Repository navigation
Configurable CORS origins and /api/2.1, /api/2.0 jobs aliases for browser clients #92
Description
Context
OpenArchFlow, a browser-based architecture tool, wants to run PySpark jobs against minilake through the Databricks-style REST API. Two things block this today:
- CORS is only enabled by
MINILAKE_DEV_CORS=1, which allows all origins. There is no way to allow specific origins. - The jobs API is only registered under
/api/2.2/jobs. Requests to/api/2.1/jobsand/api/2.0/jobshit the catch-all and return 501. Older SDK and CLI versions use these paths.
Scope
- Add
MINILAKE_CORS_ORIGINS, a comma-separated list of allowed origins (*is allowed). When set, enableCORSMiddlewarefor those origins.MINILAKE_DEV_CORS=1keeps working. - Answer preflight requests with
Access-Control-Allow-Private-Network: true, so HTTPS pages can call a local minilake. - Register
/api/2.1/jobsand/api/2.0/jobsas aliases of the existing jobs router. - Set a default for the new variable in
docker-compose.ymland document it indocs/configuration.mdandFEATURES.md.
Acceptance criteria
- A preflight
OPTIONSrequest from an allowed origin returns the CORS headers. A disallowed origin does not. runs/submit,runs/get,run-nowandruns/get-outputrespond under/api/2.0,/api/2.1and/api/2.2.- Tests cover CORS (
tests/test_app.py) and the aliases (tests/test_jobs_submit.py).
Activity