ClaudeandClaude Fable 5
6d7387b022
Part 1 — fetch_url validation simplification
Now that Connection.allowed_url_hosts exists, it's the ONLY check.
The old 2-label suffix-overlap rule against yarn_rm_url is gone.
- Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
(was list[str] | None = None). Default empty list means the
connection has no fetch access; the user must explicitly opt in
via save_connection or update_connection.
- _validate_url_host drops the yarn_rm_url parameter and the
_host_suffix_overlap helper. Now: scheme/host/IP checks, then
empty-reject, then glob match. Reject everything else.
- fetch_url's error message now points the user at
Connection.allowed_url_hosts as the fix.
- The label-by-label glob check from the previous commit is kept
(SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').
Part 2 — update_connection tool
PATCH-style update for an existing Connection record. Only the
fields the caller provides are changed. Same pattern as
update_pending_job: req.model_dump(exclude_none=True), with
'name' popped before passing to the store.
To CLEAR a field (e.g. drop auth_password), use delete_connection
+ save_connection. This is YAGNI; the alternative (model_fields_set
to distinguish 'omitted' from 'null') adds surface for bugs.
- ConnectionStore.update(name, **fields): get, model_copy(update=...),
save. Lock + atomic write. Re-validates the patched record.
- update_connection tool function: passes fields through to the
store, logs which fields were changed.
- UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
- /update_connection route with operation_id='update_connection'.
- 9 new unit tests in test_connection_tools.py (PATCH, dict/list
replace-not-merge, unknown name 404, validation of patched record,
disk persistence).
- test_fetch_url.py: existing 21 tests updated; 3 new tests for
the empty/None/missing allowed_url_hosts cases.
- test_mcp_routes.py: assert 22 tool routes.
- README: update_connection row added; fetch_url row updated.
Tests: 386 passed (up from 377, +9 net).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
84 lines
2.7 KiB
Python
84 lines
2.7 KiB
Python
# coding=utf-8
|
|
"""
|
|
@Time :2026/6/24
|
|
@Author :tao.chen
|
|
"""
|
|
from common.logging import logger
|
|
from spark_executor.core.connection_store import ConnectionStore, store
|
|
from spark_executor.models import Connection
|
|
|
|
|
|
def save_connection(
|
|
*,
|
|
name: str,
|
|
master: str,
|
|
deploy_mode: str = "cluster",
|
|
yarn_rm_url: str | None = None,
|
|
spark_conf: dict[str, str] | None = None,
|
|
ssl_verify: bool | None = None,
|
|
ssl_ca_bundle: str | None = None,
|
|
auth_type: str = "none",
|
|
auth_user: str | None = None,
|
|
auth_password: str | None = None,
|
|
auth_principal: str | None = None,
|
|
auth_keytab: str | None = None,
|
|
allowed_url_hosts: list[str] | None = None,
|
|
) -> dict[str, str]:
|
|
logger.debug(
|
|
f"save_connection enter name={name} master={master} deploy_mode={deploy_mode} "
|
|
f"yarn_rm_url={yarn_rm_url} spark_conf_keys={list((spark_conf or {}).keys())}"
|
|
)
|
|
conn = Connection(
|
|
name=name,
|
|
master=master,
|
|
deploy_mode=deploy_mode,
|
|
yarn_rm_url=yarn_rm_url,
|
|
spark_conf=spark_conf or {},
|
|
ssl_verify=ssl_verify,
|
|
ssl_ca_bundle=ssl_ca_bundle,
|
|
auth_type=auth_type,
|
|
auth_user=auth_user,
|
|
auth_password=auth_password,
|
|
auth_principal=auth_principal,
|
|
auth_keytab=auth_keytab,
|
|
allowed_url_hosts=allowed_url_hosts or [],
|
|
)
|
|
store.save(conn)
|
|
return {"name": name, "status": "SAVED"}
|
|
|
|
|
|
def update_connection(name: str, **fields) -> dict[str, object]:
|
|
"""Update an existing Connection's mutable fields.
|
|
|
|
`name` is the identifier (immutable). PATCH semantics: only the fields
|
|
you pass are changed. To clear an optional field (e.g. `yarn_rm_url`),
|
|
use `delete_connection(name=...)` followed by `save_connection(...)`.
|
|
|
|
Mutable fields: master, deploy_mode, yarn_rm_url, spark_conf,
|
|
ssl_verify, ssl_ca_bundle, auth_type, auth_user, auth_password,
|
|
auth_principal, auth_keytab, allowed_url_hosts.
|
|
"""
|
|
logger.debug(f"update_connection enter name={name} fields={sorted(fields.keys())}")
|
|
return store.update(name, **fields).model_dump()
|
|
|
|
|
|
def list_connections() -> list[dict[str, object]]:
|
|
logger.debug("list_connections enter")
|
|
return [c.model_dump() for c in store.list_all()]
|
|
|
|
|
|
def get_connection(name: str) -> dict[str, object]:
|
|
logger.debug(f"get_connection enter name={name}")
|
|
conn = store.get(name)
|
|
if conn is None:
|
|
raise KeyError(f"Unknown connection: {name}")
|
|
return conn.model_dump()
|
|
|
|
|
|
def delete_connection(name: str) -> dict[str, str]:
|
|
logger.debug(f"delete_connection enter name={name}")
|
|
removed = store.delete(name)
|
|
if not removed:
|
|
raise KeyError(f"Unknown connection: {name}")
|
|
return {"name": name, "status": "DELETED"}
|