From 4ba265d1d14b347446cffdb8458ca1debabcbfe5 Mon Sep 17 00:00:00 2001 From: Guillaume Mazoyer Date: Mon, 30 Mar 2026 15:07:09 +0200 Subject: [PATCH 1/2] Set `*_content` filter context to `WORKER` The idea is that these filters should *never* be used by the main API server. Making them `LOCAL` too would allow that. So rather than doing this, we prefer making them `WORKER` only and allow any filters to run on workers if the user turns on the proper setting in the API server. --- infrahub_sdk/template/filters.py | 20 ++++---------------- tests/unit/sdk/test_infrahub_filters.py | 15 ++++++--------- 2 files changed, 10 insertions(+), 25 deletions(-) diff --git a/infrahub_sdk/template/filters.py b/infrahub_sdk/template/filters.py index eea02e8e..6c2d5a62 100644 --- a/infrahub_sdk/template/filters.py +++ b/infrahub_sdk/template/filters.py @@ -162,22 +162,10 @@ def trusted(self) -> bool: INFRAHUB_FILTERS = [ - FilterDefinition( - name="artifact_content", allowed_contexts=ExecutionContext.WORKER | ExecutionContext.LOCAL, source="infrahub" - ), - FilterDefinition( - name="file_object_content", allowed_contexts=ExecutionContext.WORKER | ExecutionContext.LOCAL, source="infrahub" - ), - FilterDefinition( - name="file_object_content_by_hfid", - allowed_contexts=ExecutionContext.WORKER | ExecutionContext.LOCAL, - source="infrahub", - ), - FilterDefinition( - name="file_object_content_by_id", - allowed_contexts=ExecutionContext.WORKER | ExecutionContext.LOCAL, - source="infrahub", - ), + FilterDefinition(name="artifact_content", allowed_contexts=ExecutionContext.WORKER, source="infrahub"), + FilterDefinition(name="file_object_content", allowed_contexts=ExecutionContext.WORKER, source="infrahub"), + FilterDefinition(name="file_object_content_by_hfid", allowed_contexts=ExecutionContext.WORKER, source="infrahub"), + FilterDefinition(name="file_object_content_by_id", allowed_contexts=ExecutionContext.WORKER, source="infrahub"), FilterDefinition(name="from_json", allowed_contexts=ExecutionContext.ALL, source="infrahub"), FilterDefinition(name="from_yaml", allowed_contexts=ExecutionContext.ALL, source="infrahub"), ] diff --git a/tests/unit/sdk/test_infrahub_filters.py b/tests/unit/sdk/test_infrahub_filters.py index 43d1bbce..bd13ded5 100644 --- a/tests/unit/sdk/test_infrahub_filters.py +++ b/tests/unit/sdk/test_infrahub_filters.py @@ -62,12 +62,8 @@ def test_not_trusted_when_local_only(self) -> None: fd = FilterDefinition(name="safe", allowed_contexts=ExecutionContext.LOCAL, source="jinja2") assert fd.trusted is False - def test_not_trusted_when_worker_and_local(self) -> None: - fd = FilterDefinition( - name="artifact_content", - allowed_contexts=ExecutionContext.WORKER | ExecutionContext.LOCAL, - source="infrahub", - ) + def test_not_trusted_when_worker_only(self) -> None: + fd = FilterDefinition(name="artifact_content", allowed_contexts=ExecutionContext.WORKER, source="infrahub") assert fd.trusted is False def test_not_trusted_when_core_only(self) -> None: @@ -114,10 +110,11 @@ def test_context_local_allows_local_only_filters(self) -> None: jinja = Jinja2Template(template="{{ data | safe }}") jinja.validate(context=ExecutionContext.LOCAL) - def test_context_local_allows_artifact_content(self) -> None: - """LOCAL context allows artifact_content (WORKER | LOCAL).""" + def test_context_local_blocks_artifact_content(self) -> None: + """LOCAL context blocks artifact_content (WORKER only) — these filters require a worker.""" jinja = Jinja2Template(template="{{ sid | artifact_content }}") - jinja.validate(context=ExecutionContext.LOCAL) + with pytest.raises(JinjaTemplateOperationViolationError): + jinja.validate(context=ExecutionContext.LOCAL) @pytest.mark.parametrize("context", [ExecutionContext.CORE, ExecutionContext.WORKER]) def test_user_filters_always_allowed(self, context: ExecutionContext) -> None: From 64369aa8f735ef2f3abe3860300596632470f249 Mon Sep 17 00:00:00 2001 From: Guillaume Mazoyer Date: Mon, 30 Mar 2026 15:14:19 +0200 Subject: [PATCH 2/2] Update docs --- docs/docs/python-sdk/reference/templating.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/docs/python-sdk/reference/templating.mdx b/docs/docs/python-sdk/reference/templating.mdx index 83014309..d765efb7 100644 --- a/docs/docs/python-sdk/reference/templating.mdx +++ b/docs/docs/python-sdk/reference/templating.mdx @@ -185,10 +185,10 @@ These filters are provided by the Infrahub SDK for artifact and file object cont | Name | CORE | WORKER | LOCAL | | ---- | ---- | ------ | ----- | -| `artifact_content` | ❌ | ✅ | ✅ | -| `file_object_content` | ❌ | ✅ | ✅ | -| `file_object_content_by_hfid` | ❌ | ✅ | ✅ | -| `file_object_content_by_id` | ❌ | ✅ | ✅ | +| `artifact_content` | ❌ | ✅ | ❌ | +| `file_object_content` | ❌ | ✅ | ❌ | +| `file_object_content_by_hfid` | ❌ | ✅ | ❌ | +| `file_object_content_by_id` | ❌ | ✅ | ❌ | | `from_json` | ✅ | ✅ | ✅ | | `from_yaml` | ✅ | ✅ | ✅ |