kailash 0.9.21__tar.gz → 0.9.22__tar.gz

{kailash-0.9.21/src/kailash.egg-info → kailash-0.9.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kailash
-Version: 0.9.21
+Version: 0.9.22
 Summary: Python SDK for the Kailash container-node architecture
 Home-page: https://github.com/integrum/kailash-python-sdk
 Author: Integrum

{kailash-0.9.21 → kailash-0.9.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "kailash"
-version = "0.9.21"
+version = "0.9.22"
 description = "Python SDK for the Kailash container-node architecture"
 authors = [
     {name = "Integrum", email = "info@integrum.com"}

{kailash-0.9.21 → kailash-0.9.22}/setup.py

@@ -13,7 +13,7 @@ with open(os.path.join(this_directory, "README.md"), encoding="utf-8") as f:
 # Package configuration
 setup(
     name="kailash",
-    version="0.9.21",
+    version="0.9.22",
     author="Integrum",
     author_email="info@integrum.com",
     description="Python SDK for the Kailash container-node architecture",

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/__init__.py

@@ -52,7 +52,7 @@ except ImportError:
 # For backward compatibility
 WorkflowGraph = Workflow
 
-__version__ = "0.9.21"
+__version__ = "0.9.22"
 
 __all__ = [
     # Core workflow components

kailash-0.9.22/src/kailash/api/tests/test_workflow_api_404.py

@@ -0,0 +1,202 @@
+"""
+Tests for WorkflowAPI Custom 404 Handler
+
+Tests that WorkflowAPI provides helpful 404 error messages
+with available endpoints when wrong paths are accessed.
+
+These tests follow TDD: They will FAIL initially until the 404 handler is implemented.
+This is expected behavior - we write tests FIRST, then implement.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from kailash.api.workflow_api import WorkflowAPI
+from kailash.workflow.builder import WorkflowBuilder
+
+
+@pytest.fixture
+def simple_workflow_api():
+    """Simple WorkflowAPI for testing"""
+    workflow = WorkflowBuilder()
+    workflow.add_node(
+        "PythonCodeNode", "test", {"code": "result = {'message': 'test'}"}
+    )
+    api = WorkflowAPI(workflow.build())
+    return api
+
+
+def test_404_returns_helpful_json(simple_workflow_api):
+    """Test that 404 errors return helpful JSON with available endpoints."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Try to access non-existent path
+    response = client.get("/nonexistent")
+
+    # Should return 404
+    assert response.status_code == 404
+
+    # Should be JSON
+    assert response.headers["content-type"] == "application/json"
+
+    # Should have helpful error message
+    data = response.json()
+    assert "error" in data or "detail" in data, "404 response should have error field"
+
+    # Should mention endpoints or provide helpful info
+    response_str = str(data).lower()
+    has_endpoint_info = (
+        "endpoint" in response_str
+        or "available" in response_str
+        or "path" in response_str
+    )
+    assert has_endpoint_info, "404 response should mention endpoints or paths"
+
+
+def test_404_lists_available_endpoints(simple_workflow_api):
+    """Test that 404 response includes list of available endpoints."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Try to access non-existent path
+    response = client.get("/invalid_path")
+
+    assert response.status_code == 404
+
+    data = response.json()
+
+    # Should have some reference to available endpoints
+    response_str = str(data)
+    endpoints = []
+
+    # Check if standard endpoints are mentioned
+    if "/execute" in response_str:
+        endpoints.append("/execute")
+    if "/workflow/info" in response_str or "/info" in response_str:
+        endpoints.append("/workflow/info")
+    if "/health" in response_str:
+        endpoints.append("/health")
+
+    # Should mention at least 2 of the 3 standard endpoints
+    assert (
+        len(endpoints) >= 2
+    ), f"404 response should mention available endpoints. Found: {endpoints}"
+
+
+def test_404_provides_helpful_hint(simple_workflow_api):
+    """Test that 404 response provides actionable hint."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Try wrong path
+    response = client.get("/wrong")
