cornflow 1.3.5rc4__tar.gz → 1.3.6__tar.gz

{cornflow-1.3.5rc4/cornflow.egg-info → cornflow-1.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cornflow
-Version: 1.3.5rc4
+Version: 1.3.6
 Summary: cornflow is an open source multi-solver optimization server with a REST API built using flask.
 Home-page: https://github.com/baobabsoluciones/cornflow
 Author: baobab soluciones
@@ -14,8 +14,8 @@ Requires-Dist: alembic==1.9.2
 Requires-Dist: apispec==6.3.0
 Requires-Dist: cachetools==5.3.3
 Requires-Dist: click==8.1.7
-Requires-Dist: cornflow-client==1.3.5rc4
-Requires-Dist: cryptography==46.0.5
+Requires-Dist: cornflow-client==1.3.6
+Requires-Dist: cryptography==48.0.1
 Requires-Dist: disposable-email-domains==0.0.162
 Requires-Dist: Flask==2.3.2
 Requires-Dist: flask-apispec==0.11.4
@@ -35,7 +35,7 @@ Requires-Dist: ldap3==2.9.1
 Requires-Dist: marshmallow==3.26.2
 Requires-Dist: PuLP==2.9.0
 Requires-Dist: psycopg2==2.9.9
-Requires-Dist: PyJWT==2.12.0
+Requires-Dist: PyJWT==2.13.0
 Requires-Dist: pytups==0.86.2
 Requires-Dist: requests==2.32.4
 Requires-Dist: SQLAlchemy==1.3.21

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/commands/auxiliar.py

@@ -87,8 +87,8 @@ def get_new_roles_to_add(extra_permissions, resources_roles_with_access):
 
     for role_id in roles_with_access:
         if role_id not in existing_roles:
-            if role_id in ALL_DEFAULT_ROLES:
-                # Create standard role with predefined name
+            if role_id in ROLES_MAP:
+                # Create role with its predefined name from ROLES_MAP
                 role_name = ROLES_MAP[role_id]
                 new_role = RoleModel(
                     {

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/models/execution.py

@@ -7,6 +7,7 @@ from flask import current_app
 import hashlib
 from sqlalchemy.dialects.postgresql import JSON, TEXT
 from sqlalchemy import desc, or_
+from sqlalchemy.orm import defer
 from sqlalchemy.sql.expression import false
 
 # Imports from internal modules
@@ -184,7 +185,7 @@ class ExecutionModel(BaseDataModel):
         :return: The objects
         :rtype: list(:class:`BaseDataModel`)
         """
-        query = cls.query.filter(cls.deleted_at == None)
+        query = cls.query.options(defer(cls.data), defer(cls.checks)).filter(cls.deleted_at == None)
         user_access = int(current_app.config["USER_ACCESS_ALL_OBJECTS"])
         if (
             user is not None
@@ -207,7 +208,6 @@ class ExecutionModel(BaseDataModel):
                     cls.checks_and_kpis_only.is_(None),
                 )
             )
-        # if airflow they also return total_entries = query.count(), for some reason
 
         return query.order_by(desc(cls.created_at)).offset(offset).limit(limit).all()
 

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/schemas/execution.py

@@ -150,6 +150,11 @@ class ExecutionDetailsWithIndicatorsAndLogResponse(
 ):
     log = fields.Nested(BasicLogSchema, attribute="log_json")
 
+    class Meta:
+        # Exclude 'indicators' from the list endpoint schema: data is deferred in
+        # get_all_objects, so accessing obj.data here would trigger N+1 lazy loads.
+        exclude = ("indicators",)
+
 
 class ExecutionStatusEndpointResponse(Schema):
     id = fields.Str()

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/shared/const.py

@@ -7,7 +7,7 @@ AIRFLOW_BACKEND = 1
 DATABRICKS_BACKEND = 2
 
 
-CORNFLOW_VERSION = "1.3.5rc4"
+CORNFLOW_VERSION = "1.3.6"
 INTERNAL_TOKEN_ISSUER = "cornflow"
 
