vantage6-algorithm-store 5.0.3rc6__tar.gz → 5.1.0__tar.gz

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.5
 Name: vantage6-algorithm-store
-Version: 5.0.3rc6
+Version: 5.1.0
 Summary: Vantage6 algorithm store
 Author: Vantage6 Team
 Maintainer-email: Frank Martin <f.martin@iknl.nl>, Bart van Beusekom <b.vanbeusekom@iknl.nl>
-License: MIT
+License: Apache-2.0
 Requires-Python: >=3.13
 Requires-Dist: flask-jwt-extended==4.7.1
 Requires-Dist: flask-principal==0.4.0
@@ -18,12 +18,8 @@ Requires-Dist: python-keycloak==5.5.0
 Requires-Dist: requests==2.33.1
 Requires-Dist: schema==0.7.5
 Requires-Dist: sqlalchemy==2.0.37
-Requires-Dist: vantage6-common==5.0.3rc6
-Requires-Dist: vantage6==5.0.3rc6
-Provides-Extra: dev
-Requires-Dist: black; extra == 'dev'
-Requires-Dist: coverage==7.10.2; extra == 'dev'
-Requires-Dist: pre-commit; extra == 'dev'
+Requires-Dist: vantage6-common==5.1.0
+Requires-Dist: vantage6==5.1.0
 Description-Content-Type: text/markdown
 
 <h1 align="center">

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vantage6-algorithm-store"
-version = "5.0.3rc6"
+version = "5.1.0"
 description = "Vantage6 algorithm store"
 readme = "README.md"
-license = {text = "MIT"}
+license = {text = "Apache-2.0"}
 authors = [
     {name = "Vantage6 Team"}
 ]
@@ -30,15 +30,8 @@ dependencies = [
     "requests==2.33.1",
     "schema==0.7.5",
     "sqlalchemy==2.0.37",
-    "vantage6-common==5.0.3rc6",
-    "vantage6==5.0.3rc6",
-]
-
-[project.optional-dependencies]
-dev = [
-    "coverage==7.10.2",
-    "black",
-    "pre-commit",
+    "vantage6-common==5.1.0",
+    "vantage6==5.1.0",
 ]
 
 [tool.hatch.build.targets.wheel]

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/tests_store/base/unittest_base.py

@@ -9,7 +9,7 @@ from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 
-from vantage6.common.globals import InstanceType
+from vantage6.common.globals import STORE_TOKEN_AUDIENCE, InstanceType
 
 from vantage6.backend.common import test_context
 
@@ -53,8 +53,6 @@ class TestResources(unittest.TestCase):
         # set required environment variables *before* creating the app
         os.environ["KEYCLOAK_URL"] = "dummy-keycloak-url"
         os.environ["KEYCLOAK_REALM"] = "dummy-keycloak-realm"
-        os.environ["KEYCLOAK_ADMIN_USERNAME"] = "dummy-keycloak-admin-username"
-        os.environ["KEYCLOAK_ADMIN_PASSWORD"] = "dummy-keycloak-admin-password"
         os.environ["KEYCLOAK_ADMIN_CLIENT"] = "dummy-keycloak-admin-client"
         os.environ["KEYCLOAK_ADMIN_CLIENT_SECRET"] = (
             "dummy-keycloak-admin-client-secret"
@@ -150,12 +148,21 @@ class TestResources(unittest.TestCase):
             )
             new_role.save()
 
-    def login_node(self) -> dict:
+    def login_node(
+        self, client_type: str = "node", audience: str = STORE_TOKEN_AUDIENCE
+    ) -> dict:
         """
         Build headers with a real node JWT (mirrors vantage6-hq's `login_node` test
         helper), for testing endpoints that recognize nodes via the
         `vantage6_client_type` claim rather than a registered store `User`.
 
+        Parameters
+        ----------
+        client_type : str
+            Value of the `vantage6_client_type` claim, e.g. "node" or "hq"
+        audience : str
+            Audience of the token
+
         Returns
         -------
         dict
@@ -163,7 +170,8 @@ class TestResources(unittest.TestCase):
         """
         mock_claims = {
             "sub": str(uuid1()),
-            "vantage6_client_type": "node",
+            "vantage6_client_type": client_type,
+            "aud": audience,
             "exp": 9999999999,
             "iat": 0,
         }

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/tests_store/resources/test_algorithm.py

@@ -174,6 +174,68 @@ class TestAlgorithmResources(TestResources):
         # cleanup
         policy.delete()
 
+    def test_view_algorithm_decorator_hq(self):
+        """
+        Test that HQ's own token may list approved algorithms, like a node, but no
+        non-approved algorithms and nothing that requires a store user.
+        """
+        policy = Policy(
+            key=StorePolicies.ALGORITHM_VIEW.value,
+            value=AlgorithmViewPolicies.ONLY_WITH_EXPLICIT_PERMISSION.value,
+        )
+        policy.save()
+        algorithm = Algorithm(
+            name="test_algorithm", status=AlgorithmStatus.APPROVED.value
+        )
+        algorithm.save()
+        hq_headers = self.login_node(client_type="hq")
+
+        rv = self.app.get("/api/algorithm", headers=hq_headers)
+        self.assertEqual(rv.status_code, HTTPStatus.OK)
+
+        rv = self.app.get("/api/algorithm?under_review=1", headers=hq_headers)
+        self.assertEqual(rv.status_code, HTTPStatus.UNAUTHORIZED)
+        rv = self.app.get(f"/api/algorithm/{algorithm.id}", headers=hq_headers)
+        self.assertEqual(rv.status_code, HTTPStatus.UNAUTHORIZED)
+        rv = self.app.get("/api/user", headers=hq_headers)
+        self.assertEqual(rv.status_code, HTTPStatus.UNAUTHORIZED)
+
+        # cleanup
+        algorithm.delete()
+        policy.delete()
+
+    def test_tokens_for_hq_refused(self):
+        """
+        Test that the store refuses tokens issued for HQ, so clients cannot send
+        their HQ token to a store.
+        """
+        policy = Policy(
+            key=StorePolicies.ALGORITHM_VIEW.value,
+            value=AlgorithmViewPolicies.ONLY_WITH_EXPLICIT_PERMISSION.value,
+        )
+        policy.save()
+
+        for client_type in ["node", "hq"]:
+            headers = self.login_node(client_type=client_type, audience="vantage6-hq")
+            rv = self.app.get("/api/algorithm", headers=headers)
+            self.assertEqual(rv.status_code, HTTPStatus.UNAUTHORIZED)
+
+        # cleanup
+        policy.delete()
+
+    def test_tokens_for_hq_and_stores_refused(self):
+        """
+        Test that the store refuses tokens that are also valid at HQ, such as the
+        token of a login that asks for both audiences.
+        """
+        headers = self.login_node(audience="vantage6-store")
+        rv = self.app.get("/api/algorithm", headers=headers)
+        self.assertEqual(rv.status_code, HTTPStatus.OK)
+
+        headers = self.login_node(audience=["vantage6-store", "vantage6-hq"])
+        rv = self.app.get("/api/algorithm", headers=headers)
+        self.assertEqual(rv.status_code, HTTPStatus.UNAUTHORIZED)
+
     def test_view_algorithm_single_not_affected_by_node_bypass(self):
         """
         Test that the node bypass on the algorithm list endpoint does not extend to

