iatoolkit 2.47.1__tar.gz → 2.48.0__tar.gz

{iatoolkit-2.47.1/src/iatoolkit.egg-info → iatoolkit-2.48.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.47.1
+Version: 2.48.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.47.1"
+__version__ = "2.48.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/common/url_safety.py

@@ -19,6 +19,10 @@ as well, and a public URL can 302 to one. This module therefore:
 * resolves hostnames and rejects them when ANY resolved address falls in those
   ranges (fail-closed on a private answer; fail-open only when the name cannot
   be resolved at all, since that request could not have reached anything);
+* accepts an operator-configured ``allowed_private_hosts`` list, so a deployment
+  whose callback or download target is legitimately internal (portal-backend on
+  172.19.x and the like) can name that host instead of loosening the guard for
+  everyone - loopback, link-local and reserved stay unreachable even when listed;
 * offers ``fetch_with_safe_redirects`` which never lets ``requests`` follow a
   redirect blindly: every hop is re-validated with the same rules.
 
@@ -89,10 +93,42 @@ def resolve_host_classifications(hostname: str) -> list[str] | None:
     return classifications
 
 
+def _normalize_host_allowlist(allowed_hosts) -> frozenset[str]:
+    """Reduces every entry to the bare hostname ``urlparse`` will hand us, so the
+    comparison cannot silently miss.
+
+    Accepts what an operator actually types in a config file: a hostname, a
+    hostname with a port, or the whole callback URL
+    (``https://portal-api.example.com/hook``). An entry that never matched would
+    look like correct configuration while the target kept failing with the same
+    opaque error, which is the worst outcome available here.
+    """
+    normalized = set()
+    for entry in allowed_hosts or ():
+        text = str(entry or "").strip().lower()
+        if not text:
+            continue
+        if "://" in text:
+            text = urlparse(text).hostname or ""
+        elif text.startswith("["):
+            # Bracketed IPv6 literal ("[fd00::1]:8443") - the colons are part of
+            # the address, so it cannot go through the host:port split below.
+            text = text[1:].split("]", 1)[0]
+        else:
+            # host[:port][/path] with no scheme: urlparse would read the whole
+            # thing as a path, so strip the port and path by hand.
+            text = text.split("/", 1)[0].split(":", 1)[0]
+        text = text.strip().rstrip(".")
+        if text:
+            normalized.add(text)
+    return frozenset(normalized)
+
+
 def assert_public_http_url(
     url: str,
     *,
     allowed_schemes: tuple[str, ...] = ("https",),
+    allowed_private_hosts: tuple[str, ...] = (),
     error_type: IAToolkitException.ErrorType = IAToolkitException.ErrorType.INVALID_PARAMETER,
     label: str = "URL",
 ) -> ParseResult:
@@ -100,6 +136,16 @@ def assert_public_http_url(
     Raises IAToolkitException(error_type) unless ``url`` is an absolute URL with
     an allowed scheme whose host is a public internet address (literal or via
     DNS). Returns the parsed URL on success.
+
+    ``allowed_private_hosts`` is the operator's escape hatch for the legitimate
+    case this guard otherwise blocks: a target that is internal on purpose, such
+    as a callback back into the deployment's own network. A host named there is
+    accepted when it is **private** (RFC1918 & friends), by literal IP or via
+    DNS. It is still rejected when it is loopback, link-local, multicast,
+    reserved or unspecified - those are the ranges an SSRF payload actually
+    wants (127.0.0.1, ::1, 169.254.169.254), and the tenant configuration that
+    feeds this list is editable by tenant admins, who are not the platform
+    operator. The blocked local *names* stay blocked for the same reason.
     """
     normalized = str(url or "").strip()
     parsed = urlparse(normalized)
@@ -116,18 +162,29 @@ def assert_public_http_url(
     if hostname in _BLOCKED_HOSTNAMES or hostname.endswith(_BLOCKED_HOST_SUFFIXES):
         raise IAToolkitException(error_type, f"{label} host is not allowed.")
 
+    host_allows_private = hostname in _normalize_host_allowlist(allowed_private_hosts)
+
     ip_value = _to_ip_or_none(hostname)
     if ip_value is not None:
-        if classify_ip(ip_value) != "public":
-            raise IAToolkitException(error_type, f"{label} host is not allowed.")
-        return parsed
+        classification = classify_ip(ip_value)
+        if classification == "public" or (classification == "private" and host_allows_private):
+            return parsed
+        raise IAToolkitException(error_type, f"{label} host is not allowed.")
 
     classifications = resolve_host_classifications(hostname)
-    if classifications and any(kind != "public" for kind in classifications):
-        raise IAToolkitException(
-            error_type,
-            f"{label} host is not allowed (resolves to a private or reserved address).",
-        )
+    if classifications:
+        # 'blocked' is never openable from configuration - see the docstring.
+        if any(kind == "blocked" for kind in classifications):
+            raise IAToolkitException(
+                error_type,
+                f"{label} host is not allowed "
+                "(resolves to a loopback, link-local or reserved address).",
+            )
+        if any(kind == "private" for kind in classifications) and not host_allows_private:
+            raise IAToolkitException(
+                error_type,
+                f"{label} host is not allowed (resolves to a private or reserved address).",
+            )
     return parsed
 