 # endpoints responses for health check
@@ -99,6 +99,7 @@ DELETE_ACTION = 5
 
 ALL_DEFAULT_ACTIONS = [GET_ACTION, PATCH_ACTION, POST_ACTION, PUT_ACTION, DELETE_ACTION]
 
+DUMMY_ROLE = 0
 VIEWER_ROLE = 1
 PLANNER_ROLE = 2
 ADMIN_ROLE = 3
@@ -123,6 +124,7 @@ PERMISSION_METHOD_MAP = {
 }
 
 ROLES_MAP = {
+    DUMMY_ROLE: "dummy",
     PLANNER_ROLE: "planner",
     VIEWER_ROLE: "viewer",
     ADMIN_ROLE: "admin",
@@ -149,7 +151,10 @@ BASE_PERMISSION_ASSIGNATION = [
 ]
 
 EXTRA_PERMISSION_ASSIGNATION = [
+    (DUMMY_ROLE, GET_ACTION, "user-detail"),
+    (DUMMY_ROLE, PUT_ACTION, "user-detail"),
     (VIEWER_ROLE, PUT_ACTION, "user-detail"),
+    (DUMMY_ROLE, GET_ACTION, "user-roles"),
     (VIEWER_ROLE, GET_ACTION, "user-roles"),
     (PLANNER_ROLE, GET_ACTION, "user-roles"),
     (SERVICE_ROLE, GET_ACTION, "user-roles"),

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/tests/base_test_execution.py

@@ -104,7 +104,6 @@ class BaseExecutionList(BaseTestCases.ListFilters, ABC):
             "log",
             "instance_id",
             "name",
-            "indicators",
             "username",
             "first_name",
             "last_name",

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/tests/unit/test_cli.py

@@ -249,7 +249,7 @@ class CLITests(TestCase):
         result = runner.invoke(cli, ["roles", "init", "-v"])
         self.assertEqual(result.exit_code, 0)
         roles = RoleModel.get_all_objects().all()
-        self.assertEqual(len(roles), 4)
+        self.assertEqual(len(roles), 5)
 
     def test_views_entrypoint(self):
         """
@@ -325,9 +325,9 @@ class CLITests(TestCase):
         views = ViewModel.get_all_objects().all()
         permissions = PermissionViewRoleModel.get_all_objects().all()
         self.assertEqual(len(actions), 5)
-        self.assertEqual(len(roles), 4)
+        self.assertEqual(len(roles), 5)
         self.assertEqual(len(views), (len(resources) + len(alarms_resources)))
-        self.assertEqual(len(permissions), 629)
+        self.assertEqual(len(permissions), 632)
 
     def test_permissions_base_command(self):
         """
@@ -351,9 +351,9 @@ class CLITests(TestCase):
         views = ViewModel.get_all_objects().all()
         permissions = PermissionViewRoleModel.get_all_objects().all()
         self.assertEqual(len(actions), 5)
-        self.assertEqual(len(roles), 4)
+        self.assertEqual(len(roles), 5)
         self.assertEqual(len(views), (len(resources) + len(alarms_resources)))
-        self.assertEqual(len(permissions), 629)
+        self.assertEqual(len(permissions), 632)
 
     def test_service_entrypoint(self):
         """

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/tests/unit/test_executions.py

@@ -12,6 +12,7 @@ from datetime import datetime, timedelta, timezone
 from unittest.mock import patch
 
 from flask import current_app
+from sqlalchemy import event, inspect as sa_inspect
 from cornflow.app import create_app
 from cornflow.tests import base_test_execution
 
@@ -30,9 +31,11 @@ from cornflow.shared.const import (
     VIEWER_ROLE,
 )
 from cornflow.tests.const import (
+    DAG_URL,
     EXECUTION_FILES_CLEANUP_URL,
     EXECUTION_FILES_URL,
     EXECUTION_PATH,
+    EXECUTION_SOLUTION_PATH,
     EXECUTION_URL_NORUN,
     INSTANCE_PATH,
     INSTANCE_URL,
@@ -492,3 +495,162 @@ class TestExecutionFilesEndpoint(CustomTestCase):
         self.assertEqual("0 files were deleted.", response.json["message"])
 
     # endregion
+
+
+class TestExecutionListDataLoading(CustomTestCase):
+    """
+    Tests that the execution list endpoint does not load heavy columns from the
+    database and returns only the expected basic fields.
+    """
+
+    def setUp(self):
+        super().setUp()
+        # Load instance fixture and create a parent instance
+        with open(INSTANCE_PATH) as f:
+            instance_payload = json.load(f)
+        self.instance_id = self.create_new_row(
+            INSTANCE_URL, InstanceModel, instance_payload
+        )
+
+        # Load execution fixture and create the execution (without triggering a run)
+        with open(EXECUTION_PATH) as f:
+            execution_payload = json.load(f)
+        execution_payload["instance_id"] = self.instance_id
+        self.execution_id = self.create_new_row(
+            EXECUTION_URL_NORUN, ExecutionModel, execution_payload
+        )
+
+        # Use a service user to push solution data into the execution via the DAG
+        # endpoint so that the `data` column is non-NULL in the database.
+        service_token = self.create_service_user()
+        with open(EXECUTION_SOLUTION_PATH) as f:
+            solution_data = json.load(f)
+        self.update_row(
+            url=DAG_URL + self.execution_id + "/",
+            change={"data": solution_data},
+            payload_to_check={},
+            check_payload=False,
+            token=service_token,
+        )
+
+    def _capture_queries_for_get_all_objects(self):
+        captured_queries = []
+
+        def _listener(conn, cursor, statement, parameters, context, executemany):
+            captured_queries.append(statement)
+
+        engine = db.engine
+        event.listen(engine, "before_cursor_execute", _listener)
+        try:
+            executions = ExecutionModel.get_all_objects(user=self.user)
+        finally:
+            event.remove(engine, "before_cursor_execute", _listener)
+
+        return executions, captured_queries
+
+    def test_data_is_deferred_in_list_via_sqlalchemy_inspect(self):
+        executions = ExecutionModel.get_all_objects(user=self.user)
+
+        self.assertGreater(
+            len(executions),
+            0,
+            "Expected at least one execution to be returned by get_all_objects",
+        )
+
+        for execution in executions:
+            state = sa_inspect(execution)
+            self.assertIn(
+                "data",
+                state.unloaded,
+                "'data' should be deferred (not loaded eagerly) in the list query.",
+            )
+
+    def test_data_is_not_in_select_via_sql_interception(self):
+        executions, captured_queries = self._capture_queries_for_get_all_objects()
+
+        self.assertGreater(
+            len(executions),
+            0,
+            "Expected at least one execution to be returned by get_all_objects",
+        )
+
+        self.assertTrue(
+            len(captured_queries) > 0,
+            "No SQL queries were captured; the event listener may not have fired.",
+        )
+
+        data_in_query = any(
+            '"data"' in q or " data," in q.lower() or " data " in q.lower()
+            for q in captured_queries
+        )
+        self.assertFalse(
+            data_in_query,
+            "The SELECT generated by get_all_objects must not include the 'data' column. "
+            "Captured queries: " + str(captured_queries),
+        )
+
+    def test_list_endpoint_does_not_return_indicators(self):
+        from cornflow.tests.const import EXECUTION_URL
+
+        response = self.client.get(
+            EXECUTION_URL,
+            follow_redirects=True,
+            headers=self.get_header_with_auth(self.token),
+        )
+
+        self.assertEqual(
+            200,
+            response.status_code,
+            f"GET /execution/ returned unexpected status {response.status_code}",
+        )
+
+        items = response.json
+        self.assertIsInstance(items, list)
+        self.assertGreater(len(items), 0, "Expected at least one execution in the list")
+
+        for item in items:
+            self.assertNotIn(
+                "indicators",
+                item,
+                "'indicators' must not appear in execution list items.",
+            )
+
+    def test_list_endpoint_returns_basic_fields(self):
+        from cornflow.tests.const import EXECUTION_URL
+
+        response = self.client.get(
+            EXECUTION_URL,
+            follow_redirects=True,
+            headers=self.get_header_with_auth(self.token),
+        )
+
+        self.assertEqual(200, response.status_code)
+
+        items = response.json
+        self.assertIsInstance(items, list)
+        self.assertGreater(len(items), 0, "Expected at least one execution in the list")
+
+        required_fields = [
+            "id",
+            "name",
+            "description",
+            "created_at",
+            "updated_at",
+            "user_id",
+            "username",
+            "data_hash",
+            "state",
+            "message",
+            "config",
+            "instance_id",
+            "schema",
+            "log",
+        ]
+
+        for item in items:
+            for field in required_fields:
+                self.assertIn(
+                    field,
+                    item,
+                    f"Required field '{field}' is missing from the execution list response.",
+                )

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/tests/unit/test_roles.py

@@ -19,6 +19,8 @@ from cornflow.models import (
 )
 from cornflow.shared.const import (
     ADMIN_ROLE,
+    ALL_DEFAULT_ROLES,
+    DUMMY_ROLE,
     PLANNER_ROLE,
     ROLES_MAP,
     SERVICE_ROLE,
@@ -82,7 +84,7 @@ class TestRolesListEndpoint(CustomTestCase):
         )
 
         self.assertEqual(200, response.status_code)
-        self.assertEqual(5, len(response.json))
+        self.assertEqual(6, len(response.json))
 
     def test_get_no_roles(self):
         for role in ROLES_MAP:
@@ -254,7 +256,7 @@ class TestUserRolesListEndpoint(CustomTestCase):
             self.assertEqual(200, response.status_code)
             self.assertCountEqual(self.payload, response.json)
 
-        for role in (VIEWER_ROLE, PLANNER_ROLE, SERVICE_ROLE):
+        for role in (VIEWER_ROLE, PLANNER_ROLE, SERVICE_ROLE, DUMMY_ROLE):
             self.token = self.create_user_with_role(role)
             user = UserModel.get_one_object(username=f"testuser{role}")
             response = self.client.get(
@@ -484,18 +486,24 @@ class TestRolesModelMethods(CustomTestCase):
         """
         Tests the get_all_objects method
         """
-        # We expect 4 roles to be present (from ROLES_MAP constant)
+        # We expect 5 roles to be present (from ROLES_MAP constant)
         instances = RoleModel.get_all_objects().all()
-        self.assertEqual(len(instances), 4)
+        self.assertEqual(len(instances), 5)
 
         # Check that all the roles from ROLES_MAP are present
         role_names = [role.name for role in instances]
         expected_names = list(ROLES_MAP.values())
         self.assertCountEqual(role_names, expected_names)
 
+        # The dummy role is registered with its ROLES_MAP name and is not a default role
+        dummy_role = RoleModel.get_one_object(idx=DUMMY_ROLE)
+        self.assertIsNotNone(dummy_role)
+        self.assertEqual(dummy_role.name, "dummy")
+        self.assertNotIn(DUMMY_ROLE, ALL_DEFAULT_ROLES)
+
         # Test offset parameter - should get all except the first role
         instances = RoleModel.get_all_objects(offset=1).all()
-        self.assertEqual(len(instances), 3)
+        self.assertEqual(len(instances), 4)
 
         # Get the names of all roles except the first one
         remaining_roles = [role.name for role in instances]

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow/tests/unit/test_users.py

@@ -30,7 +30,13 @@ from cornflow.models import (
     UserRoleModel,
 )
 from cornflow.shared import db
-from cornflow.shared.const import ADMIN_ROLE, SERVICE_ROLE, PLANNER_ROLE, VIEWER_ROLE
+from cornflow.shared.const import (
+    ADMIN_ROLE,
+    DUMMY_ROLE,
+    SERVICE_ROLE,
+    PLANNER_ROLE,
+    VIEWER_ROLE,
+)
 from cornflow.tests.const import (
     CASE_PATH,
     CASE_URL,
@@ -89,6 +95,12 @@ class TestUserEndpoint(TestCase):
             password="Tpass_service_user1",
         )
 
+        self.dummy = dict(
+            username="aDummyUser",
+            email="dummy@test.com",
+            password="Testpassword1!",
+        )
+
         self.login_keys = ["username", "password"]
         self.items_to_check = ["email", "username", "id"]
         self.modifiable_items = [
@@ -106,6 +118,7 @@ class TestUserEndpoint(TestCase):
             self.admin,
             self.admin_2,
             self.service_user,
+            self.dummy,
         ]
 
         for u_data in self.payloads:
@@ -142,6 +155,17 @@ class TestUserEndpoint(TestCase):
                 )
                 user_role.save()
 
+            if "dummy" in u_data["email"]:
+                user_role = UserRoleModel(
+                    {"user_id": u_data["id"], "role_id": DUMMY_ROLE}
+                )
+                user_role.save()
+
+                UserRoleModel.query.filter_by(
+                    user_id=u_data["id"], role_id=PLANNER_ROLE
+                ).delete()
+                db.session.commit()
+
         db.session.commit()
         register_dag_permissions_command(verbose=False)
 
@@ -391,6 +415,74 @@ class TestUserEndpoint(TestCase):
         response = self.log_in(self.planner)
         self.assertEqual(False, response.json["change_password"])
 
+    def test_dummy_gets_own_user_detail(self):
+        # the dummy role can read its own user info
+        response = self.get_user(self.dummy, self.dummy)
+        self.assertEqual(200, response.status_code)
+        self.assertEqual(self.dummy["id"], response.json["id"])
+
+    def test_dummy_cannot_get_other_user_detail(self):
+        # the dummy role can not read another user's info
+        response = self.get_user(self.dummy, self.planner)
+        self.assertEqual(400, response.status_code)
+        self.assertTrue("error" in response.json)
+
+    def test_dummy_edits_own_user_info(self):
+        # the dummy role can edit its own user info
+        payload = {"first_name": "Dummy", "last_name": "User"}
+        response = self.modify_info(self.dummy, self.dummy, payload)
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("Updated correctly", response.json["message"])
+
+        response = self.get_user(self.dummy, self.dummy)
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("Dummy", response.json["first_name"])
+
+    def test_dummy_cannot_edit_other_user_info(self):
+        # the dummy role can not edit another user's info
+        payload = {"first_name": "Nope"}
+        response = self.modify_info(self.dummy, self.planner, payload)
+        self.assertEqual(403, response.status_code)
+        self.assertTrue("error" in response.json)
+
+    def test_dummy_cannot_get_all_users(self):
+        # the dummy role can not list all the users
+        response = self.get_user(self.dummy)
+        self.assertEqual(403, response.status_code)
+        self.assertTrue("error" in response.json)
+
+    def test_dummy_cannot_delete_user(self):
+        # the dummy role has no delete permission, even on itself
+        response = self.delete_user(self.dummy, self.dummy)
+        self.assertEqual(403, response.status_code)
+
+    def test_dummy_cannot_get_instances(self):
+        # the dummy role can not access unrelated endpoints
+        token = self.log_in(self.dummy).json["token"]
+        response = self.client.get(
+            INSTANCE_URL,
+            follow_redirects=True,
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": "Bearer " + token,
+            },
+        )
+        self.assertEqual(403, response.status_code)
+
+    def test_dummy_cannot_post_instance(self):
+        # permission is denied before any payload validation
+        token = self.log_in(self.dummy).json["token"]
+        response = self.client.post(
+            INSTANCE_URL,
+            data=json.dumps({}),
+            follow_redirects=True,
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": "Bearer " + token,
+            },
+        )
+        self.assertEqual(403, response.status_code)
+
 
 class TestUserModel(TestCase):
     def create_app(self):

