),
     # _cls.py
     "RemoteClass": ("chalkcompute._cls", "RemoteClass"),
     "ClassError": ("chalkcompute._cls", "ClassError"),

{chalkcompute-2.2.0 → chalkcompute-2.3.0}/chalkcompute/__init__.pyi

@@ -11,7 +11,6 @@ from chalkcompute._connect import build_image_from_spec as build_image
 from chalkcompute._connect import (
     build_image_with_volumes_from_spec as build_image_with_volumes,
 )
-from chalkcompute._container import AllowedRoute as AllowedRoute
 from chalkcompute._container import Container as Container
 from chalkcompute._container import ContainerError as ContainerError
 from chalkcompute._container import ContainerInfo as ContainerInfo
@@ -22,7 +21,6 @@ from chalkcompute._container import ImageBuildError as ImageBuildError
 from chalkcompute._container import ComputeClass as ComputeClass
 from chalkcompute._container import KernelPolicy as KernelPolicy
 from chalkcompute._container import NetworkPolicy as NetworkPolicy
-from chalkcompute._container import PortRange as PortRange
 from chalkcompute._function import DeployedFunction as DeployedFunction
 from chalkcompute._function import FunctionBuildError as FunctionBuildError
 from chalkcompute._function import FunctionCallHandle as FunctionCallHandle
@@ -83,12 +81,10 @@ __all__ = [
     "ContainerSession",
     "ContainerSecurityPolicy",
     "ContainerExecResult",
-    "AllowedRoute",
     "ImageBuildError",
     "ComputeClass",
     "KernelPolicy",
     "NetworkPolicy",
-    "PortRange",
     "RemoteClass",
     "ClassError",
     "ClassBuildError",

{chalkcompute-2.2.0 → chalkcompute-2.3.0}/chalkcompute/_connect.py

@@ -363,6 +363,10 @@ def build_image(
     ConnectError
         If the build fails or times out.
     """
+    image_uri = image.as_image_uri_if_possible()
+    if image_uri is not None:
+        return image_uri
+
     from google.protobuf.json_format import MessageToDict
 
     spec_dict = MessageToDict(image.to_proto())

{chalkcompute-2.2.0 → chalkcompute-2.3.0}/chalkcompute/_container.py

@@ -19,16 +19,15 @@ destination path's common ancestor.
 from __future__ import annotations
 
 import base64
-import ipaddress
 import logging
 import queue
 import time
 import uuid
 from collections import deque
-from collections.abc import Iterator
+from collections.abc import Iterable, Iterator, Mapping
 from dataclasses import dataclass, field
 from enum import Enum
-from typing import TYPE_CHECKING, Any, NoReturn
+from typing import TYPE_CHECKING, Any, NoReturn, cast
 
 import grpc
 
@@ -57,8 +56,6 @@ from chalkcompute._vvolume import VersionedVolumeClient
 logger = logging.getLogger(__name__)
 
 if TYPE_CHECKING:
-    from collections.abc import Iterable
-
     from chalkcompute._image import Image as _Image
     from chalkcompute._secret import Secret
 
@@ -145,92 +142,275 @@ class ContainerSecurityPolicy:
         return {"kernelPolicy": self.kernel_policy.value}
 
 
-@dataclass
-class PortRange:
-    """Inclusive destination port range for a network policy route."""
+_PortRangeInput = tuple[int, int] | int
+
+
+class NetworkPolicy:
+    """Network egress policy for a container.
 