vantage6_algorithm_store-5.1.0/tests_store/test_db_session_release.py

@@ -0,0 +1,99 @@
+"""
+Tests that the outside-Flask database session is released.
+
+Covers two things:
+
+- ``DatabaseSessionManager.session_scope`` clears the session both when its body
+  exits normally and when the body raises.
+- Constructing an ``AlgorithmStoreApp`` leaves no session behind. Startup loads
+  the permission rules and syncs the policies outside a Flask request, so the
+  request hooks that normally clear the session never fire; a session left here
+  keeps its pooled connection in an open transaction for the lifetime of the
+  process.
+"""
+
+import os
+from unittest import TestCase
+from unittest.mock import patch
+
+from vantage6.common.globals import InstanceType
+
+from vantage6.backend.common import session as session_module, test_context
+
+from tests_store.base.unittest_base import MOCK_PUBLIC_KEY_PEM
+from vantage6.algorithm.store import AlgorithmStoreApp
+from vantage6.algorithm.store.globals import PACKAGE_FOLDER
+from vantage6.algorithm.store.model.base import Database, DatabaseSessionManager
+
+
+class TestSessionScope(TestCase):
+    @classmethod
+    def setUpClass(cls):
+        Database().connect("sqlite://", allow_drop_all=True)
+
+    @classmethod
+    def tearDownClass(cls):
+        Database().clear_data()
+        Database().close()
+
+    def tearDown(self):
+        # make sure a failing test does not leak a session into the next one
+        DatabaseSessionManager.clear_session()
+
+    def test_session_released_on_normal_exit(self):
+        """The outside-Flask session is cleared when the scope exits normally."""
+        with DatabaseSessionManager.session_scope() as scoped_session:
+            self.assertIsNotNone(scoped_session)
+            self.assertIsNotNone(session_module.session)
+        self.assertIsNone(session_module.session)
+
+    def test_session_released_when_body_raises(self):
+        """The session is cleared even when the body raises - the actual bug."""
+        with self.assertRaises(RuntimeError), DatabaseSessionManager.session_scope():
+            self.assertIsNotNone(session_module.session)
+            raise RuntimeError("work blew up mid-scope")
+        self.assertIsNone(session_module.session)
+
+
+class TestStartupReleasesSession(TestCase):
+    """
+    Building the app must not leave a session (and connection) checked out.
+
+    Startup loads the permission rules and syncs the policies against the
+    database, all outside a Flask request.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        Database().connect("sqlite://", allow_drop_all=True)
+
+    @classmethod
+    def tearDownClass(cls):
+        Database().clear_data()
+        Database().close()
+
+    def test_no_session_left_after_app_construction(self):
+        ctx = test_context.TestContext.from_external_config_file(
+            PACKAGE_FOLDER, InstanceType.ALGORITHM_STORE
+        )
+
+        # set required environment variables *before* creating the app
+        os.environ["KEYCLOAK_URL"] = "dummy-keycloak-url"
+        os.environ["KEYCLOAK_REALM"] = "dummy-keycloak-realm"
+        os.environ["KEYCLOAK_ADMIN_USERNAME"] = "dummy-keycloak-admin-username"
+        os.environ["KEYCLOAK_ADMIN_PASSWORD"] = "dummy-keycloak-admin-password"
+        os.environ["KEYCLOAK_ADMIN_CLIENT"] = "dummy-keycloak-admin-client"
+        os.environ["KEYCLOAK_ADMIN_CLIENT_SECRET"] = (
+            "dummy-keycloak-admin-client-secret"
+        )
+
+        DatabaseSessionManager.clear_session()
+        self.assertIsNone(session_module.session)
+
+        with patch(
+            "vantage6.algorithm.store.AlgorithmStoreApp._get_keycloak_public_key"
+        ) as mock_get_key:
+            mock_get_key.return_value = MOCK_PUBLIC_KEY_PEM.decode()
+            AlgorithmStoreApp(ctx)
+
+        self.assertIsNone(session_module.session)

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/vantage6/algorithm/store/__init__.py

@@ -27,7 +27,7 @@ from flask_principal import Identity, identity_changed
 from vantage6.common import logger_name
 from vantage6.common.enum import StorePolicies
 from vantage6.common.exceptions import AuthenticationException
-from vantage6.common.globals import DEFAULT_API_PATH
+from vantage6.common.globals import DEFAULT_API_PATH, STORE_TOKEN_AUDIENCE
 
 from vantage6.cli.context.algorithm_store import AlgorithmStoreContext
 
@@ -75,17 +75,18 @@ class AlgorithmStoreApp(Vantage6App):
             static_folder=Path(__file__).parent / "static",
         )
 
-        # setup the permission manager for the API endpoints
-        self.permissions = PermissionManager(RESOURCES_PATH, RESOURCES, DefaultRole)
+        with DatabaseSessionManager.session_scope():
+            # setup the permission manager for the API endpoints
+            self.permissions = PermissionManager(RESOURCES_PATH, RESOURCES, DefaultRole)
 
-        # Load API resources
-        self.load_resources()
+            # Load API resources
+            self.load_resources()
 
-        # sync policies with the database
-        self.setup_policies(self.ctx.config)
+            # sync policies with the database
+            self.setup_policies(self.ctx.config)
 
-        if self.ctx.config.get("dev", {}).get("disable_review", False):
-            self.setup_disable_review()
+            if self.ctx.config.get("dev", {}).get("disable_review", False):
+                self.setup_disable_review()
 
         log.info("Initialization done")
 
@@ -93,6 +94,10 @@ class AlgorithmStoreApp(Vantage6App):
         """Configure the Flask settings of the vantage6 algorithm store."""
         self._configure_flask_base(DatabaseSessionManager)
 
+        # only accept Keycloak tokens issued for algorithm stores. Tokens for HQ are
+        # refused, so clients never have a reason to send them here.
+        self.app.config["JWT_DECODE_AUDIENCE"] = STORE_TOKEN_AUDIENCE
+
     def configure_api(self) -> None:
         """Define global API output and its structure."""
         self._configure_api_base(BaseHATEOASModelSchema, Base)
@@ -115,17 +120,18 @@ class AlgorithmStoreApp(Vantage6App):
             Returns
             -------
             db.User | str:
-                The user identity, or the keycloak id if it is a node that is
+                The user identity, or the keycloak id if a node or HQ is
                 authenticating.
 
