pulse-engine 0.2.22__tar.gz → 0.2.23__tar.gz

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulse-engine
-Version: 0.2.22
+Version: 0.2.23
 Summary: Pulse Engine — Hybrid framework for building Pulse products
 Author: Pulse Team
 Requires-Python: >=3.11,<3.13

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pulse-engine"
-version = "0.2.22"
+version = "0.2.23"
 description = "Pulse Engine — Hybrid framework for building Pulse products"
 authors = ["Pulse Team"]
 readme = "README.md"

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/cron/pipeline_sync.py

@@ -76,16 +76,23 @@ async def sync_pipeline_schedules(session: AsyncSession, settings: Settings) ->
                 continue
 
             name = config.deployment_name
+            # Internal trigger endpoint: authenticated by the shared cron-internal
+            # token (not a tenant Bearer token) and accepts a JSON body, so the
+            # generic cron_job_flow can fire it without Cognito creds or multipart.
             trigger_url = (
-                f"{settings.pulse_engine_url.rstrip('/')}/api/v1/pipelines/trigger"
+                f"{settings.pulse_engine_url.rstrip('/')}"
+                "/api/v1/pipelines/trigger-internal"
                 if settings.pulse_engine_url
-                else "/api/v1/pipelines/trigger"
+                else "/api/v1/pipelines/trigger-internal"
             )
 
             await repo.upsert(
                 tenant_id=tenant_id,
                 name=name,
                 webhook_url=trigger_url,
+                webhook_headers={
+                    "X-Cron-Internal-Token": settings.pulse_cron_internal_token
+                },
                 schedule=config.infra.schedule,
                 payload={"pipeline_name": config.name, "yaml_path": str(yaml_path)},
                 job_type="pipeline",

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/middleware/tenant.py

@@ -30,6 +30,13 @@ PUBLIC_PATHS = {
 }
 
 
+# Paths authenticated by the shared X-Cron-Internal-Token (verified in-endpoint)
+# rather than a tenant Bearer token — must bypass TenantMiddleware resolution.
+INTERNAL_TOKEN_PATHS = {
+    "/api/v1/pipelines/trigger-internal",
+}
+
+
 def _is_cron_internal_path(path: str) -> bool:
     """True for cron callback endpoints authenticated via X-Cron-Internal-Token."""
     # /api/v1/cron-jobs/{job_id}/runs/init
@@ -54,7 +61,12 @@ class TenantMiddleware(BaseHTTPMiddleware):
     async def dispatch(
         self, request: Request, call_next: RequestResponseEndpoint
     ) -> Response:
-        if request.url.path in PUBLIC_PATHS or _is_cron_internal_path(request.url.path):
+        path = request.url.path
+        if (
+            path in PUBLIC_PATHS
+            or path in INTERNAL_TOKEN_PATHS
+            or _is_cron_internal_path(path)
+        ):
             return await call_next(request)
 
         try:

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/pipeline/config_parser.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+from collections.abc import Iterator
+from pathlib import Path
+
 import yaml  # type: ignore[import-untyped]
 from pydantic import ValidationError
 
@@ -35,6 +38,42 @@ def parse_pipeline_config(yaml_content: str) -> PipelineConfig:
     return config
 
 
+def iter_pipeline_configs(pipeline_dirs: str) -> Iterator[tuple[Path, PipelineConfig]]:
+    """Yield ``(path, config)`` for every valid ``*.yaml`` across the dirs.
+
+    ``pipeline_dirs`` is a colon-separated list (same format as
+    ``Settings.pulse_pipeline_dirs``). Missing dirs and files that fail
+    validation are skipped silently — callers that care log their own context.
+    """
+    for raw in pipeline_dirs.split(":"):
+        entry = raw.strip()
+        if not entry:
+            continue
+        directory = Path(entry)
+        if not directory.is_dir():
+            continue
+        for yaml_path in sorted(directory.glob("*.yaml")):
+            try:
+                config = parse_pipeline_config(yaml_path.read_text())
+            except PipelineConfigError:
+                continue
+            yield yaml_path, config
+
+
+def find_pipeline_config(
+    pipeline_dirs: str, pipeline_name: str
+) -> PipelineConfig | None:
+    """Return the first pipeline config whose ``name`` matches, else ``None``.
+
+    Names are assumed unique across the configured dirs; if two configs share a
+    name the first (sorted, per-dir) match wins.
+    """
+    for _path, config in iter_pipeline_configs(pipeline_dirs):
+        if config.name == pipeline_name:
+            return config
+    return None
+
+
 def validate_dag(config: PipelineConfig) -> None:
     """Validate DAG structure for v2 pipelines."""
     errors: list[str] = []

