Decouple from direct-mongo plugin, harden Mongo handling, and modernize CI#21
Merged
Conversation
…aph queries); obfuscate Mongo credentials in config route; reject JS-executing Mongo operators; timezone-aware datetimes
The blueprint registers the dependency-graph endpoints under /graph/uuids/<uuid> (see dserver_dependency_graph_plugin/__init__.py), but the README documented a non-existent /graph/lookup/<uuid> path in all three curl examples. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Install dservercore, the search and the retrieve plugin from the jic-dtool mains, which carry the coordinated readme_parsed feature and the dservercore.utils_auth JWT helpers this branch relies on. Drop the dserver-direct-mongo-plugin install entirely: the dependency was removed in 8c317d2 and, as a custom extension, it overwrites the readme_parsed field and breaks the graph queries. Bump actions to current majors: checkout v6, setup-python v6, mongodb-github-action 1.12.1, upload-artifact v7, download-artifact v8, sigstore v3.4.0. Update the test matrix to Python 3.10-3.13 x MongoDB 6.0/7.0/8.0 and raise requires-python to >=3.10. Python 3.9 (and the EOL MongoDB 4.2-5.0) are dropped because jic-dtool/dservercore now requires Python >=3.10. Verified locally with act across the full matrix: all 12 cells (3.10-3.13 x 6.0/7.0/8.0) pass, 11 tests each. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Guidance file for Claude Code sessions: how to run the suite (MongoDB required), the dependency-view/bookkeeping architecture, the readme_parsed dependency keys, and the JS-operator query hardening boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jotelha
changed the title
version.py is the setuptools_scm write_to target and is regenerated on every build, so it does not belong in VCS. Remove it from the index and add it to .gitignore. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the dependency-graph plugin self-contained and brings its query
handling, build, and CI up to date. Originally scoped to dropping the
direct-mongo-plugin dependency; it now also covers the
readme_parsedtraversal fix, Mongo query hardening, the flit build switch, and a CI
modernization onto the
jic-dtoolplugin repositories.Changes
Decouple from other plugins
dserver-direct-mongo-plugin; vendor theneeded
_dict_to_mongo_queryhelpers intoutils.py.register_datasetis now a no-op — the plugin only reads the search collection.
Dependency-graph correctness
readme_parsed.derived_from.uuidinstead ofreadme.*. String READMEs broke graph queries; the parsed view is thereliable source. Requires the modernized search/retrieve plugins that
populate
readme_parsed.Hardening & robustness
MONGO_URI/MONGO_DB/MONGO_COLLECTION) inthe
/config/inforoute.$where,$function,$accumulator) in raw queries; covered bytest_raw_query_hardening.py.Build
flit_scm.Docs
/graph/lookup→/graph/uuids).CLAUDE.md(build/test commands + architecture overview).CI
dservercore, search and retrieve plugins from thejic-dtoolmains (they carry
readme_parsedand theutils_authJWT helpers thisbranch imports). Drop the
direct-mongo-plugininstall entirely.upload-artifact v7, download-artifact v8, sigstore v3.4.0.
requires-pythonraisedto
>=3.10(jic-dtool/dservercore now requires it).Verification
Full CI matrix run locally with
act: all 12 cells (Python 3.10–3.13 ×MongoDB 6.0/7.0/8.0) pass, 11 tests each.
Coordinated dependencies
Depends on unreleased upstream work:
jic-dtool/dservercore(≥0.22, for theutils_authJWT helpers) and thejic-dtoolsearch/retrieve mongo pluginsthat emit
readme_parsed.