Merge branch 'master' into 789-capture-wave-metrics-by-container-arch…

…itecture

VERSION

@@ -1 +1 @@
-1.18.0
+1.18.1

build.gradle

@@ -88,7 +88,7 @@ dependencies {
     testImplementation 'org.testcontainers:mysql:1.17.3'
 
     // --
-    implementation 'ch.qos.logback:logback-classic:1.5.13'
+    implementation 'ch.qos.logback:logback-classic:1.5.16'
 
     // rate limit
     implementation 'com.coveo:spillway:3.0.0'

changelog.txt

@@ -1,4 +1,10 @@
 # Wave changelog
+1.18.1 - 21 Feb 2025
+- Add denyHosts to pairing websocket [f5369eed]
+- Use virtual threads for build, scan and mirror jobs (#742) [9dfce1f7]
+- removed metrics from open-api (#798) [740831aa]
+- Bump ch.qos.logback:logback-classic 1.5.16 (#799) [7bf703d6]
+
 1.18.0 - 18 Feb 2025
 - Add Scan image request (#796) [a950d1cf]
 - Improve caching for AWS ECR and Auth lookup (#783) [b1a76d15]

src/main/groovy/io/seqera/wave/service/builder/impl/BuildStateStoreImpl.groovy

@@ -50,7 +50,7 @@ class BuildStateStoreImpl extends AbstractStateStore<BuildEntry> implements Buil
 
     private ExecutorService ioExecutor
 
-    BuildStateStoreImpl(StateProvider<String, String> provider, BuildConfig buildConfig, @Named(TaskExecutors.IO) ExecutorService ioExecutor) {
+    BuildStateStoreImpl(StateProvider<String, String> provider, BuildConfig buildConfig, @Named(TaskExecutors.BLOCKING) ExecutorService ioExecutor) {
         super(provider, new MoshiEncodeStrategy<BuildEntry>() {})
         this.buildConfig = buildConfig
         this.ioExecutor = ioExecutor

src/main/groovy/io/seqera/wave/service/builder/impl/ContainerBuildServiceImpl.groovy

@@ -87,7 +87,7 @@ class ContainerBuildServiceImpl implements ContainerBuildService, JobHandler<Bui
     private BuildStateStore buildStore
 
     @Inject
-    @Named(TaskExecutors.IO)
+    @Named(TaskExecutors.BLOCKING)
     private ExecutorService executor
 
     @Inject

src/main/groovy/io/seqera/wave/service/logs/BuildLogServiceImpl.groovy

@@ -79,7 +79,7 @@ class BuildLogServiceImpl implements BuildLogService {
     private String condaLockPrefix
 
     @Inject
-    @Named(TaskExecutors.IO)
+    @Named(TaskExecutors.BLOCKING)
     private ExecutorService ioExecutor
 
     @PostConstruct

src/main/groovy/io/seqera/wave/service/mirror/ContainerMirrorServiceImpl.groovy

@@ -54,7 +54,7 @@ class ContainerMirrorServiceImpl implements ContainerMirrorService, JobHandler<M
     private JobService jobService
 
     @Inject
-    @Named(TaskExecutors.IO)
+    @Named(TaskExecutors.BLOCKING)
     private ExecutorService ioExecutor
 
     @Inject

src/main/groovy/io/seqera/wave/service/pairing/socket/PairingWebSocket.groovy

@@ -66,10 +66,20 @@ class PairingWebSocket {
     @Value('${wave.closeSessionOnInvalidLicenseToken:false}')
     private boolean closeSessionOnInvalidLicenseToken
 
+    @Nullable
+    @Value('${wave.denyHosts}')
+    private List<String> denyHosts
+
     @OnOpen
     void onOpen(String service, String token, String endpoint, WebSocketSession session) {
         log.debug "Opening pairing session - endpoint: ${endpoint} [sessionId: $session.id]"
 
+        if( isDenyHost(endpoint) ) {
+            log.warn "Pairing not allowed for endpoint: ${endpoint}"
+            session.close(CloseReason.POLICY_VIOLATION)
+            return
+        }
+
         // check for a valid connection token
         if( licenseManager && !isLicenseTokenValid(token, endpoint) && closeSessionOnInvalidLicenseToken ) {
             session.close(CloseReason.POLICY_VIOLATION)
@@ -150,4 +160,11 @@ class PairingWebSocket {
         return true
     }
 
+    protected boolean isDenyHost(String endpoint) {
+        for( String it : (denyHosts ?: List.of()) ) {
+            if( endpoint.contains(it) )
+                return true
+        }
+        return false
+    }
 }

src/main/groovy/io/seqera/wave/service/scan/ContainerScanServiceImpl.groovy

@@ -64,7 +64,7 @@ class ContainerScanServiceImpl implements ContainerScanService, JobHandler<ScanE
     private ScanConfig config
 
     @Inject
-    @Named(TaskExecutors.IO)
+    @Named(TaskExecutors.BLOCKING)
     private ExecutorService executor
 
     @Inject

src/main/resources/logback.xml

@@ -43,7 +43,7 @@
             <totalSizeCap>200MB</totalSizeCap>
         </rollingPolicy>
         <encoder>
-            <pattern>%d{MMM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n >> wt=%X{requestId}%n</pattern>
+            <pattern>%d{MMM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n</pattern>
         </encoder>
     </appender>
 

src/test/groovy/io/seqera/wave/service/builder/BuildStoreLocalTest.groovy

@@ -46,7 +46,7 @@ class BuildStoreLocalTest extends Specification {
     private BuildConfig buildConfig
 
     @Inject
-    @Named(TaskExecutors.IO)
+    @Named(TaskExecutors.BLOCKING)
     ExecutorService ioExecutor
 
     BuildResult zeroResult = BuildResult.create('0')

src/test/groovy/io/seqera/wave/service/pairing/PairingWebSocketTest.groovy

@@ -0,0 +1,62 @@
+/*
+ *  Wave, containers provisioning service
+ *  Copyright (c) 2023-2024, Seqera Labs
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package io.seqera.wave.service.pairing
+
+import spock.lang.Specification
+
+import io.micronaut.context.ApplicationContext
+import io.micronaut.test.extensions.spock.annotation.MicronautTest
+import io.seqera.wave.service.pairing.socket.PairingWebSocket
+
+/**
+ *
+ * @author Paolo Di Tommaso <paolo.ditommaso@gmail.com>
+ */
+@MicronautTest
+class PairingWebSocketTest extends Specification {
+
+    def 'should allow any host' () {
+        given:
+        def ctx = ApplicationContext.run()
+        def pairing = ctx.getBean(PairingWebSocket)
+
+        expect:
+        !pairing.isDenyHost('foo')
+        !pairing.isDenyHost('seqera.io')
+        !pairing.isDenyHost('ngrok')
+
+        cleanup:
+        ctx.close()
+    }
+
+    def 'should disallowed deny hosts' () {
+        given:
+        def ctx = ApplicationContext.run(['wave.denyHosts': ['ngrok','hctal']])
+        def pairing = ctx.getBean(PairingWebSocket)
+
+        expect:
+        pairing.isDenyHost('ngrok')
+        pairing.isDenyHost('hctal')
+        and:
+        !pairing.isDenyHost('seqera.io')
+
+        cleanup:
+        ctx.close()
+    }
+}

typespec/models/models.tsp

@@ -3,7 +3,6 @@ import "./ContainerResponse.tsp";
 import "./BuildStatusResponse.tsp";
 import "./ContainerInspectRequest.tsp";
 import "./ContainerInspectResponse.tsp";
-import "./MetricsResponse.tsp";
 import "./WaveScanRecord.tsp";
 import "./WaveBuildRecord.tsp";
 import "./ValidateRegistryCredsRequest.tsp";

typespec/routes.tsp

@@ -20,7 +20,7 @@ namespace wave {
     @statusCode statusCode: 200;
     };
 
-    @route("/container/{requestId}")
+    @route("/{requestId}")
     @get op getContainerDetails(@path requestId: string): {
       @body response: WaveContainerRecord;
       @statusCode statusCode: 200;
@@ -89,28 +89,6 @@ namespace wave {
 
   }
 
-  @route("/v1alpha2/metrics")
-  interface MetricsService {
-
-    @route("/builds")
-    @get op getBuildMetrics(@query date?: string, @query org?: string): {
-      @body response: MetricsResponse;
-      @statusCode statusCode: 200;
-    };
-
-    @route("/pulls")
-    @get op getPullMetrics(@query date?: string, @query org?: string):  {
-      @body response: MetricsResponse;
-      @statusCode statusCode: 200;
-    };
-
-    @route("/fusion/pulls")
-    @get op getFusionPullMetrics(@query date?: string, @query org?: string):  {
-      @body response: MetricsResponse;
-      @statusCode statusCode: 200;
-    };
-  }
-
   @route("/v1alpha2/validate-creds")
   @post op validateCredsV2(@body request: ValidateRegistryCredsRequest):  boolean;