-    start_port: int
-    """Inclusive start port. Must be between 1 and 65535."""
+    For HOST containers, missing and empty policies deny application egress
+    unless allowed routes or hosts are configured.
+    """
+
+    @dataclass(init=False)
+    class Route:
+        """Allowed destination CIDR and optional destination port ranges."""
+
+        route: str
+        """Destination CIDR, e.g. ``"10.0.0.0/8"``."""
+
+        ports: list[tuple[int, int]]
+        """Destination port ranges. Empty means all ports."""
+
+        def __init__(
+            self,
+            route: str,
+            *,
+            ports: Iterable[_PortRangeInput] | None = None,
+        ) -> None:
+            if not isinstance(route, str):
+                raise TypeError("route must be a string")
+            if not route:
+                raise ValueError("route must not be empty")
+            self.route = route
+            self.ports = [_coerce_port_range(port) for port in ports or []]
+
+        def to_dict(self) -> dict[str, Any]:
+            body: dict[str, Any] = {"route": self.route}
+            if self.ports:
+                body["portRanges"] = [
+                    {"startPort": start_port, "endPort": end_port}
+                    for start_port, end_port in self.ports
+                ]
+            return body
+
+    @dataclass
+    class Matcher:
+        """String matcher for path, query-string, or header values."""
+
+        exact: str | None = None
+        starts_with: str | None = None
+        regex: str | None = None
+
+        def __post_init__(self) -> None:
+            values = [
+                self.exact is not None,
+                self.starts_with is not None,
+                self.regex is not None,
+            ]
+            if sum(values) != 1:
+                raise ValueError("set exactly one of exact, starts_with, or regex")
+            for name, value in (
+                ("exact", self.exact),
+                ("starts_with", self.starts_with),
+                ("regex", self.regex),
+            ):
+                if value is not None and not isinstance(value, str):
+                    raise TypeError(f"{name} must be a string")
+
+        def to_dict(self) -> dict[str, str]:
+            if self.exact is not None:
+                return {"exact": self.exact}
+            if self.starts_with is not None:
+                return {"startsWith": self.starts_with}
+            assert self.regex is not None
+            return {"regex": self.regex}
 
-    end_port: int | None = None
-    """Inclusive end port. Defaults to ``start_port``."""
+    @dataclass
+    class KeyValueMatcher:
+        """Matcher for a query-string or header entry."""
+
+        key: NetworkPolicy.Matcher
+        value: NetworkPolicy.Matcher | None = None
+
+        def __post_init__(self) -> None:
+            if not isinstance(self.key, NetworkPolicy.Matcher):
+                raise TypeError("key must be a NetworkPolicy.Matcher")
+            if self.value is not None and not isinstance(
+                self.value, NetworkPolicy.Matcher
+            ):
+                raise TypeError("value must be a NetworkPolicy.Matcher")
+
+        def to_dict(self) -> dict[str, Any]:
+            body: dict[str, Any] = {"key": self.key.to_dict()}
+            if self.value is not None:
+                body["value"] = self.value.to_dict()
+            return body
 
-    def __post_init__(self) -> None:
-        if self.end_port is None:
-            self.end_port = self.start_port
-        _validate_port_range(self.start_port, self.end_port)
+    @dataclass
+    class Match:
+        """Request matcher for host policy rules."""
+
+        path: NetworkPolicy.Matcher | None = None
+        methods: list[str] = field(default_factory=list)
+        query_strings: list[NetworkPolicy.KeyValueMatcher] = field(default_factory=list)
+        headers: list[NetworkPolicy.KeyValueMatcher] = field(default_factory=list)
+
+        def __post_init__(self) -> None:
+            if self.path is not None and not isinstance(
+                self.path, NetworkPolicy.Matcher
+            ):
+                raise TypeError("path must be a NetworkPolicy.Matcher")
+            if isinstance(self.methods, str):
+                raise TypeError("methods must be a list of strings")
+            self.methods = list(self.methods or [])
+            for method in self.methods:
+                if not isinstance(method, str):
+                    raise TypeError("methods must be a list of strings")
+            self.query_strings = list(self.query_strings or [])
+            for matcher in self.query_strings:
+                if not isinstance(matcher, NetworkPolicy.KeyValueMatcher):
+                    raise TypeError(
+                        "query_strings must be a list of NetworkPolicy.KeyValueMatcher"
+                    )
+            self.headers = list(self.headers or [])
+            for matcher in self.headers:
+                if not isinstance(matcher, NetworkPolicy.KeyValueMatcher):
+                    raise TypeError(
+                        "headers must be a list of NetworkPolicy.KeyValueMatcher"
+                    )
 
-    def to_dict(self) -> dict[str, int]:
-        assert self.end_port is not None
-        return {"startPort": self.start_port, "endPort": self.end_port}
+        def to_dict(self) -> dict[str, Any]:
+            body: dict[str, Any] = {}
+            if self.path is not None:
+                body["path"] = self.path.to_dict()
+            if self.methods:
+                body["method"] = list(self.methods)
+            if self.query_strings:
+                body["queryString"] = [
+                    matcher.to_dict() for matcher in self.query_strings
+                ]
+            if self.headers:
+                body["headers"] = [matcher.to_dict() for matcher in self.headers]
+            return body
 
+    @dataclass
+    class Transformer:
+        """Request transform for a host policy rule."""
 
