simview 6.2.3__tar.gz → 6.3.0__tar.gz

{simview-6.2.3/simview.egg-info → simview-6.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simview
-Version: 6.2.3
+Version: 6.3.0
 Summary: THREE.js-based simulation visualization tool
 Author-email: Jan Vlk <vlkjan6@fel.cvut.cz>, Ales Kucera <kuceral4@fel.cvut.cz>, David Korcak <david.korcak@gmail.com>
 License-Expression: BSD-3-Clause

{simview-6.2.3 → simview-6.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simview"
-version = "6.2.3"
+version = "6.3.0"
 readme = "README.md"
 requires-python = ">=3.12"
 license = "BSD-3-Clause"

{simview-6.2.3 → simview-6.3.0}/simview/__main__.py

@@ -297,9 +297,18 @@ def save_merged(
         logger.error("Error: --save-merged requires at least 2 input files to merge.")
         sys.exit(1)
 
+    from simview.columnar import columnarize_states, inline_blob
     from simview.merge import merge_simulation_files
 
     merged = merge_simulation_files(paths, selections)
+    # Pack the merged states the same way SimulationScene.save does: merge
+    # decodes every blob to plain lists, so dumping it directly would write
+    # the fat legacy per-frame layout. Falls back silently when numpy is
+    # unavailable or the states are too irregular (columnarize_states
+    # returns None).
+    columnar_states = columnarize_states(merged["states"], merged["model"], inline_blob)
+    if columnar_states is not None:
+        merged["states"] = columnar_states
     payload = json.dumps(merged).encode("utf-8")
     if out_path.suffix == ".gz":
         payload = gzip.compress(payload, compresslevel=1)
@@ -372,7 +381,12 @@ def _add_host_port_flags(sp: argparse.ArgumentParser) -> None:
         "--host",
         type=str,
         default="127.0.0.1",
-        help="Host/interface for the server to bind to (default: 127.0.0.1).",
+        help=(
+            "Host/interface for the server to bind to (default: 127.0.0.1). "
+            "Note: the server has no authentication, so binding to a "
+            "non-loopback address exposes the scene data to everyone who can "
+            "reach it."
+        ),
     )
     sp.add_argument(
         "--port",

{simview-6.2.3 → simview-6.3.0}/simview/info.py

@@ -1,8 +1,7 @@
 """Structural summary of a scene JSON file, for `simview info` and for coding
 agents inspecting simview-generated data files.
 
-Deliberately dependency-free (stdlib only: json, gzip via
-`simview.utils.read_maybe_gzipped_bytes`, base64) so it works on a base
+Deliberately dependency-free (stdlib only: json, gzip, base64) so it works on a base
 install without the `authoring` extra (torch/numpy) -- see "Lazy imports" in
 docs/dev/architecture.md. Does not import `simview.model`/`simview.server`:
 the former pulls in torch at module scope, the latter fastapi/uvicorn --
@@ -11,6 +10,7 @@ both wrong layering for a lightweight inspection tool. Shares its blob-decoding/
 which are stdlib-only on this read path.
 """
 
+import gzip
 import json
 from pathlib import Path
 from typing import Any
@@ -23,7 +23,7 @@ from simview.columnar import (
     is_blob,
     is_columnar,
 )
-from simview.utils import body_label, cap, human_bytes, read_maybe_gzipped_bytes
+from simview.utils import body_label, cap, human_bytes
 
 _MAX_DETAIL_ITEMS = 20
 _LARGE_FILE_BYTES = 100_000_000
@@ -218,9 +218,12 @@ def _summarize_states(states, model: dict | None, warnings: list[str]) -> dict:
 
     scalars_summary = {}
     for name in scalar_names:
-        missing = [i for i, s in enumerate(states) if name not in s]
+        # One pass per scalar: collect missing-frame indices and check
+        # lengths in the same walk.
+        missing = []
         for i, s in enumerate(states):
             if name not in s:
+                missing.append(i)
                 continue
             value = s[name]
             length = len(value) if isinstance(value, list) else 1
@@ -395,7 +398,10 @@ def summarize_scene(path: str | Path) -> dict:
     path = Path(path)
     raw = path.read_bytes()
     gzipped = raw[:2] == b"\x1f\x8b"
-    data = json.loads(read_maybe_gzipped_bytes(path))
+    # Decompress from the bytes already in hand rather than calling
+    # read_maybe_gzipped_bytes(path), which would read the whole file a
+    # second time -- scene files are often hundreds of MB.
+    data = json.loads(gzip.decompress(raw) if gzipped else raw)
     if not isinstance(data, dict):
         raise ValueError(
             "scene file must contain a JSON object with 'model'/'states' keys"

{simview-6.2.3 → simview-6.3.0}/simview/server.py

@@ -7,6 +7,7 @@ import hashlib
 import json
 import logging
 import os
+import re
 import secrets
 import threading
 import time
@@ -23,6 +24,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel
+from starlette.datastructures import Headers
 from starlette.types import Scope
 
 from simview.columnar import columnarize_states, is_columnar, rewrite_blobs
@@ -36,7 +38,31 @@ STATIC = str(files("simview").joinpath("static"))
 # Local-only viewer: CORS is restricted to localhost/127.0.0.1 on any port so a
 # browser tab open on another local dev server can't be silently allowed, while
 # still letting the bundled UI (served from the same host) talk to the API.
-_ALLOWED_ORIGIN_REGEX = r"^https?://(localhost|127\.0\.0\.1)(:\d+)?$"
+# The host list is shared with the /ws/states origin check (see
+# _LOCAL_ORIGIN_RE below), so the two can't drift apart.
+_LOCAL_HOSTS = r"(localhost|127\.0\.0\.1|\[::1\])"
+_ALLOWED_ORIGIN_REGEX = rf"^https?://{_LOCAL_HOSTS}(:\d+)?$"
+
+# The same host list, compiled, for the /ws/states origin check (see
+# _ws_origin_allowed): CORS does not apply to WebSockets, so the endpoint has
+# to check the browser's Origin header itself.
+_LOCAL_ORIGIN_RE = re.compile(rf"^{_LOCAL_HOSTS}(:\d+)?$")
+# A bare address (IPv4 or IPv6 literal, optionally bracketed) -- what a Host
+# header holds when the browser dialed the server by address rather than by a
+# (rebindable) name. Also used by that check.
+_IP_LITERAL_RE = re.compile(r"^\[?[0-9A-Fa-f:.]+\]?$")
+
+# Hosts run()/ViewerHandle bind to without a warning (see _warn_public_bind).
+_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+# Hard cap on the declared size of any request body. /batch-names is the only
+# endpoint that accepts one, and a scene's batch names are a handful of short
+# strings, so 1 MiB is orders of magnitude above legitimate use while keeping a
+# rogue POST (or a runaway client) from ballooning memory or the on-disk
+# sidecar.
+_MAX_REQUEST_BODY_BYTES = 1 << 20
+# Per-name cap for POST /batch-names, same reasoning per string.
+_MAX_BATCH_NAME_CHARS = 256
 
 # Subdirectories of simview/static that hold vendored, version-pinned third-party
 # libraries. These never change for a given release, so they get a long-lived,
@@ -101,6 +127,99 @@ def _not_found(what: str) -> JSONResponse:
     return JSONResponse({"message": f"{what} data not available"}, status_code=404)
 
 
+def _warn_public_bind(host: str) -> None:
+    """Warn when the server is bound where other machines can reach it.
+
+    The server has no authentication: anyone who can connect can read the
+    scene data and persist batch names to disk next to the scene file. That is
+    fine on loopback (the default, and all a personal viewer needs) and a
+    deliberate choice on e.g. an HPC login node -- hence a warning, not an
+    error.
+    """
+    if host not in _LOOPBACK_HOSTS:
+        logger.warning(
+            "Serving on %s with NO authentication: anyone who can reach this "
+            "address can read the scene data and write batch names. Only bind "
+            "to a shared interface on networks you trust.",
+            host,
+        )
+
+
+def _host_of(authority: str) -> str:
+    """The host part of a Host-header-style `host[:port]` authority, keeping
+    IPv6 brackets intact ('[::1]:5420' -> '[::1]')."""
+    if authority.startswith("["):
+        return authority.partition("]")[0] + "]"
+    return authority.partition(":")[0]
+
+
+def _ws_origin_allowed(websocket: WebSocket) -> bool:
+    """Whether /ws/states should serve this connection.
+
+    Browsers always send an Origin header on WebSocket connections, and CORS
+    does not apply to them, so without this check any site open in the user's
+    browser could connect to a running live viewer and read every pushed
+    frame. Two origins are allowed:
+
+    * a localhost one (the viewer itself, another local dev server, the
+      Jupyter iframe), matching the CORS list above;
+    * a same-origin one -- the Origin's host:port equals the Host header, i.e.
+      a page this very server served, connecting back to the address it was
+      loaded from. The Host must additionally name an address or 'localhost':
+      a hostname that Origin and Host agree on is the DNS-rebinding signature,
+      while an address the browser actually dialed is by construction this
+      machine. (The trade-off: a live viewer reached by hostname over the LAN
+      is refused -- reach it by address, e.g. http://10.0.0.5:5420.)
+
+    A missing Origin (tests, non-browser tooling) is allowed; browsers never
+    omit it.
+    """
+    origin = websocket.headers.get("origin")
+    if origin is None:
+        return True
+    match = re.match(r"^https?://([^/?#]+)", origin)
+    if not match:
+        return False
+    if _LOCAL_ORIGIN_RE.match(match.group(1)):
+        return True
+    host_header = websocket.headers.get("host", "")
+    if match.group(1) != host_header:
+        return False
+    host = _host_of(host_header)
+    return host == "localhost" or _IP_LITERAL_RE.match(host) is not None
+
+
+class _BodySizeLimitMiddleware:
+    """Rejects requests whose declared body exceeds _MAX_REQUEST_BODY_BYTES.
+
+    Checks Content-Length and answers 413 before FastAPI/uvicorn buffers and
+    parses anything. A chunked request with no Content-Length slips past this
+    -- acceptable for a local single-user tool, where the point is bounding
+    what a casual or runaway client can push, not defeating a deliberate
+    attacker with full protocol control.
+    """
+
+    def __init__(self, app):
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive, send):
+        if scope["type"] == "http":
+            length = Headers(scope=scope).get("content-length")
+            if length is not None and length.isdigit():
+                if int(length) > _MAX_REQUEST_BODY_BYTES:
+                    response = JSONResponse(
+                        {
+                            "message": (
+                                f"Request body exceeds {_MAX_REQUEST_BODY_BYTES} bytes"
+                            )
+                        },
+                        status_code=413,
+                    )
+                    await response(scope, receive, send)
+                    return
+        await self.app(scope, receive, send)
+
+
 class BatchNamesRequest(BaseModel):
     names: list[str]
 
@@ -168,10 +287,15 @@ class SimViewServer:
         # SimViewServer doesn't need a reference to it. Bounded: on a run
         # longer than the cap the oldest frames are forgotten, so a late viewer
         # replays the most recent window instead of the entire history.
-        self.frame_buffer: deque[dict] = deque(maxlen=frame_buffer_size)
+        # Each entry is (absolute frame index, frame): the index rides with
+        # the frame so a catch-up never has to reconstruct it from
+        # `frames_pushed - len(buffer)`, whose two halves are updated by
+        # different threads and could be read mid-update.
+        self.frame_buffer: deque[tuple[int, dict]] = deque(maxlen=frame_buffer_size)
         # Absolute index (in the producer's scene.states) of the next frame to
-        # enter frame_buffer, so a catch-up can tell the viewer where its
-        # window starts -- episode startIndex values are absolute too.
+        # enter frame_buffer. Maintained by push_frame on the producer's thread
+        # and read there only (live.py); catch-up reads the indices stored in
+        # the buffer instead.
         self.frames_pushed = 0
         self._batch_selections = (
             None if batch_selections is None else [str(s) for s in batch_selections]
@@ -213,6 +337,10 @@ class SimViewServer:
             allow_methods=["GET", "POST"],
             allow_headers=["*"],
         )
+        # Body-size cap for the one endpoint with a request body. Added after
+        # CORS above, so it wraps it and rejects oversized payloads before any
+        # middleware or handler runs.
+        self.app.add_middleware(_BodySizeLimitMiddleware)
 
         # Mount static files. StaticFiles adds ETag/Last-Modified headers so
         # unchanged assets (vendored libs, textures, our own JS) are served
@@ -286,9 +414,13 @@ class SimViewServer:
         # write dead "/blob/..." URLs, and a second show() would serve stale
         # blob references). Deep-copying just the model is cheap: the big
         # payloads are immutable blob strings, which deepcopy shares rather
-        # than duplicating. `states` is never mutated, so it isn't copied.
+        # than duplicating. A columnar `states` doc gets the same treatment
+        # below (rewrite_blobs rewrites its inline blobs in place too); the
+        # legacy per-frame list is only ever read.
         if preloaded and model_data is not None:
             model_data = copy.deepcopy(model_data)
+        if preloaded and is_columnar(states_data):
+            states_data = copy.deepcopy(states_data)
 
         # Taken once, at load: the sidecar must describe the batches that were
         # actually loaded, not whatever the file is by the time of a rename.
@@ -323,8 +455,11 @@ class SimViewServer:
         # Random per-load token folded into every blob URL so it's safe to cache
         # them forever: a later server restart serving a different scene on the
         # same port gets a different token, so it can never collide with a
-        # stale cached response for blob id N from a previous load.
-        self._blob_token = secrets.token_hex(4)
+        # stale cached response for blob id N from a previous load. It doubles
+        # as the only thing gating /blob responses (the /model payload that
+        # lists the URLs is CORS-restricted), so it is 128-bit rather than the
+        # few bits a pure cache-buster would need.
+        self._blob_token = secrets.token_hex(16)
 
         def register_blob(raw: bytes) -> str:
             blob_id = len(self.blobs)
@@ -461,6 +596,19 @@ class SimViewServer:
                     media_type="application/json",
                     status_code=400,
                 )
+            if any(len(name) > _MAX_BATCH_NAME_CHARS for name in names):
+                return Response(
+                    content=json.dumps(
+                        {
+                            "message": (
+                                "Batch names must each be at most "
+                                f"{_MAX_BATCH_NAME_CHARS} characters"
+                            )
+                        }
+                    ),
+                    media_type="application/json",
+                    status_code=400,
+                )
 
             self.model_data["batchNames"] = names
             self._pack_model()
@@ -490,6 +638,23 @@ class SimViewServer:
             # so a viewer opened mid-run still sees the recent timeline.
             @self.app.websocket("/ws/states")
             async def ws_states(websocket: WebSocket):
+                if not _ws_origin_allowed(websocket):
+                    # CORS doesn't apply to WebSockets, so the endpoint checks
+                    # the browser's Origin itself (see _ws_origin_allowed).
+                    # Rejected during the handshake, before any frame is sent.
+                    # A warning, not info: the hostname case is a formerly
+                    # working setup now refused, and this line is the only
+                    # server-side clue.
+                    logger.warning(
+                        "Rejected /ws/states connection with Origin %r: only "
+                        "localhost and same-origin pages may connect to the "
+                        "live stream. A viewer opened by hostname must be "
+                        "opened by its address instead (e.g. "
+                        "http://10.0.0.5:5420).",
+                        websocket.headers.get("origin"),
+                    )
+                    await websocket.close(code=1008)
+                    return
                 await websocket.accept()
                 try:
                     await self._send_catchup(websocket)
@@ -524,20 +689,22 @@ class SimViewServer:
             if not pending:
                 self.ws_clients.add(websocket)
                 return
-            # Absolute index of buffered[0]: everything pushed minus what the
-            # (bounded) buffer still holds.
-            offset = self.frames_pushed - len(buffered) + replayed
             for start in range(0, len(pending), _CATCHUP_CHUNK_SIZE):
                 chunk = pending[start : start + _CATCHUP_CHUNK_SIZE]
                 await websocket.send_text(
-                    json.dumps({"states": chunk, "frameOffset": offset + start})
+                    json.dumps(
+                        {
+                            "states": [frame for _, frame in chunk],
+                            "frameOffset": pending[start][0],
+                        }
+                    )
                 )
             replayed += len(pending)
 
     def push_frame(self, frame: dict) -> None:
         """Record one new frame for catch-up (live mode). The caller
         broadcasts it separately via `broadcast_frame`."""
-        self.frame_buffer.append(frame)
+        self.frame_buffer.append((self.frames_pushed, frame))
         self.frames_pushed += 1
 
     def set_episodes(self, episodes: list[dict]) -> None:
@@ -599,6 +766,7 @@ class SimViewServer:
         open_browser: bool = False,
     ):
         """Serve on `host:port`, blocking until the server stops."""
+        _warn_public_bind(host)
         logger.info("SimView server running on http://%s:%s", host, port)
         if open_browser:
             import webbrowser
@@ -693,6 +861,7 @@ class ViewerHandle:
         self.port = find_free_port(host, preferred_port)
         self.view = view
         self.iframe_height = iframe_height
+        _warn_public_bind(host)
 
         # Prefer uvicorn's modern sansio websocket implementation when the
         # `websockets` package is available -- the default "auto" still selects

{simview-6.2.3 → simview-6.3.0}/simview/static/js/SimView.js

@@ -25,7 +25,7 @@ import { escapeHtml } from "./utils/html.js";
 import { bytesPerFrame, shouldWindowField } from "./utils/blobWindow.js";
 import { shouldFollowLive } from "./utils/liveFollow.js";
 import { shiftEpisodes } from "./utils/episodes.js";
-import { parseViewState, parseStartupOptions, serializeViewState, toggleMapFromUiState } from "./utils/viewState.js";
+import { parseViewState, parseStartupOptions, safeStaticBase, serializeViewState, toggleMapFromUiState } from "./utils/viewState.js";
 import { mergeUiDefaults, applyViewerDomDefaults, panelHideCss } from "./utils/viewerDefaults.js";
 
 export class SimView {
@@ -80,10 +80,13 @@ export class SimView {
             console.log(`SimView: static demo mode, base='${simView.staticBase}'`);
         }
         // Startup hash keys (see parseStartupOptions): `data` wins over the global.
-        // `hide = []`: a browser cache serving an older viewState.js alongside
-        // this file must degrade to showing the panels, not a broken viewer.
+        // The `data` value is validated against this page's origin (see
+        // safeStaticBase) -- the hash is attacker-controllable via a crafted
+        // link. `hide = []`: a browser cache serving an older viewState.js
+        // alongside this file must degrade to showing the panels, not a
+        // broken viewer.
         const { data, ui, play, hide = [] } = parseStartupOptions(location.hash);
-        if (data) simView.staticBase = data;
+        if (data) simView.staticBase = safeStaticBase(data);
         if (!ui) document.body.classList.add("sv-embed");
         simView.autoplay = play;
         // `hide=recording,legend`: same stylesheet mechanism as
@@ -306,6 +309,20 @@ export class SimView {
             console.log("Live stream closed (simulation finished serving).");
             this.liveSocket = null;
             this.hideLiveBadge();
+            // The splash is only removed once a frame arrives (above), so it
+            // still being attached means the connection died before the run
+            // started -- e.g. refused by the server's origin check (a viewer
+            // opened by hostname; see /ws/states). Show why instead of leaving
+            // "Fetching states…" up forever.
+            if (splash && splash.isConnected) {
+                splash.innerHTML =
+                    `<h1 class="sv-splash-error">Couldn't start the live stream</h1>` +
+                    `<p>${escapeHtml(
+                        "The server refused the connection. If the viewer was opened by hostname, " +
+                        "open it by its address instead (e.g. http://10.0.0.5:5420). " +
+                        "See the browser console and the server log for details.",
+                    )}</p>`;
+            }
         };
         socket.onerror = (event) => {
             console.error("Live stream error:", event);
@@ -364,6 +381,9 @@ export class SimView {
             if (this.scalarPlotter) {
                 this.scalarPlotter.onStatesAppended();
             }
+            if (this.terrainProfile) {
+                this.terrainProfile.onStatesAppended();
+            }
             if (wasFollowingLive) {
                 this.animationController.goToTime(this.store.lastTime());
             }

{simview-6.2.3 → simview-6.3.0}/simview/static/js/ui/TerrainProfile.js

@@ -129,6 +129,14 @@ export class TerrainProfile {
         }
     }
 
+    // Called by SimView when live streaming appended states -- the cached
+    // whole-run series is now stale. Mirrors ErrorMetrics.onHistoryReady:
+    // recompute is deferred to the throttled animate() tick (and skipped
+    // entirely while hidden -- setVisible recomputes on open).
+    onStatesAppended() {
+        this.dirty = true;
+    }
+
     // Called by AnalysisPanel when this panel becomes/stops being the visible section.
     setVisible(visible) {
         if (this.isExpanded === visible) return;
@@ -174,8 +182,9 @@ export class TerrainProfile {
 
     // Recomputes the full (whole-timeline) series for the current
     // layer/body/path selection. This is the expensive step (bilinear
-    // sampling every frame x every batch) -- only run on open or on a
-    // control change while open, never per animation frame.
+    // sampling every frame x every batch) -- only run on open, on a control
+    // change while open, or (live mode) on the throttled animate() tick
+    // after new states arrived, never per animation frame.
     _recompute() {
         this.dirty = false;
         const store = this.app.animationController ? this.app.animationController.store : null;
@@ -311,7 +320,8 @@ export class TerrainProfile {
         if (!this.isExpanded) return;
         if (now - this.lastRenderTime < this.minRenderDelay) return;
         this.lastRenderTime = now;
-        this._updateMarker();
+        if (this.dirty) this._recompute();
+        else this._updateMarker();
     }
 
     dispose() {

{simview-6.2.3 → simview-6.3.0}/simview/static/js/utils/viewState.js

@@ -211,3 +211,24 @@ export function parseStartupOptions(hash) {
         hide: (params.get("hide") || "").split(",").filter(Boolean),
     };
 }
+
+// The `data=` startup key, validated: relative URLs (the save_static bundle
+// layout, `#data=./my-scene/`) and absolute URLs on this page's own origin
+// pass; anything cross-origin is ignored with a warning. The hash is
+// attacker-controllable (any crafted link can set it), and without this check
+// such a link would make the viewer fetch and render scene data from an
+// arbitrary server. The `window.__simviewStaticBase` global is set by whoever
+// hosts the page itself, so it stays unrestricted.
+export function safeStaticBase(data) {
+    try {
+        const url = new URL(data, location.href);
+        if (url.origin !== location.origin) {
+            console.warn(`SimView: ignoring cross-origin data= '${data}'`);
+            return null;
+        }
+        return data;
+    } catch {
+        console.warn(`SimView: ignoring invalid data= '${data}'`);
+        return null;
+    }
+}

{simview-6.2.3 → simview-6.3.0}/simview/view.py

@@ -79,11 +79,13 @@ def view_hash(
     `point_clouds`, `track` (a body name, or ``"None"``), `color_map` and
     `speed` are carried as named keys; leaving one ``None`` leaves the
     viewer's current setting alone.
-    `data` (base URL of a static bundle, see `SimulationScene.save_static`),
-    `ui=False` (hide all panels), `play=True` (start playing once loaded) and
-    `hide` (panel names as in `viewerDefaults.panels`, e.g. ``["recording"]``
-    for the REC/format/screenshot controls) are startup options, not view
-    state.
+    `data` (base URL of a static bundle, see `SimulationScene.save_static`;
+    must be same-origin with the viewer page -- cross-origin values are
+    ignored by the viewer, which sets ``window.__simviewStaticBase``
+    instead), `ui=False` (hide all panels), `play=True` (start playing once
+    loaded) and `hide` (panel names as in `viewerDefaults.panels`, e.g.
+    ``["recording"]`` for the REC/format/screenshot controls) are startup
+    options, not view state.
     """
     params = []
     if t is not None:

{simview-6.2.3 → simview-6.3.0/simview.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simview
-Version: 6.2.3
+Version: 6.3.0
 Summary: THREE.js-based simulation visualization tool
 Author-email: Jan Vlk <vlkjan6@fel.cvut.cz>, Ales Kucera <kuceral4@fel.cvut.cz>, David Korcak <david.korcak@gmail.com>
 License-Expression: BSD-3-Clause

{simview-6.2.3 → simview-6.3.0}/tests/test_cli.py

@@ -15,6 +15,7 @@ pytest.importorskip("torch")
 from conftest import build_scene
 
 import simview.__main__ as cli
+from simview.columnar import is_columnar
 
 
 def _fail_if_called(*args, **kwargs):
@@ -185,6 +186,9 @@ def test_save_merged_writes_json_without_starting_server(monkeypatch, tmp_path):
     assert out_path.is_file()
     merged = json.loads(out_path.read_text())
     assert merged["model"]["simBatches"] == 3
+    # Packed like SimulationScene.save, not the fat per-frame layout merge
+    # produces internally.
+    assert is_columnar(merged["states"])
 
 
 def test_save_merged_gzips_when_path_ends_in_gz(monkeypatch, tmp_path):

{simview-6.2.3 → simview-6.3.0}/tests/test_live.py

@@ -23,6 +23,7 @@ pytest.importorskip("torch")
 
 import torch
 from fastapi.testclient import TestClient
+from starlette.websockets import WebSocketDisconnect
 
 from simview.live import LiveViewer
 from simview.scene import BodyShapeType, SimulationScene
@@ -126,7 +127,7 @@ def test_frame_buffer_is_bounded():
         server.push_frame({"time": float(i), "bodies": []})
 
     # Oldest frames are forgotten rather than growing without limit.
-    assert [frame["time"] for frame in server.frame_buffer] == [7.0, 8.0, 9.0]
+    assert [frame["time"] for _, frame in server.frame_buffer] == [7.0, 8.0, 9.0]
 
 
 def test_websocket_receives_frame_pushed_after_connect(live_client):
@@ -144,6 +145,65 @@ def test_websocket_receives_frame_pushed_after_connect(live_client):
         assert message == {"states": [frame], "frameOffset": 0}
 
 
+# --- /ws/states origin check --------------------------------------------------
+#
+# CORS does not apply to WebSockets, so the endpoint checks the browser's
+# Origin header itself (see _ws_origin_allowed in server.py): a site open in
+# the user's browser must not be able to connect and read the live stream.
+# The existing tests above double as the "no Origin header" (non-browser
+# client) case, which stays allowed.
+
+
+def test_websocket_rejects_cross_origin(live_client):
+    _server, client = live_client
+    with pytest.raises(WebSocketDisconnect):
+        with client.websocket_connect(
+            "/ws/states", headers={"origin": "http://evil.example"}
+        ):
+            pass
+
+
+def test_websocket_rejects_same_origin_hostname_host(live_client):
+    # The DNS-rebinding signature: Origin and Host agree, but on a hostname a
+    # browser could have re-resolved to loopback. Only an address (or
+    # 'localhost') is trusted there.
+    _server, client = live_client
+    with pytest.raises(WebSocketDisconnect):
+        with client.websocket_connect(
+            "/ws/states",
+            headers={
+                "origin": "http://evil.example:5420",
+                "host": "evil.example:5420",
+            },
+        ):
+            pass
+
+
+def test_websocket_accepts_localhost_origin(live_client):
+    server, client = live_client
+    server.push_frame({"time": 0.0, "bodies": []})
+
+    with client.websocket_connect(
+        "/ws/states", headers={"origin": "http://localhost:3000"}
+    ) as ws:
+        message = json.loads(ws.receive_text())
+        assert message["states"] == [{"time": 0.0, "bodies": []}]
+
+
+def test_websocket_accepts_same_origin_address_host(live_client):
+    # A page this server served, reached by address over the LAN (Host is an
+    # IP literal matching the Origin) -- same-origin, so allowed.
+    server, client = live_client
+    server.push_frame({"time": 0.0, "bodies": []})
+
+    with client.websocket_connect(
+        "/ws/states",
+        headers={"origin": "http://10.0.0.5:5420", "host": "10.0.0.5:5420"},
+    ) as ws:
+        message = json.loads(ws.receive_text())
+        assert message["states"] == [{"time": 0.0, "bodies": []}]
+
+
 def test_broadcast_drops_dead_connection_without_raising(live_client):
     server, _client = live_client
 

{simview-6.2.3 → simview-6.3.0}/tests/test_server.py

@@ -1,4 +1,5 @@
 import json
+import logging
 import os
 import re
 
@@ -10,7 +11,7 @@ from conftest import build_scene
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
-from simview.server import SimViewServer
+from simview.server import SimViewServer, _warn_public_bind
 
 
 @pytest.fixture
@@ -151,6 +152,47 @@ def test_batch_names_endpoint_rejects_wrong_length(tmp_path):
     assert resp.status_code == 400
 
 
+def test_batch_names_endpoint_rejects_overlong_names(client):
+    # Batch names are persisted to a sidecar next to the scene file; the
+    # per-name cap bounds what a single request can write (see
+    # _MAX_BATCH_NAME_CHARS). The rejection must also leave the served model
+    # untouched.
+    too_long = "x" * 257
+    resp = client.post("/batch-names", json={"names": ["fine", too_long]})
+    assert resp.status_code == 400
+    assert "batchNames" not in client.get("/model").json()
+
+    # Exactly at the cap is fine.
+    resp = client.post("/batch-names", json={"names": ["fine", "x" * 256]})
+    assert resp.status_code == 200
+
+
+def test_oversized_request_body_rejected(client):
+    # Any endpoint, not just /batch-names: the middleware answers 413 off the
+    # Content-Length before anything parses the body.
+    resp = client.post("/batch-names", content=b"x" * (2 << 20))
+    assert resp.status_code == 413
+    # An in-bounds body still reaches the endpoint (here: 422, pydantic).
+    resp = client.post("/batch-names", content=b"{}")
+    assert resp.status_code == 422
+
+
+def test_public_bind_warns_only_off_loopback(caplog):
+    # The server has no authentication, so binding anywhere other machines
+    # can reach must be loud about it; loopback (the default) stays quiet.
+    with caplog.at_level(logging.WARNING, logger="simview.server"):
+        _warn_public_bind("0.0.0.0")
+        _warn_public_bind("hpc-node03")
+    assert caplog.text.count("NO authentication") == 2
+
+    caplog.clear()
+    with caplog.at_level(logging.WARNING, logger="simview.server"):
+        _warn_public_bind("127.0.0.1")
+        _warn_public_bind("localhost")
+        _warn_public_bind("::1")
+    assert "NO authentication" not in caplog.text
+
+
 # --- Gzip support ------------------------------------------------------------
 
 

{simview-6.2.3 → simview-6.3.0}/tests/test_show.py

@@ -8,6 +8,7 @@ httpx), rather than FastAPI's in-process TestClient, since the whole point of
 `show` is that it doesn't block the caller.
 """
 
+import json
 import socket
 
 import httpx
@@ -17,7 +18,9 @@ pytest.importorskip("torch")
 
 from conftest import build_scene
 
+from simview.columnar import is_columnar
 from simview.scene import SimulationScene, ViewerHandle
+from simview.server import SimViewServer
 
 
 def _port_is_free(host: str, port: int) -> bool:
@@ -113,6 +116,23 @@ def test_show_does_not_mutate_the_scene_model():
         assert len(blob_resp.content) == 5 * 3 * 4  # 5 points x 3 floats x 4 bytes
 
 
+def test_preloaded_columnar_states_doc_is_not_mutated(tmp_path):
+    """Serving a preloaded columnar `data=` dict must not rewrite its inline
+    __b64__ state blobs into /blob/ URLs in place -- the states twin of the
+    model regression above (a later save of the same dict would write dead
+    references)."""
+    scene = build_scene(batch_size=1)
+    path = tmp_path / "scene.json"
+    scene.save(path)
+    doc = json.loads(path.read_text())
+    assert is_columnar(doc["states"])
+    states_before = json.dumps(doc["states"])
+
+    SimViewServer(data=doc)
+
+    assert json.dumps(doc["states"]) == states_before
+
+
 def test_concurrent_shows_get_independent_ports():
     scene_a = build_scene(batch_size=1)
     scene_b = build_scene(batch_size=1)