 
@@ -135,6 +192,7 @@ def fetch_with_safe_redirects(
     url: str,
     *,
     allowed_schemes: tuple[str, ...] = ("https",),
+    allowed_private_hosts: tuple[str, ...] = (),
     error_type: IAToolkitException.ErrorType = IAToolkitException.ErrorType.INVALID_PARAMETER,
     label: str = "URL",
     max_redirects: int = 3,
@@ -151,7 +209,11 @@ def fetch_with_safe_redirects(
     current_url = str(url or "").strip()
     for _ in range(max_redirects + 1):
         assert_public_http_url(
-            current_url, allowed_schemes=allowed_schemes, error_type=error_type, label=label
+            current_url,
+            allowed_schemes=allowed_schemes,
+            allowed_private_hosts=allowed_private_hosts,
+            error_type=error_type,
+            label=label,
         )
         response = requests.get(current_url, allow_redirects=False, **requests_kwargs)
         location = response.headers.get("Location") if response.status_code in _REDIRECT_STATUSES else None

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/locales/en.yaml

@@ -1038,6 +1038,89 @@ ui:
     status_auth_redirect: "Auth redirect"
     unknown_client: "unknown client"
 
+  scheduled_jobs:
+    title: "Scheduled jobs"
+    schedules: "Schedules"
+    runs: "History"
+    schedules_title: "Scheduled executions"
+    runs_title: "Run history"
+    loading: "Loading..."
+    show_disabled: "Show disabled"
+    new_schedule: "New schedule"
+    edit_schedule: "Edit schedule"
+    search_placeholder: "Search schedules or targets"
+    refresh: "Refresh"
+    name: "Name"
+    schedule: "Schedule"
+    next_run: "Next run"
+    last_result: "Last result"
+    enabled: "Enabled"
+    disabled: "Disabled"
+    actions: "Actions"
+    all_schedules: "All schedules"
+    status: "Status"
+    all_statuses: "All statuses"
+    default_view: "Default view"
+    run: "Run"
+    scheduled_for: "Scheduled for"
+    duration: "Duration"
+    detail: "Detail"
+    identity: "Identity"
+    target: "Target"
+    target_type: "What to run"
+    target_type_tool: "Tool"
+    target_type_native_job: "Native job"
+    target_type_pipeline: "Pipeline"
+    timing: "Timing"
+    cron_expression: "Cron expression"
+    cron_help_format: "Format: minute, hour, day of month, month, day of week."
+    cron_every_10_minutes: "every 10 min"
+    cron_daily_at_3: "daily at 03:00"
+    cron_weekdays_at_9: "weekdays at 09:00"
+    timezone: "Timezone"
+    execution: "Execution"
+    queue: "Queue"
+    timeout_seconds: "Timeout (seconds)"
+    max_retries: "Retries"
+    arguments_json: "Arguments (JSON)"
+    policies: "Policies"
+    misfire_policy: "After downtime"
+    policy_skip: "Skip"
+    policy_run_once: "Run once"
+    policy_catch_up: "Catch up"
+    grace_seconds: "Grace (seconds)"
+    max_catch_up: "Catch-up limit"
+    overlap_policy: "When a previous run is active"
+    overlap_skip: "Skip new run"
+    overlap_allow: "Allow overlap"
+    delete_title: "Delete schedule?"
+    delete_message: "The schedule and its run history will be permanently deleted."
+    summary: "{active} active of {total}"
+    empty: "No schedules found."
+    run_now: "Run now"
+    view_runs: "View runs"
+    runs_summary: "{count} recent runs"
+    runs_empty: "No runs found."
+    attempt: "Attempt {count}"
+    select_tool: "Select a tool"
+    select_native_job: "Select a native job"
+    select_pipeline: "Select a pipeline"
+    invalid_arguments_json: "Arguments must be a valid JSON object."
+    request_failed: "Request failed"
+    saved: "Schedule saved."
+    enabled_success: "Schedule enabled."
+    disabled_success: "Schedule disabled."
+    run_queued: "Run queued."
+    deleted: "Schedule deleted."
+    status_never: "Never run"
+    status_pending: "Pending"
+    status_queued: "Queued"
+    status_running: "Running"
+    status_retrying: "Retrying"
+    status_succeeded: "Succeeded"
+    status_failed: "Failed"
+    status_skipped: "Skipped"
+
   pipelines:
     source_root_label: "Root (prefix)"
     source_root_placeholder: "companies/<company_short_name>/..."

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/locales/es.yaml

@@ -1053,6 +1053,89 @@ ui:
     unknown_client: "cliente desconocido"
 
 
+  scheduled_jobs:
+    title: "Jobs programados"
+    schedules: "Programaciones"
+    runs: "Historial"
+    schedules_title: "Ejecuciones programadas"
+    runs_title: "Historial de ejecuciones"
+    loading: "Cargando..."
+    show_disabled: "Mostrar deshabilitados"
+    new_schedule: "Nueva programación"
+    edit_schedule: "Editar programación"
+    search_placeholder: "Buscar programaciones o destinos"
+    refresh: "Actualizar"
+    name: "Nombre"
+    schedule: "Programación"
+    next_run: "Próxima ejecución"
+    last_result: "Último resultado"
+    enabled: "Habilitada"
+    disabled: "Deshabilitada"
+    actions: "Acciones"
+    all_schedules: "Todas las programaciones"
+    status: "Estado"
+    all_statuses: "Todos los estados"
+    default_view: "Vista por defecto"
+    run: "Ejecución"
+    scheduled_for: "Programada para"
+    duration: "Duración"
+    detail: "Detalle"
+    identity: "Identidad"
+    target: "Destino"
+    target_type: "Qué ejecutar"
+    target_type_tool: "Tool"
+    target_type_native_job: "Job nativo"
+    target_type_pipeline: "Pipeline"
+    timing: "Horario"
+    cron_expression: "Expresión cron"
+    cron_help_format: "Formato: minuto, hora, día del mes, mes, día de la semana."
+    cron_every_10_minutes: "cada 10 min"
+    cron_daily_at_3: "diariamente a las 03:00"
+    cron_weekdays_at_9: "lunes a viernes a las 09:00"
+    timezone: "Zona horaria"
+    execution: "Ejecución"
+    queue: "Cola"
+    timeout_seconds: "Timeout (segundos)"
+    max_retries: "Reintentos"
+    arguments_json: "Argumentos (JSON)"
+    policies: "Políticas"
+    misfire_policy: "Después de una interrupción"
+    policy_skip: "Omitir"
+    policy_run_once: "Ejecutar una vez"
+    policy_catch_up: "Recuperar pendientes"
+    grace_seconds: "Tolerancia (segundos)"
+    max_catch_up: "Límite de recuperación"
+    overlap_policy: "Cuando una ejecución anterior sigue activa"
+    overlap_skip: "Omitir nueva ejecución"
+    overlap_allow: "Permitir solapamiento"
+    delete_title: "¿Eliminar programación?"
+    delete_message: "La programación y su historial de ejecuciones se eliminarán permanentemente."
+    summary: "{active} activas de {total}"
+    empty: "No se encontraron programaciones."
+    run_now: "Ejecutar ahora"
+    view_runs: "Ver ejecuciones"
+    runs_summary: "{count} ejecuciones recientes"
+    runs_empty: "No se encontraron ejecuciones."
+    attempt: "Intento {count}"
+    select_tool: "Selecciona una tool"
+    select_native_job: "Selecciona un job nativo"
+    select_pipeline: "Selecciona un pipeline"
+    invalid_arguments_json: "Los argumentos deben ser un objeto JSON válido."
+    request_failed: "La solicitud falló"
+    saved: "Programación guardada."
+    enabled_success: "Programación habilitada."
+    disabled_success: "Programación deshabilitada."
+    run_queued: "Ejecución encolada."
+    deleted: "Programación eliminada."
+    status_never: "Nunca ejecutada"
+    status_pending: "Pendiente"
+    status_queued: "En cola"
+    status_running: "Ejecutando"
+    status_retrying: "Reintentando"
+    status_succeeded: "Exitosa"
+    status_failed: "Fallida"
+    status_skipped: "Omitida"
+
   pipelines:
     source_root_label: "Raiz (prefijo)"
     source_root_placeholder: "companies/<company_short_name>/..."

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/repositories/models.py

@@ -358,6 +358,7 @@ class Tool(Base):
 
     # source of the definition (Source of Truth)
     SOURCE_SYSTEM = 'SYSTEM'
+    SOURCE_EXTENSION = 'EXTENSION'  # registered by an installed runtime extension
     SOURCE_YAML = 'YAML'         # defined in company.yaml
     SOURCE_USER = 'USER'         # defined via GUI/API
     SOURCE_PACK = 'PACK'         # materialized by enterprise control-plane

{iatoolkit-2.47.1 → iatoolkit-2.48.0}/src/iatoolkit/services/tool_service.py

@@ -983,6 +983,8 @@ class ToolService:
         desired_names.discard("")
 
         for name, tool in existing_by_name.items():
+            if tool.source == Tool.SOURCE_EXTENSION:
+                continue
             if name not in desired_names and bool(tool.is_active):
                 return True
 
@@ -1042,6 +1044,8 @@ class ToolService:
             desired_names.discard("")
             deactivated_tools = 0
             for name, tool in existing_by_name.items():
+                if tool.source == Tool.SOURCE_EXTENSION:
+                    continue
                 if name in desired_names or not bool(tool.is_active):
                     continue
                 tool.is_active = False

{iatoolkit-2.47.1 → iatoolkit-2.48.0/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.47.1
+Version: 2.48.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT