fractal-server 2.5.0a0__tar.gz → 2.5.1__tar.gz

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fractal-server
-Version: 2.5.0a0
+Version: 2.5.1
 Summary: Server component of the Fractal analytics platform
 Home-page: https://github.com/fractal-analytics-platform/fractal-server
 License: BSD-3-Clause

fractal_server-2.5.1/fractal_server/__init__.py

@@ -0,0 +1 @@
+__VERSION__ = "2.5.1"

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/routes/api/v2/task_collection_custom.py

@@ -20,12 +20,12 @@ from ....schemas.v2 import TaskCreateV2
 from ....schemas.v2 import TaskReadV2
 from fractal_server.app.models import UserOAuth
 from fractal_server.app.routes.auth import current_active_verified_user
+from fractal_server.string_tools import validate_cmd
 from fractal_server.tasks.v2.background_operations import _insert_tasks
 from fractal_server.tasks.v2.background_operations import (
     _prepare_tasks_metadata,
 )
 
-
 router = APIRouter()
 
 logger = set_logger(__name__)
@@ -74,6 +74,7 @@ async def collect_task_custom(
         package_name_underscore = task_collect.package_name.replace("-", "_")
         # Note that python_command is then used as part of a subprocess.run
         # statement: be careful with mixing `'` and `"`.
+        validate_cmd(package_name_underscore)
         python_command = (
             "import importlib.util; "
             "from pathlib import Path; "

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/routes/auth/_aux_auth.py

@@ -32,7 +32,11 @@ async def _get_single_user_with_group_names(
     res = await db.execute(stm_groups)
     groups = res.scalars().unique().all()
     group_names = [group.name for group in groups]
-    return UserRead(**user.model_dump(), group_names=group_names)
+    return UserRead(
+        **user.model_dump(),
+        group_names=group_names,
+        oauth_accounts=user.oauth_accounts,
+    )
 
 
 async def _get_single_user_with_group_ids(
@@ -53,7 +57,11 @@ async def _get_single_user_with_group_ids(
     res = await db.execute(stm_links)
     links = res.scalars().unique().all()
     group_ids = [link.group_id for link in links]
-    return UserRead(**user.model_dump(), group_ids=group_ids)
+    return UserRead(
+        **user.model_dump(),
+        group_ids=group_ids,
+        oauth_accounts=user.oauth_accounts,
+    )
 
 
 async def _get_single_group_with_user_ids(
@@ -97,9 +105,7 @@ async def _user_or_404(user_id: int, db: AsyncSession) -> UserOAuth:
         user_id: ID of the user
         db: Async db session
     """
-    stm = select(UserOAuth).where(UserOAuth.id == user_id)
-    res = await db.execute(stm)
-    user = res.scalars().unique().one_or_none()
+    user = await db.get(UserOAuth, user_id, populate_existing=True)
     if user is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="User not found."

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/routes/auth/current_user.py

@@ -51,9 +51,13 @@ async def patch_current_user(
     # NOTE: here it would be relevant to catch an `InvalidPasswordException`
     # (from `fastapi_users.exceptions`), if we were to allow users change
     # their own password
+
     user = await user_manager.update(update, current_user, safe=True)
-    patched_user = schemas.model_validate(UserOAuth, user)
+    validated_user = schemas.model_validate(UserOAuth, user)
 
+    patched_user = await db.get(
+        UserOAuth, validated_user.id, populate_existing=True
+    )
     patched_user_with_groups = await _get_single_user_with_group_names(
         patched_user, db
     )

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/routes/auth/users.py

@@ -43,10 +43,8 @@ async def get_user(
 ) -> UserRead:
     user = await _user_or_404(user_id, db)
     if group_ids:
-        user_with_group_ids = await _get_single_user_with_group_ids(user, db)
-        return user_with_group_ids
-    else:
-        return user
+        user = await _get_single_user_with_group_ids(user, db)
+    return user
 