+
+    assert response.status_code == 404
+
+    data = response.json()
+    response_str = str(data).lower()
+
+    # Should have hint, message, or suggestion
+    has_helpful_content = (
+        "hint" in response_str
+        or "try" in response_str
+        or "use" in response_str
+        or "most common" in response_str
+        or "suggestion" in response_str
+        or "did you mean" in response_str
+    )
+
+    assert (
+        has_helpful_content
+    ), "404 response should provide helpful hints or suggestions"
+
+
+def test_404_includes_documentation_link(simple_workflow_api):
+    """Test that 404 response includes link to documentation."""
+    client = TestClient(simple_workflow_api.app)
+
+    response = client.get("/missing")
+
+    assert response.status_code == 404
+    data = response.json()
+
+    # Should have docs link or path
+    response_str = str(data).lower()
+    has_docs_reference = (
+        "docs" in response_str
+        or "documentation" in response_str
+        or "/docs" in response_str
+    )
+    assert has_docs_reference, "404 response should reference documentation"
+
+
+def test_404_handler_for_root_path(simple_workflow_api):
+    """Test 404 handler when accessing root path with wrong method."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Try to GET root (only POST is typically defined for execute)
+    response = client.get("/")
+
+    # Could be 404 or 405 Method Not Allowed
+    assert response.status_code in [
+        404,
+        405,
+    ], f"Expected 404 or 405, got {response.status_code}"
+
+    # If 404, should have helpful info
+    if response.status_code == 404:
+        data = response.json()
+        response_str = str(data).lower()
+
+        # Should mention execute or available methods
+        has_helpful_info = (
+            "execute" in response_str
+            or "post" in response_str
+            or "endpoint" in response_str
+        )
+        assert (
+            has_helpful_info
+        ), "404 on root should mention execute endpoint or POST method"
+
+
+def test_404_handler_preserves_fastapi_routes(simple_workflow_api):
+    """Test that valid routes still work after adding 404 handler."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Valid route should work
+    response = client.get("/health")
+
+    # Health endpoint should return 200
+    assert (
+        response.status_code == 200
+    ), "Valid routes should still work after adding 404 handler"
+
+    # Should return JSON
+    assert response.headers["content-type"] == "application/json"
+
+
+def test_404_response_format_consistency(simple_workflow_api):
+    """Test that 404 responses have consistent format."""
+    client = TestClient(simple_workflow_api.app)
+
+    # Try multiple invalid paths
+    paths = ["/invalid1", "/wrong/path", "/nonexistent/endpoint"]
+
+    for path in paths:
+        response = client.get(path)
+        assert response.status_code == 404
+
+        # All should return JSON
+        assert (
+            response.headers["content-type"] == "application/json"
+        ), f"404 response for {path} should be JSON"
+
+        # All should have error structure
+        data = response.json()
+        assert isinstance(
+            data, dict
+        ), f"404 response for {path} should be a JSON object"
+
+        # Should have at least one error-related field
+        has_error_field = any(key in data for key in ["error", "detail", "message"])
+        assert (
+            has_error_field
+        ), f"404 response for {path} should have error/detail/message field"

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/api/workflow_api.py

@@ -12,7 +12,7 @@ from typing import Any
 
 import uvicorn
 from fastapi import BackgroundTasks, FastAPI, HTTPException, Request
-from fastapi.responses import StreamingResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from pydantic import BaseModel, Field
 
 from kailash.runtime.local import LocalRuntime
@@ -129,6 +129,38 @@ class WorkflowAPI:
     def _setup_routes(self):
         """Setup API routes dynamically based on workflow."""
 