-PortRangeInput = PortRange | tuple[int, int] | int
+        headers: dict[str, str] = field(default_factory=dict)
 
+        def __post_init__(self) -> None:
+            self.headers = dict(self.headers or {})
+            for key, value in self.headers.items():
+                if not isinstance(key, str) or not isinstance(value, str):
+                    raise TypeError("headers must be a dict[str, str]")
 
-@dataclass(init=False)
-class AllowedRoute:
-    """Allowed destination CIDR and optional destination port ranges.
+        def to_dict(self) -> dict[str, Any]:
+            return {"headers": dict(self.headers)}
 
-    Empty ``port_ranges`` means all destination ports for the route.
-    """
+    @dataclass
+    class Rule:
+        """Host policy rule for matching, transforming, or forwarding requests."""
+
+        transforms: list[NetworkPolicy.Transformer] = field(default_factory=list)
+        match: NetworkPolicy.Match | None = None
+        forward_url: str | None = None
+
+        def __post_init__(self) -> None:
+            self.transforms = list(self.transforms or [])
+            for transformer in self.transforms:
+                if not isinstance(transformer, NetworkPolicy.Transformer):
+                    raise TypeError(
+                        "transforms must be a list of NetworkPolicy.Transformer"
+                    )
+            if self.match is not None and not isinstance(
+                self.match, NetworkPolicy.Match
+            ):
+                raise TypeError("match must be a NetworkPolicy.Match")
+            if self.forward_url is not None and not isinstance(self.forward_url, str):
+                raise TypeError("forward_url must be a string")
+
+        def to_dict(self) -> dict[str, Any]:
+            body: dict[str, Any] = {}
+            if self.transforms:
+                body["transform"] = [
+                    transformer.to_dict() for transformer in self.transforms
+                ]
+            if self.match is not None:
+                body["match"] = self.match.to_dict()
+            if self.forward_url is not None:
+                body["forwardUrl"] = self.forward_url
+            return body
+
+    allowed_routes: list[Route]
+    """Allowed destination routes and their permitted destination ports."""
 
-    route: str
-    """Destination CIDR, e.g. ``"10.0.0.0/8"``."""
+    denied_routes: list[str]
+    """Destination CIDRs to deny before evaluating allowed routes or hosts."""
 
-    port_ranges: list[PortRange]
-    """Destination port ranges allowed for this route."""
+    allowed_hosts: dict[str, list[Rule]]
+    """Host patterns mapped to request rules. Empty rule lists allow the host."""
 
     def __init__(
         self,
-        route: str | None = None,
-        port_ranges: Iterable[PortRangeInput] | None = None,
         *,
-        cidr: str | None = None,
-        ports: Iterable[PortRangeInput] | None = None,
+        allowed_routes: Iterable[Route] | None = None,
+        denied_routes: Iterable[str] | None = None,
+        allowed_hosts: Iterable[str] | Mapping[str, Iterable[Rule]] | None = None,
     ) -> None:
-        if route is None:
-            route = cidr
-        elif cidr is not None and cidr != route:
-            raise ValueError("Pass only one of route or cidr")
-        if route is None:
-            raise ValueError("route is required")
-        if port_ranges is not None and ports is not None:
-            raise ValueError("Pass only one of port_ranges or ports")
-
-        ipaddress.ip_network(route)
-        self.route = route
-        self.port_ranges = [
-            _coerce_port_range(port_range)
-            for port_range in (port_ranges if port_ranges is not None else ports or [])
-        ]
-
-    def to_dict(self) -> dict[str, Any]:
-        body: dict[str, Any] = {"route": self.route}
-        if self.port_ranges:
-            body["portRanges"] = [
-                port_range.to_dict() for port_range in self.port_ranges
-            ]
-        return body
-
-
-@dataclass
-class NetworkPolicy:
-    """Network egress allowlist for a container.
+        self.allowed_routes = list(allowed_routes or [])
+        for route in self.allowed_routes:
+            if not isinstance(route, NetworkPolicy.Route):
+                raise TypeError("allowed_routes must be a list of NetworkPolicy.Route")
+
+        if isinstance(denied_routes, str):
+            raise TypeError("denied_routes must be a list of strings")
+        self.denied_routes = list(denied_routes or [])
+        for route in self.denied_routes:
+            if not isinstance(route, str):
+                raise TypeError("denied_routes must be a list of strings")
+
+        self.allowed_hosts = {}
+        if allowed_hosts is None:
+            return
 
-    A missing policy leaves networking unrestricted for backwards compatibility.
-    A present policy allows only its ``allowed_routes``.
-    """
+        if isinstance(allowed_hosts, Mapping):
+            for host, rules in allowed_hosts.items():
+                if not isinstance(host, str):
+                    raise TypeError("allowed_hosts entries must be strings")
+                self._validate_host(host)
+                if isinstance(rules, NetworkPolicy.Rule):
+                    raise TypeError(
+                        "allowed_hosts values must be lists of NetworkPolicy.Rule"
+                    )
+                self.allowed_hosts[host] = list(
+                    cast(Iterable[NetworkPolicy.Rule], rules)
+                )
+                for rule in self.allowed_hosts[host]:
+                    if not isinstance(rule, NetworkPolicy.Rule):
+                        raise TypeError(
+                            "allowed_hosts values must be lists of NetworkPolicy.Rule"
+                        )
+            return
 
-    allowed_routes: list[AllowedRoute] = field(default_factory=list)
-    """Allowed destination routes and their permitted destination ports."""
+        if isinstance(allowed_hosts, str):
+            raise TypeError("allowed_hosts must be a list of strings or a dict")
+        for host in allowed_hosts:
+            self._validate_host(host)
+            self.allowed_hosts[host] = []
 
     def to_dict(self) -> dict[str, Any]:
-        return {
+        body: dict[str, Any] = {
             "allowedRoutes": [
                 allowed_route.to_dict() for allowed_route in self.allowed_routes
             ]
         }
+        if self.denied_routes:
+            body["deniedRoutes"] = list(self.denied_routes)
+        if self.allowed_hosts:
+            body["allowedHosts"] = {
+                host: {"rules": [rule.to_dict() for rule in rules]}
+                for host, rules in self.allowed_hosts.items()
+            }
+        return body
+
+    @staticmethod
+    def _validate_host(host: str) -> None:
+        if not isinstance(host, str):
+            raise TypeError("allowed_hosts entries must be strings")
+        if not host:
+            raise ValueError("allowed_hosts entries must not be empty")
 
 
 @dataclass
@@ -1773,15 +1953,15 @@ def _handle_container_grpc_error(
     raise ContainerError(f"Container session RPC failed: {details}") from e
 
 
-def _coerce_port_range(port_range: PortRangeInput) -> PortRange:
-    if isinstance(port_range, PortRange):
-        return port_range
+def _coerce_port_range(port_range: _PortRangeInput) -> tuple[int, int]:
     if isinstance(port_range, int) and not isinstance(port_range, bool):
-        return PortRange(port_range)
+        _validate_port_range(port_range, port_range)
+        return port_range, port_range
     if isinstance(port_range, tuple) and len(port_range) == 2:
         start_port, end_port = port_range
-        return PortRange(start_port, end_port)
-    raise TypeError("port ranges must be PortRange, int, or (start_port, end_port)")
+        _validate_port_range(start_port, end_port)
+        return start_port, end_port
+    raise TypeError("ports must be integers or (start_port, end_port) tuples")
 
 
 def _validate_port_range(start_port: int, end_port: int) -> None: