feat(problems): publish immutable versions and fence artifact access

2026-10-09 01:51:13 +08:00
parent ff60136f8d
commit 996dbc5144
37 changed files with 3235 additions and 14 deletions
@@ -0,0 +1,96 @@
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import APIRouter, Header, HTTPException, Request, Response, Security
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from kf_oj.contracts.judging import JobManifest, LeaseBinding
+from kf_oj.modules.submissions.public import WorkerAccessDenied, WorkerReadBusy
+from kf_oj.modules.submissions.worker_access import WorkerAccess
+
+router = APIRouter(prefix="/internal/evaluations", tags=["worker artifacts"])
+bearer = HTTPBearer(auto_error=False, scheme_name="WorkerLease")
+
+
+def grant(
+    evaluation_id: UUID,
+    attempt_id: UUID,
+    worker: UUID,
+    fence: int,
+    credentials: HTTPAuthorizationCredentials | None,
+) -> tuple[LeaseBinding, str]:
+    if (
+        credentials is None
+        or credentials.scheme.lower() != "bearer"
+        or len(credentials.credentials) != 64
+    ):
+        raise HTTPException(401, "worker lease required")
+    try:
+        return LeaseBinding(
+            evaluation_id=evaluation_id,
+            attempt_id=attempt_id,
+            worker_id=worker,
+            fencing_version=fence,
+        ), credentials.credentials
+    except ValueError:
+        raise HTTPException(404, "worker grant rejected") from None
+
+
+def component(request: Request) -> WorkerAccess:
+    access = getattr(request.app.state, "worker_access", None)
+    if access is None:
+        raise HTTPException(503, "worker artifact service unavailable")
+    return access
+
+
+@router.get("/{evaluation_id}/attempts/{attempt_id}/manifest", response_model=JobManifest)
+async def manifest(
+    evaluation_id: UUID,
+    attempt_id: UUID,
+    request: Request,
+    worker: Annotated[UUID, Header(alias="X-Worker-ID")],
+    fence: Annotated[int, Header(alias="X-Fencing-Version", ge=1)],
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Security(bearer)],
+):
+    binding, token = grant(evaluation_id, attempt_id, worker, fence, credentials)
+    try:
+        payload = await component(request).manifest(binding, token)
+    except WorkerAccessDenied:
+        raise HTTPException(404, "worker grant rejected") from None
+    except WorkerReadBusy:
+        raise HTTPException(429, "worker reads temporarily limited") from None
+    return Response(payload, media_type="application/json", headers={"Cache-Control": "no-store"})
+
+
+@router.get(
+    "/{evaluation_id}/attempts/{attempt_id}/artifacts/{digest}",
+    response_class=Response,
+    responses={
+        200: {
+            "content": {
+                "application/octet-stream": {"schema": {"type": "string", "format": "binary"}}
+            }
+        }
+    },
+)
+async def artifact(
+    evaluation_id: UUID,
+    attempt_id: UUID,
+    digest: str,
+    request: Request,
+    worker: Annotated[UUID, Header(alias="X-Worker-ID")],
+    fence: Annotated[int, Header(alias="X-Fencing-Version", ge=1)],
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Security(bearer)],
+):
+    binding, token = grant(evaluation_id, attempt_id, worker, fence, credentials)
+    try:
+        payload = await component(request).artifact(binding, token, digest)
+    except WorkerAccessDenied:
+        raise HTTPException(404, "worker grant rejected") from None
+    except WorkerReadBusy:
+        raise HTTPException(429, "worker reads temporarily limited") from None
+    return Response(
+        payload,
+        media_type="application/octet-stream",
+        headers={"Cache-Control": "no-store", "X-Content-Type-Options": "nosniff"},
+    )