 
 @router_users.patch("/users/{user_id}/", response_model=UserRead)
@@ -127,9 +125,7 @@ async def patch_user(
                 status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
                 detail=error_msg,
             )
-
         patched_user = user_to_patch
-
     elif edit_attributes:
         # Modify user attributes
         try:
@@ -142,7 +138,10 @@ async def patch_user(
                 safe=False,
                 request=None,
             )
-            patched_user = schemas.model_validate(UserOAuth, user)
+            validated_user = schemas.model_validate(UserOAuth, user)
+            patched_user = await db.get(
+                UserOAuth, validated_user.id, populate_existing=True
+            )
         except exceptions.InvalidPasswordException as e:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
@@ -189,9 +188,11 @@ async def list_users(
     # https://github.com/fractal-analytics-platform/fractal-server/issues/1742
     for ind, user in enumerate(user_list):
         user_list[ind] = dict(
-            user.model_dump(),
+            **user.model_dump(),
+            oauth_accounts=user.oauth_accounts,
             group_ids=[
                 link.group_id for link in links if link.user_id == user.id
             ],
         )
+
     return user_list

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/compress_folder.py

@@ -48,7 +48,7 @@ def create_tar_archive(
         "."
     )
     logger.debug(f"cmd tar:\n{cmd_tar}")
-    run_subprocess(cmd=cmd_tar, logger_name=logger_name)
+    run_subprocess(cmd=cmd_tar, logger_name=logger_name, allow_char="*")
 
 
 def remove_temp_subfolder(subfolder_path_tmp_copy: Path, logger_name: str):

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/executors/slurm/sudo/_subprocess_run_as_user.py

@@ -20,6 +20,7 @@ import subprocess  # nosec
 from typing import Optional
 
 from ......logger import set_logger
+from fractal_server.string_tools import validate_cmd
 
 logger = set_logger(__name__)
 
@@ -47,6 +48,7 @@ def _run_command_as_user(
     Returns:
         res: The return value from `subprocess.run`.
     """
+    validate_cmd(cmd)
     logger.debug(f'[_run_command_as_user] {user=}, cmd="{cmd}"')
     if user:
         new_cmd = f"sudo --set-home --non-interactive -u {user} {cmd}"

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/executors/slurm/sudo/executor.py

@@ -47,6 +47,7 @@ from ._subprocess_run_as_user import _path_exists_as_user
 from ._subprocess_run_as_user import _run_command_as_user
 from fractal_server import __VERSION__
 from fractal_server.app.runner.components import _COMPONENT_KEY_
+from fractal_server.string_tools import validate_cmd
 
 
 logger = set_logger(__name__)
@@ -65,6 +66,7 @@ def _subprocess_run_or_raise(full_command: str) -> Optional[CompletedProcess]:
     Returns:
         The actual `CompletedProcess` output of `subprocess.run`.
     """
+    validate_cmd(full_command)
     try:
         output = subprocess.run(  # nosec
             shlex.split(full_command),
@@ -1266,6 +1268,7 @@ class FractalSlurmExecutor(SlurmExecutor):
             pre_command = f"sudo --non-interactive -u {self.slurm_user}"
             submit_command = f"scancel {scancel_string}"
             full_command = f"{pre_command} {submit_command}"
+            validate_cmd(full_command)
             logger.debug(f"Now execute `{full_command}`")
             try:
                 subprocess.run(  # nosec

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/run_subprocess.py

@@ -3,11 +3,15 @@ import subprocess  # nosec
 from typing import Optional
 
 from fractal_server.logger import get_logger
+from fractal_server.string_tools import validate_cmd
 
 
 def run_subprocess(
-    cmd: str, logger_name: Optional[str] = None
+    cmd: str,
+    allow_char: Optional[str] = None,
+    logger_name: Optional[str] = None,
 ) -> subprocess.CompletedProcess:
+    validate_cmd(cmd, allow_char=allow_char)
     logger = get_logger(logger_name)
     try:
         res = subprocess.run(  # nosec

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/v1/_common.py

@@ -31,6 +31,7 @@ from .common import write_args_file
 from fractal_server.app.runner.filenames import HISTORY_FILENAME
 from fractal_server.app.runner.filenames import METADATA_FILENAME
 from fractal_server.app.runner.task_files import get_task_file_paths
+from fractal_server.string_tools import validate_cmd
 
 
 def no_op_submit_setup_call(
@@ -77,6 +78,7 @@ def _call_command_wrapper(cmd: str, stdout: Path, stderr: Path) -> None:
                             TERM or KILL signal)
     """
 
+    validate_cmd(cmd)
     # Verify that task command is executable
     if shutil.which(shlex_split(cmd)[0]) is None:
         msg = (

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/runner/v2/runner_functions_low_level.py

@@ -12,6 +12,7 @@ from ..exceptions import JobExecutionError
 from ..exceptions import TaskExecutionError
 from fractal_server.app.models.v2 import WorkflowTaskV2
 from fractal_server.app.runner.task_files import get_task_file_paths
+from fractal_server.string_tools import validate_cmd
 
 
 def _call_command_wrapper(cmd: str, log_path: Path) -> None:
@@ -25,6 +26,10 @@ def _call_command_wrapper(cmd: str, log_path: Path) -> None:
                             exit code (e.g. due to the subprocess receiving a
                             TERM or KILL signal)
     """
+    try:
+        validate_cmd(cmd)
+    except ValueError as e:
+        raise TaskExecutionError(f"Invalid command. Original error: {str(e)}")
 
     # Verify that task command is executable
     if shutil.which(shlex_split(cmd)[0]) is None:

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/schemas/user.py

@@ -10,7 +10,7 @@ from pydantic.types import StrictStr
 from ._validators import val_absolute_path
 from ._validators import val_unique_list
 from ._validators import valstr
-
+from fractal_server.string_tools import validate_cmd
 
 __all__ = (
     "UserRead",
@@ -20,6 +20,22 @@ __all__ = (
 )
 
 
+class OAuthAccountRead(BaseModel):
+    """
+    Schema for storing essential `OAuthAccount` information within
+    `UserRead.oauth_accounts`.
+
+    Attributes:
+        id: ID of the row in fractal-owned `oauthaccount` table.
+        account_email: Email associated to OAuth account
+        oauth_name: Name of the OAuth provider (e.g. `github`)
+    """
+
+    id: int
+    account_email: str
+    oauth_name: str
+
+
 class UserRead(schemas.BaseUser[int]):
     """
     Schema for `User` read from database.
@@ -37,6 +53,7 @@ class UserRead(schemas.BaseUser[int]):
     slurm_accounts: list[str]
     group_names: Optional[list[str]] = None
     group_ids: Optional[list[int]] = None
+    oauth_accounts: list[OAuthAccountRead]
 
 
 class UserUpdate(schemas.BaseUserUpdate):
@@ -60,14 +77,16 @@ class UserUpdate(schemas.BaseUserUpdate):
         valstr("slurm_user")
     )
     _username = validator("username", allow_reuse=True)(valstr("username"))
-    _cache_dir = validator("cache_dir", allow_reuse=True)(
-        val_absolute_path("cache_dir")
-    )
 
     _slurm_accounts = validator("slurm_accounts", allow_reuse=True)(
         val_unique_list("slurm_accounts")
     )
 
+    @validator("cache_dir")
+    def cache_dir_validator(cls, value):
+        validate_cmd(value)
+        return val_absolute_path("cache_dir")(value)
+
     @validator(
         "is_active",
         "is_verified",
@@ -98,9 +117,10 @@ class UserUpdateStrict(BaseModel, extra=Extra.forbid):
         val_unique_list("slurm_accounts")
     )
 
-    _cache_dir = validator("cache_dir", allow_reuse=True)(
-        val_absolute_path("cache_dir")
-    )
+    @validator("cache_dir")
+    def cache_dir_validator(cls, value):
+        validate_cmd(value)
+        return val_absolute_path("cache_dir")(value)
 
 
 class UserUpdateWithNewGroupIds(UserUpdate):
@@ -140,6 +160,8 @@ class UserCreate(schemas.BaseUserCreate):
         valstr("slurm_user")
     )
     _username = validator("username", allow_reuse=True)(valstr("username"))
-    _cache_dir = validator("cache_dir", allow_reuse=True)(
-        val_absolute_path("cache_dir")
-    )
+
+    @validator("cache_dir")
+    def cache_dir_validator(cls, value):
+        validate_cmd(value)
+        return val_absolute_path("cache_dir")(value)

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/schemas/v2/dumps.py

@@ -39,14 +39,23 @@ class TaskDumpV2(BaseModel):
 
 
 class WorkflowTaskDumpV2(BaseModel):
+    """
+    Before v2.5.0, WorkflowTaskV2 could have `task_id=task=None` and
+    non-`None` `task_legacy_id` and `task_legacy`. Since these objects
+    may still exist in the database after version updates, we are setting
+    `task_id` and `task` to `Optional` to avoid response-validation errors
+    for the endpoints that GET datasets.
+    Ref issue #1783.
+    """
+
     id: int
     workflow_id: int
     order: Optional[int]
 
     input_filters: Filters
 
-    task_id: int
-    task: TaskDumpV2
+    task_id: Optional[int]
+    task: Optional[TaskDumpV2]
 
 
 class WorkflowDumpV2(BaseModel, extra=Extra.forbid):

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/app/schemas/v2/task.py

@@ -11,6 +11,7 @@ from pydantic import validator
 
 from .._validators import valdictkeys
 from .._validators import valstr
+from fractal_server.string_tools import validate_cmd
 
 
 class TaskCreateV2(BaseModel, extra=Extra.forbid):
@@ -43,6 +44,11 @@ class TaskCreateV2(BaseModel, extra=Extra.forbid):
                 "Task must have at least one valid command "
                 "(parallel and/or non_parallel)"
             )
+        if command_parallel is not None:
+            validate_cmd(command_parallel)
+        if command_non_parallel is not None:
+            validate_cmd(command_non_parallel)
+
         return values
 
     _name = validator("name", allow_reuse=True)(valstr("name"))

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/ssh/_fabric.py

@@ -17,6 +17,7 @@ from paramiko.ssh_exception import NoValidConnectionsError
 from ..logger import get_logger
 from ..logger import set_logger
 from fractal_server.config import get_settings
+from fractal_server.string_tools import validate_cmd
 from fractal_server.syringe import Inject
 
 
@@ -143,6 +144,7 @@ class FractalSSH(object):
         self,
         *,
         cmd: str,
+        allow_char: Optional[str] = None,
         max_attempts: Optional[int] = None,
         base_interval: Optional[int] = None,
         lock_timeout: Optional[int] = None,
@@ -152,6 +154,7 @@ class FractalSSH(object):
 
         Args:
             cmd: Command to be run
+            allow_char: Forbidden chars to allow for this command
             max_attempts:
             base_interval:
             lock_timeout:
@@ -159,6 +162,9 @@ class FractalSSH(object):
         Returns:
             Standard output of the command, if successful.
         """
+
+        validate_cmd(cmd, allow_char=allow_char)
+
         actual_max_attempts = self.default_max_attempts
         if max_attempts is not None:
             actual_max_attempts = max_attempts

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/fractal_server/string_tools.py

@@ -1,7 +1,12 @@
 import string
+from typing import Optional
 
 __SPECIAL_CHARACTERS__ = f"{string.punctuation}{string.whitespace}"
 
+# List of invalid characters discussed here:
+# https://github.com/fractal-analytics-platform/fractal-server/issues/1647
+__NOT_ALLOWED_FOR_COMMANDS__ = r"`#$&*()\|[]{};<>?!"
+
 
 def sanitize_string(value: str) -> str:
     """
@@ -43,3 +48,23 @@ def slugify_task_name_for_source(task_name: str) -> str:
         Slug-ified task name.
     """
     return task_name.replace(" ", "_").lower()
+
+
+def validate_cmd(command: str, allow_char: Optional[str] = None):
+    """
+    Assert that the provided `command` does not contain any of the forbidden
+    characters for commands
+    (fractal_server.string_tools.__NOT_ALLOWED_FOR_COMMANDS__)
+
+    Args:
+        command: command to validate.
+        allow_char: chars to accept among the forbidden ones
+    """
+    forbidden = set(__NOT_ALLOWED_FOR_COMMANDS__)
+    if allow_char is not None:
+        forbidden = forbidden - set(allow_char)
+    if not forbidden.isdisjoint(set(command)):
+        raise ValueError(
+            f"Command must not contain any of this characters: '{forbidden}'\n"
+            f"Provided command: '{command}'."
+        )

{fractal_server-2.5.0a0 → fractal_server-2.5.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "fractal-server"
-version = "2.5.0a0"
+version = "2.5.1"
 description = "Server component of the Fractal analytics platform"
 authors = [
     "Tommaso Comparin <tommaso.comparin@exact-lab.it>",
@@ -92,7 +92,7 @@ filterwarnings = [
 ]
 
 [tool.bumpver]
-current_version = "2.5.0a0"
+current_version = "2.5.1"
 version_pattern = "MAJOR.MINOR.PATCH[PYTAGNUM]"
 commit_message = "bump version {old_version} -> {new_version}"
 commit = true

fractal_server-2.5.0a0/fractal_server/__init__.py

@@ -1 +0,0 @@
-__VERSION__ = "2.5.0a0"