Roland Tannous 6e8bf4d51b studio: fix training page regressions from the security hardening pass (#5409) ... * studio: allow huggingface.co and datasets-server.huggingface.co in CSP connect-src The security hardening pass (0881a7a5) added connect-src 'self', which blocked the Training page's direct browser calls to HuggingFace. Model search (@huggingface/hub listModels/modelInfo/whoAmI -> huggingface.co) and dataset subset/split discovery (datasets-server.huggingface.co/splits) both returned nothing as a result. Extend connect-src to permit the two HF hosts the SPA actually talks to. No other directive changes; HF tokens still stay client-side. * studio: format FastAPI 422 detail arrays in training error messages readError in train-api.ts stringified payload.detail directly. On a 422 the detail is an array of {loc, msg} objects, which JS coerces to '[object Object],[object Object]' -- the UI showed that instead of the actual validator message. Format the array into 'field.path: msg; ...' so the offending field and the validator's message surface in the UI and toast. * studio: allow num_epochs/max_steps = 0 sentinel through TrainingStartRequest The hyperparameter validators added in the security pass rejected 0 for both num_epochs and max_steps. But Studio's steps-vs-epochs toggle uses 0 as a sentinel: when training by max_steps the frontend sends num_epochs=0, and when training by epochs it sends max_steps=0. The trainer expects this and ignores the zeroed field. Widen both validators to [0, MAX]. They still catch the actual out-of-range and non-integer inputs they were added for. * studio: reject TrainingStartRequest when num_epochs and max_steps are both 0 Each field's validator accepts 0 as a "use the other one" sentinel, but on their own they don't catch the case where both are 0 (or max_steps is None and num_epochs is 0). That payload would otherwise produce a no-op training job. Add a model-level validator that rejects it with a clear 422 message. * studio: add Optional[int] type hints to _check_max_steps and _check_warmup_steps Brings these two validators in line with the rest of the TrainingStartRequest validators in the same file, which all carry explicit cls/v/return hints.		2026-05-13 19:40:54 +04:00
..
.gitkeep	fix: restore models directory files deleted during restructure	2026-02-02 19:36:30 +00:00
__init__.py	Studio: Dark theme refactor, right sidebar redesign, and chat UI polish (#5150)	2026-05-07 14:33:31 +04:00
auth.py	studio: security and hardening pass (auth rate-limit, sandbox, path containment, schema validation, headers) (#5375)	2026-05-13 06:12:18 -07:00
data_recipe.py	feat(studio): multi-file unstructured seed upload with better backend extraction (#4468)	2026-03-20 13:22:42 -07:00
datasets.py	Final cleanup	2026-03-12 18:28:04 +00:00
export.py	studio: security and hardening pass (auth rate-limit, sandbox, path containment, schema validation, headers) (#5375)	2026-05-13 06:12:18 -07:00
inference.py	studio: security and hardening pass (auth rate-limit, sandbox, path containment, schema validation, headers) (#5375)	2026-05-13 06:12:18 -07:00
models.py	Studio: add folder browser modal for Custom Folders (#5035)	2026-04-15 08:04:33 -07:00
responses.py	Final cleanup	2026-03-12 18:28:04 +00:00
training.py	studio: fix training page regressions from the security hardening pass (#5409)	2026-05-13 19:40:54 +04:00
users.py	fix: remove old comments (#4292)	2026-03-14 16:50:13 +04:00