             Raises
             ------
             AuthenticationException
-                If no store `User` is registered for this (non-node) identity.
+                If no store `User` is registered for this (non-node, non-HQ)
+                identity.
             """
             identity = jwt_headers["sub"]
 
-            if jwt_headers.get("vantage6_client_type") == "node":
+            if jwt_headers.get("vantage6_client_type") in ("node", "hq"):
                 return identity
 
             auth_identity = Identity(identity)
@@ -328,5 +334,10 @@ def run_store(config: str, system_folders: bool = True) -> AlgorithmStoreApp:
     ctx = AlgorithmStoreContext.from_external_config_file(
         config, system_folders, in_container=True
     )
-    Database().connect(uri=ctx.get_database_uri(), allow_drop_all=False)
+    Database().connect(
+        uri=ctx.get_database_uri(),
+        allow_drop_all=False,
+        pool_size=ctx.config.get("database_pool_size"),
+        max_overflow=ctx.config.get("database_max_overflow"),
+    )
     return AlgorithmStoreApp(ctx)

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/vantage6/algorithm/store/model/base.py

@@ -52,7 +52,13 @@ class Database(BaseDatabase, metaclass=Singleton):
         """
         self._close(Base)
 
-    def connect(self, uri="sqlite:////tmp/test.db", allow_drop_all=False):
+    def connect(
+        self,
+        uri="sqlite:////tmp/test.db",
+        allow_drop_all=False,
+        pool_size: int | None = None,
+        max_overflow: int | None = None,
+    ):
         """
         Connect to the database.
 
@@ -62,8 +68,20 @@ class Database(BaseDatabase, metaclass=Singleton):
             URI of the database. Defaults to a sqlite database in /tmp.
         allow_drop_all : bool, optional
             If True, the database can be dropped. Defaults to False.
-        """
-        self._connect(Base, uri, allow_drop_all)
+        pool_size : int, optional
+            Number of persistent connections in the SQLAlchemy connection pool.
+            When None (default), SQLAlchemy's default is used. Ignored for SQLite.
+        max_overflow : int, optional
+            Number of extra connections allowed on top of ``pool_size``. When None
+            (default), SQLAlchemy's default is used. Ignored for SQLite.
+        """
+        self._connect(
+            Base,
+            uri,
+            allow_drop_all,
+            pool_size=pool_size,
+            max_overflow=max_overflow,
+        )
 
 
 class DatabaseSessionManager(BaseDatabaseSessionManager):
@@ -101,6 +119,22 @@ class DatabaseSessionManager(BaseDatabaseSessionManager):
         """
         BaseDatabaseSessionManager._new_session(DatabaseSessionManager, Database)
 
+    @staticmethod
+    def session_scope():
+        """
+        Context manager that yields a session and always releases it.
+
+        Use this for database work that runs outside the Flask request
+        lifecycle (e.g. application startup), where the request hooks that
+        normally clear the session do not fire.
+
+        Returns
+        -------
+        contextmanager
+            A context manager yielding a database session
+        """
+        return BaseDatabaseSessionManager._session_scope(DatabaseSessionManager)
+
 
 class ModelBase(BaseModelBase):
     """

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/vantage6/algorithm/store/resource/__init__.py

@@ -105,24 +105,25 @@ def _authorize_user(
     return None, None
 
 
-def _is_node_request() -> bool:
+def _get_request_client_type() -> str | None:
     """
-    Check whether the current request carries a valid node JWT.
+    Get the `vantage6_client_type` of the valid JWT of the current request, e.g.
+    "node" or "hq".
 
-    Nodes are never registered as a store `User` - unlike `_authenticate`, this does
-    not do a database lookup. It only relies on the `vantage6_client_type` claim set
-    by the shared vantage6 Keycloak realm.
+    Nodes and HQ are never registered as a store `User` - unlike `_authenticate`, this
+    does not do a database lookup. It only relies on the `vantage6_client_type` claim
+    set by the shared vantage6 Keycloak realm.
 
     Note that this function does not raise if no token is present at all, so it is safe
     to call unconditionally before any policy-based access checks.
 
     Returns
     -------
-    bool
-        Whether the request is authenticated as a node.
+    str | None
+        The client type, or None if the request has no token or no client type.
     """
     verify_jwt_in_request(optional=True)
-    return get_jwt().get("vantage6_client_type") == "node"
+    return get_jwt().get("vantage6_client_type")
 
 
 def with_authentication() -> Callable:
@@ -189,20 +190,27 @@ def with_permission(resource: str, operation: Operation) -> Callable:
     return protection_decorator
 
 
-def with_permission_to_view_algorithms(allow_node: bool = False) -> Callable:
+def with_permission_to_view_algorithms(
+    allow_node: bool = False, allow_hq: bool = False
+) -> Callable:
     """
     Decorator to verify that the user has as a permission on a resource.
 
     Parameters
     ----------
     allow_node : bool, optional
-        If True, also allow requests authenticated as a node (see `_is_node_request`)
-        to view approved algorithms, regardless of the store's `algorithm_view` policy.
-        This lets nodes independently re-verify - for their own
-        `allowed_algorithm_stores` policy - that an image is a registered, approved
-        algorithm in this store, without requiring the node to be registered as a
-        store `User`. Node access is still restricted to approved algorithms only.
+        If True, also allow requests authenticated as a node (see
+        `_get_request_client_type`) to view approved algorithms, regardless of the
+        store's `algorithm_view` policy. This lets nodes independently re-verify - for
+        their own `allowed_algorithm_stores` policy - that an image is a registered,
+        approved algorithm in this store, without requiring the node to be registered
+        as a store `User`. Access is still restricted to approved algorithms only.
         Default is False.
+    allow_hq : bool, optional
+        If True, also allow requests authenticated as HQ to view approved algorithms,
+        regardless of the store's `algorithm_view` policy. This lets HQ look up the
+        algorithm of a new task. Access is still restricted to approved algorithms
+        only. Default is False.
 
     Returns
     -------
@@ -211,6 +219,12 @@ def with_permission_to_view_algorithms(allow_node: bool = False) -> Callable:
         authentication.
     """
 
+    allowed_client_types = {
+        client_type
+        for client_type, allowed in (("node", allow_node), ("hq", allow_hq))
+        if allowed
+    }
+
     def protection_decorator(fn):
         @wraps(fn)
         def decorator(self, *args, **kwargs):
@@ -225,11 +239,14 @@ def with_permission_to_view_algorithms(allow_node: bool = False) -> Callable:
                 or request_args.get("invalidated")
             )
 
-            # nodes re-verifying an image against this store's catalog are always
-            # allowed to see approved algorithms, independent of the store's
+            # nodes re-verifying an image and HQ looking up a task's algorithm are
+            # always allowed to see approved algorithms, independent of the store's
             # algorithm_view policy - they are never allowed to see non-approved ones
-            if allow_node and request_approved and _is_node_request():
-                g.node = True
+            if (
+                allowed_client_types
+                and request_approved
+                and _get_request_client_type() in allowed_client_types
+            ):
                 return fn(self, *args, **kwargs)
 
             policies = Policy.get_as_dict()

{vantage6_algorithm_store-5.0.3rc6 → vantage6_algorithm_store-5.1.0}/vantage6/algorithm/store/resource/algorithm.py

@@ -148,7 +148,7 @@ class AlgorithmBaseResource(AlgorithmStoreResources):
 class Algorithms(AlgorithmBaseResource):
     """Resource for /algorithm"""
 
-    @with_permission_to_view_algorithms(allow_node=True)
+    @with_permission_to_view_algorithms(allow_node=True, allow_hq=True)
     def get(self):
         """List algorithms
         ---
@@ -159,11 +159,11 @@ class Algorithms(AlgorithmBaseResource):
           algorithms, set the 'awaiting_reviewer_assignment', 'under_review' or
           'invalidated' parameter to True.
 
-          Nodes are always allowed to list approved algorithms (e.g. filtered by
-          'image'), regardless of this store's algorithm_view policy - this lets a node
-          independently verify that an image is a registered, approved algorithm for
-          its own allowed_algorithm_stores policy. Nodes cannot use the non-approved
-          filters.
+          Nodes and HQ are always allowed to list approved algorithms (e.g. filtered
+          by 'image'), regardless of this store's algorithm_view policy - this lets a
+          node independently verify that an image is a registered, approved algorithm
+          for its own allowed_algorithm_stores policy, and lets HQ look up the
+          algorithm of a new task. They cannot use the non-approved filters.
 
         parameters:
           - in: query