fix(api): file /workflow-runs/from-image into the caller's collection (#238) - #279
Open
kevin9327 wants to merge 1 commit into
Open
fix(api): file /workflow-runs/from-image into the caller's collection (#238)#279kevin9327 wants to merge 1 commit into
kevin9327 wants to merge 1 commit into
Conversation
…lightningpixel#238) The canonical run endpoint hardcoded the "Default" collection, while the legacy /generate/from-image accepts a `collection` field. A run driven over REST/MCP therefore always landed in Default/, which the Workspace Library does not index, so everything generated headlessly existed on disk but showed as "No workspace assets are indexed yet" in the app (cause 1 of lightningpixel#238). Accept the same `collection` field on /workflow-runs/from-image and route the run into it. The name goes through a shared `sanitize_collection()`, extracted from the legacy endpoint's inline check rather than copied, so the two surfaces cannot drift on which characters may name a workspace subfolder: a path separator, a drive/wildcard character, or an empty name still falls back to "Default", because that string becomes a directory under the workspace. This is the API half of lightningpixel#238. It lets a headless caller target an indexed collection (e.g. "Exports") instead of the workaround of mirroring files by hand; the indexer roots and job meta records (causes 2 and 3) are separate and untouched here. Tests (api/tests/test_workflow_runs_router.py): the sanitizer keeps a plain name, refuses path and wildcard characters, and defaults on empty; the endpoint forwards the caller's collection to the run and neutralizes a traversing one. 6 new tests, full api suite 59 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
POST /workflow-runs/from-imagenow accepts acollectionform field (default"Default") and files the run into it, instead of hardcoding"Default".Why
This is cause 1 of #238. The legacy
/generate/from-imagealready acceptscollection, but the canonical workflow-runs endpoint hardcoded it:So a run driven over the REST/MCP surface always landed in
Default/, which the Workspace Library does not index — everything generated headlessly existed on disk but showed as "No workspace assets are indexed yet" in the app. With this change a headless caller can target an indexed collection (e.g.Exports) directly, instead of the reported workaround of mirroring files by hand.The collection name becomes a directory under the workspace (
WORKSPACE_DIR / collection), so it has to be sanitized. Rather than copy the legacy endpoint's inline check, I extracted it into a sharedsanitize_collection()and call it from both — a path separator, a drive/wildcard character, or an empty name still falls back to"Default", and the two surfaces can't drift on which characters are allowed.Scope is deliberately just the API half. The indexer roots and job‑meta records (causes 2 and 3 of #238) are separate and untouched here.
Testing
New
api/tests/test_workflow_runs_router.py(6 tests):sanitize_collectionkeeps a plain name (trimmed), refuses/ \ : * ? " < > |, and defaults on empty/blank.create_run_from_imageforwards the caller's collection to the run and neutralizes a traversing one (../../etc→Default).Full
apiunittest suite green (the 2 skips are pre-existing). No TypeScript touched.