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/pipeline/router_pipelines.py

@@ -8,6 +8,7 @@ from fastapi import (
     Depends,
     File,
     Form,
+    Header,
     HTTPException,
     Request,
     UploadFile,
@@ -19,11 +20,13 @@ from pulse_engine.dependencies import get_db_session
 from pulse_engine.middleware.tenant import get_tenant_id
 from pulse_engine.pipeline.config_parser import (
     PipelineConfigError,
+    find_pipeline_config,
     parse_pipeline_config,
 )
 from pulse_engine.pipeline.schemas import (
     InitRunRequest,
     InitRunResponse,
+    InternalTriggerRequest,
     PipelineRunListResponse,
     PipelineRunStatus,
     PipelineStatusResponse,
@@ -109,6 +112,65 @@ async def trigger_pipeline(
     return TriggerResponse(run_id=run_id)
 
 
+def _verify_cron_internal_token(
+    request: Request,
+    x_cron_internal_token: Annotated[str | None, Header()] = None,
+) -> None:
+    """Authorize internal callers via the shared cron-internal token."""
+    settings = request.app.state.settings
+    expected = getattr(settings, "pulse_cron_internal_token", "")
+    if not expected or x_cron_internal_token != expected:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing internal token",
+        )
+
+
+@router.post(
+    "/trigger-internal",
+    status_code=status.HTTP_202_ACCEPTED,
+    response_model=TriggerResponse,
+)
+async def trigger_pipeline_internal(
+    body: InternalTriggerRequest,
+    request: Request,
+    service: Annotated[PipelineService, Depends(get_pipeline_service)] = None,  # type: ignore[assignment]
+    _: None = Depends(_verify_cron_internal_token),
+) -> TriggerResponse:
+    """Trigger a scheduled pipeline by name, authenticated by cron-internal token.
+
+    Used by ``cron_job_flow`` for ``type=pipeline`` crons: resolves the pipeline
+    config from ``pulse_pipeline_dirs`` server-side (no multipart upload, no
+    tenant Bearer token needed). Tenant is taken from the config, mirroring
+    ``sync_pipeline_schedules``.
+    """
+    settings = request.app.state.settings
+    config = find_pipeline_config(
+        getattr(settings, "pulse_pipeline_dirs", "") or "", body.pipeline_name
+    )
+    if config is None:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Pipeline '{body.pipeline_name}' not found in configured dirs",
+        )
+
+    tenant_id = config.config.get("tenant_id") or "default"
+    try:
+        run_id = await service.trigger(
+            tenant_id=tenant_id,
+            product=config.name,
+            orchestrator=config.infra.orchestrator,
+            config=config,
+            global_config=config.config,
+        )
+    except PipelineSubmissionError as e:
+        raise HTTPException(status_code=502, detail=str(e))
+    except PipelineServiceError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+    return TriggerResponse(run_id=run_id)
+
+
 @router.post(
     "/runs/init",
     status_code=status.HTTP_201_CREATED,

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/pipeline/schemas.py

@@ -172,6 +172,16 @@ class TriggerPayload(BaseModel):
     orchestrator: Literal["prefect"] | None = None
 
 
+class InternalTriggerRequest(BaseModel):
+    """Body for the internal cron-token pipeline trigger.
+
+    Extra fields (e.g. ``yaml_path``, ``cron_run_id``) sent by ``cron_job_flow``
+    are ignored.
+    """
+
+    pipeline_name: str
+
+
 class PipelineRunStatus(str, Enum):
     pending = "pending"
     running = "running"

{pulse_engine-0.2.22 → pulse_engine-0.2.23}/src/pulse_engine/pipeline/service.py

@@ -332,10 +332,13 @@ class PipelineService:
         now = datetime.now(tz=UTC)
         await self._run_repo.update_status(run.id, "running", started_at=now)
 
+        # Cron/scheduled per-execution runs may retry or run for days after the
+        # token is minted; use the same 90-day TTL as the scheduled trigger path
+        # so step-status callbacks don't 401 on an expired token.
         token = self._token_issuer.issue_token(
             pipeline_run_id=run.id,
             tenant_id=tenant_id,
-            ttl_seconds=86400,
+            ttl_seconds=7_776_000,  # 90 days
         )
         return run.id, token