Repository navigation
feat: configurable CORS origins and /api/2.0, /api/2.1 jobs aliases - #93
Merged
Merged
Conversation
Add MINILAKE_CORS_ORIGINS allowlist (with Private Network Access preflight support) so external browser apps can call the API, and serve the Jobs API under /api/2.0 and /api/2.1 as aliases of /api/2.2. Refs #92
…vate network support pydantic-settings decoded the list-typed field as JSON, so a comma-separated value stopped startup. Keep the raw string and expose cors_origin_list. Use CORSMiddleware(allow_private_network=True) when Starlette supports it, with the custom middleware as a fallback for older versions. Refs #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MINILAKE_CORS_ORIGINS, a comma-separated allowlist of browser origins (*allowed) that may call the API cross-origin.MINILAKE_DEV_CORS=1keeps working.Access-Control-Allow-Private-Network), using Starlette's nativeallow_private_networkwhen available and a small middleware fallback otherwise./api/2.0/jobsand/api/2.1/jobsas aliases of/api/2.2/jobs.docker-compose.ymland document it indocs/configuration.mdandFEATURES.md.This lets OpenArchFlow's Databricks Studio call minilake directly from the browser (see dmux/OpenArchFlow#57).
Notes
Settingsis a pydantic-settings model, which parses list-typed fields from the environment as JSON. The value is therefore stored as a string and exposed throughcors_origin_list; a regression test covers this.Test plan
pytest tests/test_app.py(13 passed): allowed and disallowed origins, CORS off by default, Private Network Access preflight, alias middleware, env parsing.workspace/mkdirs,workspace/import,runs/submit,runs/get,runs/list(via/api/2.1) andruns/get-outputend to end, with the subprocess executor.scripts/run-tests-docker.sh(needs the Docker socket).Closes #92