{cornflow-1.3.5rc4 → cornflow-1.3.6/cornflow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cornflow
-Version: 1.3.5rc4
+Version: 1.3.6
 Summary: cornflow is an open source multi-solver optimization server with a REST API built using flask.
 Home-page: https://github.com/baobabsoluciones/cornflow
 Author: baobab soluciones
@@ -14,8 +14,8 @@ Requires-Dist: alembic==1.9.2
 Requires-Dist: apispec==6.3.0
 Requires-Dist: cachetools==5.3.3
 Requires-Dist: click==8.1.7
-Requires-Dist: cornflow-client==1.3.5rc4
-Requires-Dist: cryptography==46.0.5
+Requires-Dist: cornflow-client==1.3.6
+Requires-Dist: cryptography==48.0.1
 Requires-Dist: disposable-email-domains==0.0.162
 Requires-Dist: Flask==2.3.2
 Requires-Dist: flask-apispec==0.11.4
@@ -35,7 +35,7 @@ Requires-Dist: ldap3==2.9.1
 Requires-Dist: marshmallow==3.26.2
 Requires-Dist: PuLP==2.9.0
 Requires-Dist: psycopg2==2.9.9
-Requires-Dist: PyJWT==2.12.0
+Requires-Dist: PyJWT==2.13.0
 Requires-Dist: pytups==0.86.2
 Requires-Dist: requests==2.32.4
 Requires-Dist: SQLAlchemy==1.3.21

{cornflow-1.3.5rc4 → cornflow-1.3.6}/cornflow.egg-info/requires.txt

@@ -2,8 +2,8 @@ alembic==1.9.2
 apispec==6.3.0
 cachetools==5.3.3
 click==8.1.7
-cornflow-client==1.3.5rc4
-cryptography==46.0.5
+cornflow-client==1.3.6
+cryptography==48.0.1
 disposable-email-domains==0.0.162
 Flask==2.3.2
 flask-apispec==0.11.4
@@ -21,7 +21,7 @@ ldap3==2.9.1
 marshmallow==3.26.2
 PuLP==2.9.0
 psycopg2==2.9.9
-PyJWT==2.12.0
+PyJWT==2.13.0
 pytups==0.86.2
 requests==2.32.4
 SQLAlchemy==1.3.21

{cornflow-1.3.5rc4 → cornflow-1.3.6}/requirements.txt

@@ -2,8 +2,8 @@ alembic==1.9.2
 apispec==6.3.0
 cachetools==5.3.3
 click==8.1.7
-cornflow-client==1.3.5rc4
-cryptography==46.0.5
+cornflow-client==1.3.6
+cryptography==48.0.1
 disposable-email-domains==0.0.162
 Flask==2.3.2
 flask-apispec==0.11.4
@@ -23,7 +23,7 @@ ldap3==2.9.1
 marshmallow==3.26.2
 PuLP==2.9.0
 psycopg2==2.9.9
-PyJWT==2.12.0
+PyJWT==2.13.0
 pytups==0.86.2
 requests==2.32.4
 SQLAlchemy==1.3.21

{cornflow-1.3.5rc4 → cornflow-1.3.6}/setup.py

@@ -9,7 +9,7 @@ with open("requirements.txt", "r") as fh:
 
 setuptools.setup(
     name="cornflow",
-    version="1.3.5rc4",
+    version="1.3.6",
     author="baobab soluciones",
     author_email="cornflow@baobabsoluciones.es",
     description="cornflow is an open source multi-solver optimization server with a REST API built using flask.",