+        # Custom 404 handler for helpful error messages
+        @self.app.exception_handler(404)
+        async def custom_404_handler(request: Request, exc):
+            """Provide helpful 404 error with available endpoints."""
+            return JSONResponse(
+                status_code=404,
+                content={
+                    "error": "Endpoint not found",
+                    "path": request.url.path,
+                    "message": "The requested endpoint does not exist for this workflow.",
+                    "available_endpoints": [
+                        {
+                            "method": "POST",
+                            "path": "/execute",
+                            "description": "Execute the workflow with input parameters",
+                        },
+                        {
+                            "method": "GET",
+                            "path": "/workflow/info",
+                            "description": "Get workflow metadata and structure",
+                        },
+                        {
+                            "method": "GET",
+                            "path": "/health",
+                            "description": "Check workflow API health status",
+                        },
+                    ],
+                    "hint": "Most common: POST to /execute endpoint with JSON body containing 'inputs' field",
+                    "documentation": "/docs",
+                },
+            )
+
         # Root execution endpoint (convenience for direct workflow execution)
         @self.app.post("/")
         async def execute_workflow_root(

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/nodes/base.py

@@ -202,11 +202,13 @@ class Node(ABC):
             - Validates parameters are correctly specified
         """
         try:
-            self.id = kwargs.get("id", self.__class__.__name__)
+            # Use _node_id for internal node identifier (namespace separation)
+            # This prevents collision with user's 'id' parameter
+            self._node_id = kwargs.get("_node_id", self.__class__.__name__)
             self.metadata = kwargs.get(
                 "metadata",
                 NodeMetadata(
-                    id=self.id,
+                    id=self._node_id,  # NodeMetadata still uses 'id' internally
                     name=kwargs.get("name", self.__class__.__name__),
                     description=kwargs.get("description", self.__doc__ or ""),
                     version=kwargs.get("version", "1.0.0"),
@@ -214,7 +216,7 @@ class Node(ABC):
                     tags=kwargs.get("tags", set()),
                 ),
             )
-            self.logger = logging.getLogger(f"kailash.nodes.{self.id}")
+            self.logger = logging.getLogger(f"kailash.nodes.{self._node_id}")
 
             # Filter out internal fields from config with comprehensive parameter handling
             # Get parameter definitions once and cache for both filtering and validation
@@ -232,11 +234,12 @@ class Node(ABC):
 
             # Comprehensive parameter filtering: handle ALL potential conflicts
             # Fields that are always internal (never user parameters)
-            always_internal = {"metadata"}
+            always_internal = {"metadata", "_node_id"}
 
             # Fields that can be either internal or user parameters
+            # Note: 'id' removed from this list - users can now use 'id' freely
+            # since node identifier is now '_node_id'
             potentially_user_params = {
-                "id",
                 "name",
                 "description",
                 "version",
@@ -344,6 +347,32 @@ class Node(ABC):
             self._workflow_context = {}
         self._workflow_context[key] = value
 
+    @property
+    def id(self) -> str:
+        """
+        Backward compatibility property for node identifier.
+
+        Returns the node's identifier (_node_id). This property maintains
+        backward compatibility for code that accesses node.id.
+
+        The internal identifier is now _node_id to prevent namespace collision
+        with user's 'id' parameter.
+        """
+        return self._node_id
+
+    @id.setter
+    def id(self, value: str):
+        """
+        Setter for backward compatibility with code that sets node.id.
+
+        This allows graph.py and other code to set the node identifier
+        while internally using _node_id for namespace separation.
+
+        Args:
+            value: The node identifier to set
+        """
+        self._node_id = value
+
     @abstractmethod
     def get_parameters(self) -> dict[str, NodeParameter]:
         """Define the parameters this node accepts.

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/nodes/code/python.py

@@ -412,8 +412,11 @@ class CodeExecutor:
         # Check code safety first
         is_safe, violations, imports_found = self.check_code_safety(code)
 
-        # Sanitize inputs
-        sanitized_inputs = validate_node_parameters(inputs, self.security_config)
+        # Sanitize inputs with python_exec context
+        # Python code execution via exec() does not need shell metacharacter sanitization
+        sanitized_inputs = validate_node_parameters(
+            inputs, self.security_config, context="python_exec"
+        )
 
         # Create isolated namespace
         import builtins
@@ -572,8 +575,11 @@ class CodeExecutor:
         Raises:
             NodeExecutionError: If function execution fails
         """
-        # Sanitize inputs for security
-        sanitized_inputs = validate_node_parameters(inputs, self.security_config)
+        # Sanitize inputs for security with python_exec context
+        # Python function execution does not need shell metacharacter sanitization
+        sanitized_inputs = validate_node_parameters(
+            inputs, self.security_config, context="python_exec"
+        )
 
         try:
             # Get function signature

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/security.py

@@ -475,6 +475,7 @@ def sanitize_input(
     max_length: int = 10000,
     allowed_types: list[type] | None = None,
     config: SecurityConfig | None = None,
+    context: str = "generic",
 ) -> Any:
     """
     Sanitize input values to prevent injection attacks.
@@ -484,12 +485,22 @@ def sanitize_input(
         max_length: Maximum string length
         allowed_types: List of allowed types
         config: Security configuration
+        context: Execution context for context-aware sanitization.
+            - "generic": Default moderate sanitization (backward compatible)
+            - "python_exec": Python code execution (preserves shell metacharacters)
+            - "shell_exec": Shell command execution (removes all dangerous characters)
 
     Returns:
         Sanitized value
 
     Raises:
         SecurityError: If input fails validation
+
+    Note:
+        The context parameter allows for appropriate security measures based on
+        how the data will be used. Python code execution via exec() does not
+        need shell metacharacter sanitization since characters like $, ;, &, |
+        are regular Python string characters and not executed by a shell.
     """
     if config is None:
         config = get_security_config()
@@ -751,32 +762,59 @@ def sanitize_input(
         if len(value) > max_length:
             raise SecurityError(f"Input too long: {len(value)} > {max_length}")
 
-        # Remove potentially dangerous characters and patterns
-        sanitized = re.sub(r"[<>;&|`$()]", "", value)
-        # Remove script tags and javascript
-        sanitized = re.sub(
-            r"<script.*?</script>", "", sanitized, flags=re.IGNORECASE | re.DOTALL
-        )
-        sanitized = re.sub(r"javascript:", "", sanitized, flags=re.IGNORECASE)
+        # Context-aware sanitization
+        if context == "python_exec":
+            # Python execution context: Only remove XSS patterns, preserve shell metacharacters
+            # Python exec() does not execute shell commands, so $, ;, &, |, `, (, ) are safe
+            sanitized = re.sub(
+                r"<script.*?</script>", "", value, flags=re.IGNORECASE | re.DOTALL
+            )
+            sanitized = re.sub(r"javascript:", "", sanitized, flags=re.IGNORECASE)
+            # Remove only the most dangerous HTML tags for XSS prevention
+            sanitized = re.sub(
+                r"</?(?:script|iframe|object|embed).*?>",
+                "",
+                sanitized,
+                flags=re.IGNORECASE,
+            )
+        elif context == "shell_exec":
+            # Shell execution context: Remove all shell metacharacters
+            sanitized = re.sub(r"[<>;&|`$()]", "", value)
+            sanitized = re.sub(
+                r"<script.*?</script>", "", sanitized, flags=re.IGNORECASE | re.DOTALL
+            )
+            sanitized = re.sub(r"javascript:", "", sanitized, flags=re.IGNORECASE)
+        else:
+            # Generic context: Moderate sanitization (backward compatible)
+            # Remove only basic XSS patterns, preserve most characters
+            sanitized = re.sub(
+                r"<script.*?</script>", "", value, flags=re.IGNORECASE | re.DOTALL
+            )
+            sanitized = re.sub(r"javascript:", "", sanitized, flags=re.IGNORECASE)
+            # Remove angle brackets for basic XSS protection
+            sanitized = re.sub(r"[<>]", "", sanitized)
 
         if sanitized != value and config.enable_audit_logging:
-            logger.warning(f"Input sanitized: {value[:50]}... -> {sanitized[:50]}...")
+            logger.warning(
+                f"Input sanitized ({context}): {value[:50]}... -> {sanitized[:50]}..."
+            )
 
         return sanitized
 
     # Dictionary sanitization (recursive)
     if isinstance(value, dict):
         return {
-            sanitize_input(k, max_length, allowed_types, config): sanitize_input(
-                v, max_length, allowed_types, config
-            )
+            sanitize_input(
+                k, max_length, allowed_types, config, context
+            ): sanitize_input(v, max_length, allowed_types, config, context)
             for k, v in value.items()
         }
 
     # List sanitization (recursive)
     if isinstance(value, list):
         return [
-            sanitize_input(item, max_length, allowed_types, config) for item in value
+            sanitize_input(item, max_length, allowed_types, config, context)
+            for item in value
         ]
 
     return value
@@ -811,7 +849,9 @@ def create_secure_temp_dir(
 
 
 def validate_node_parameters(
-    parameters: dict[str, Any], config: SecurityConfig | None = None
+    parameters: dict[str, Any],
+    config: SecurityConfig | None = None,
+    context: str = "generic",
 ) -> dict[str, Any]:
     """
     Validate and sanitize node parameters.
@@ -819,6 +859,10 @@ def validate_node_parameters(
     Args:
         parameters: Node parameters to validate
         config: Security configuration
+        context: Execution context for context-aware sanitization
+            - "generic": Default moderate sanitization
+            - "python_exec": Python code execution (preserves shell metacharacters)
+            - "shell_exec": Shell command execution (removes all dangerous characters)
 
     Returns:
         Validated and sanitized parameters
@@ -833,20 +877,22 @@ def validate_node_parameters(
 
     for key, value in parameters.items():
         # Sanitize parameter key
-        clean_key = sanitize_input(key, config=config)
+        clean_key = sanitize_input(key, config=config, context=context)
 
         # Special handling for file paths
         if "path" in key.lower() or "file" in key.lower():
             if isinstance(value, (str, Path)):
                 validated_value = validate_file_path(value, config, f"parameter {key}")
             else:
-                validated_value = sanitize_input(value, config=config)
+                validated_value = sanitize_input(value, config=config, context=context)
         else:
-            validated_value = sanitize_input(value, config=config)
+            validated_value = sanitize_input(value, config=config, context=context)
 
         validated_params[clean_key] = validated_value
 
     if config.enable_audit_logging:
-        logger.info(f"Node parameters validated: {list(validated_params.keys())}")
+        logger.info(
+            f"Node parameters validated ({context}): {list(validated_params.keys())}"
+        )
 
     return validated_params

{kailash-0.9.21 → kailash-0.9.22}/src/kailash/workflow/graph.py

@@ -154,19 +154,19 @@ class Workflow:
 
         try:
             # Handle different constructor patterns
-            if "name" in params and "id" not in params:
+            if "name" in params and "_node_id" not in params:
                 # Node expects 'name' parameter (like PythonCodeNode)
                 if "name" not in config:
                     config = config.copy()  # Don't modify original
                     config["name"] = node_id
                 return node_class(**config)
-            elif "id" in params:
-                # Node expects 'id' parameter (traditional pattern)
-                return node_class(id=node_id, **config)
+            elif "_node_id" in params:
+                # Node expects '_node_id' parameter (namespace-separated metadata)
+                return node_class(_node_id=node_id, **config)
             else:
                 # Fallback: try both patterns
                 try:
-                    return node_class(id=node_id, **config)
+                    return node_class(_node_id=node_id, **config)
                 except TypeError:
                     # Try with name parameter
                     config = config.copy()

{kailash-0.9.21 → kailash-0.9.22/src/kailash.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kailash
-Version: 0.9.21
+Version: 0.9.22
 Summary: Python SDK for the Kailash container-node architecture
 Home-page: https://github.com/integrum/kailash-python-sdk
 Author: Integrum

{kailash-0.9.21 → kailash-0.9.22}/src/kailash.egg-info/SOURCES.txt

@@ -33,6 +33,7 @@ src/kailash/api/gateway.py
 src/kailash/api/mcp_integration.py
 src/kailash/api/studio.py
 src/kailash/api/workflow_api.py
+src/kailash/api/tests/test_workflow_api_404.py
 src/kailash/channels/__init__.py
 src/kailash/channels/api_channel.py
 src/kailash/channels/base.py