* Studio: require signed capability tokens for /p preview links The public /p preview routes added in #6486 run model load and chat generation as the admin user with no authentication. The only gate is the preview ref, a deterministic outputs-root path (run or run/checkpoint) that is guessable rather than secret. On a network-reachable Studio (--secure tunnel or -H 0.0.0.0), an unauthenticated caller who guesses a ref can consume GPU and probe a private fine-tuned checkpoint. Make the share link an unguessable, revocable capability: - Sign the canonical ref with a dedicated server-side secret (HMAC-SHA256, stored in app_secrets, independent of the JWT/login secret). - Require a valid token on every /p chat, models, and page request before resolving a checkpoint or loading a model; missing or invalid tokens get a generic 404 so the surface never confirms a ref exists. - Accept the token via ?k= (browser link and preview page) or Authorization: Bearer (OpenAI-compatible clients). - Rotate the secret to revoke every outstanding link (POST /api/settings/preview-links/rotate). - Clamp preview generation (max_tokens/max_completion_tokens <= 1024, n = 1) and set Referrer-Policy: no-referrer on the page so the token is not leaked via Referer. Training history hands the authenticated owner the signed token, and the copy-link button builds /p/{ref}?k={sig}. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: honor a lower caller token limit in the preview clamp Codex review: when only the legacy max_tokens was sent, the clamp left max_completion_tokens at the 1024 default, and _effective_max_tokens prefers max_completion_tokens, so a request like max_tokens=16 could still generate up to 1024 tokens. Derive one effective limit (max_completion_tokens wins, else the legacy max_tokens) and pin both fields to it so a caller's lower limit is kept. * Studio: add preview kill switch, rate limit, and revoke-links UI Follow-ups to the /p preview capability work: - Public-sharing kill switch: a persisted setting (default on) gates the public /p surface. When off, every preview request 404s even with a valid token, and the owner UI stops offering share links. GET/PUT /api/settings/preview-sharing; enforced in _verify_or_404. - Per-IP rate limit on the preview chat route: a coarse in-process sliding-window limiter (20 req/min/IP) returns 429 + Retry-After before the GPU lock is taken. Client IP honors X-Forwarded-For only when UNSLOTH_STUDIO_TRUST_FORWARDED is set, matching the login limiter's trust model. - Settings UI: a "Preview sharing" section with the public-sharing toggle and a "Revoke all preview links" button (confirm dialog) that rotates the secret. Tests cover the kill switch (404 when off), the 429 path, the sliding window, client-IP trust behavior, and the setting default. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: fix preview-fields sharing arg and refresh sigs after revoke Codex review: - P1: get_training_run_detail and update_training_run called _preview_fields with only output_dir after it gained a required sharing_on parameter, raising a 500 TypeError once get_run succeeded. Pass get_preview_sharing_enabled() at both sites; add a detail-endpoint regression test. - P2: after rotating the preview secret from settings, the history grid still held stale preview_sig values, so a freshly copied link would 404. Emit emitTrainingRunsChanged() after a successful revoke so the grid refetches freshly signed refs. * Studio: harden preview sharing controls (Codex review) - Fail closed: a read failure on the preview-sharing kill switch now returns False instead of defaulting to enabled, so an unavailable settings DB can't reopen the public surface. A missing key still defaults to enabled. - Per-IP rate limit behind the managed Cloudflare tunnel: client_ip now honors CF-Connecting-IP when the socket peer is loopback, so tunneled visitors are keyed by their real IP instead of collapsing onto the local cloudflared peer. - GET /p no longer mints key/share_url when sharing is disabled; it returns sharing_enabled=false so clients don't distribute links that 404. - Settings UI: toggling public sharing emits the training-runs-changed event so the history grid shows/hides Copy preview link without a manual refresh. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: harden preview rate limiter and IP keying (Opus review) From a two-agent review of the PR: - Rate limiter no longer evicts an active bucket when the table is full: a flood of distinct keys could otherwise cycle out a throttled bucket and reset its counter. Evict only aged-out buckets; if the table is full of live clients, fail closed (deny the new key) instead. - client_ip keys on the rightmost (proxy-appended) X-Forwarded-For hop when the trust env is set; the leftmost is client-spoofable. Documented the append/overwrite-proxy assumption. - _verify_or_404 checks the capability token before the kill-switch DB read, so unauthenticated /p spam can't be used as an unbounded settings-DB sink and the response is identical regardless of the sharing on/off state. Tests: nested run/checkpoint happy path + wrong-ref rejection, the eviction fail-closed behavior, and route-level coverage for the rotate / preview-sharing settings endpoints. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
150 lines
5.2 KiB
Python
150 lines
5.2 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
|
|
|
|
"""
|
|
Training history API routes — browse, view, and delete past training runs.
|
|
"""
|
|
|
|
import json
|
|
from typing import Optional
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Query
|
|
from loggers import get_logger
|
|
|
|
from auth.authentication import get_current_subject
|
|
from core.training.resume import can_resume_run
|
|
from models import (
|
|
TrainingRunDeleteResponse,
|
|
TrainingRunDetailResponse,
|
|
TrainingRunListResponse,
|
|
TrainingRunMetrics,
|
|
TrainingRunSummary,
|
|
TrainingRunUpdateRequest,
|
|
)
|
|
from storage.studio_db import (
|
|
delete_run,
|
|
get_run,
|
|
get_run_metrics,
|
|
list_runs,
|
|
update_run_display_name,
|
|
)
|
|
from utils.models.checkpoints import has_preview_model, preview_ref
|
|
from utils.preview_sharing_settings import get_preview_sharing_enabled
|
|
from utils.preview_token import sign_preview_ref
|
|
|
|
logger = get_logger(__name__)
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
def _preview_fields(output_dir: Optional[str], sharing_on: bool) -> dict:
|
|
"""Previewability + the signed `/p` share ref for a run's output dir.
|
|
|
|
The signature is what makes the share link a capability: these routes are
|
|
authenticated, so only the run's owner ever receives it. When public sharing
|
|
is switched off, omit the signature so the UI hides the copy-link affordance
|
|
(and the link would 404 anyway). ``sharing_on`` is resolved once per request.
|
|
"""
|
|
ref = preview_ref(output_dir)
|
|
return {
|
|
"has_preview_model": has_preview_model(output_dir),
|
|
"preview_ref": ref,
|
|
"preview_sig": sign_preview_ref(ref) if (ref and sharing_on) else None,
|
|
}
|
|
|
|
|
|
@router.get("/runs", response_model = TrainingRunListResponse)
|
|
async def list_training_runs(
|
|
limit: int = Query(50, ge = 1, le = 200),
|
|
offset: int = Query(0, ge = 0),
|
|
current_subject: str = Depends(get_current_subject),
|
|
):
|
|
"""List training runs, newest first."""
|
|
result = list_runs(limit = limit, offset = offset)
|
|
sharing_on = get_preview_sharing_enabled()
|
|
return TrainingRunListResponse(
|
|
runs = [
|
|
TrainingRunSummary(
|
|
**{
|
|
**r,
|
|
"can_resume": can_resume_run(r),
|
|
**_preview_fields(r.get("output_dir"), sharing_on),
|
|
}
|
|
)
|
|
for r in result["runs"]
|
|
],
|
|
total = result["total"],
|
|
)
|
|
|
|
|
|
@router.get("/runs/{run_id}", response_model = TrainingRunDetailResponse)
|
|
async def get_training_run_detail(run_id: str, current_subject: str = Depends(get_current_subject)):
|
|
"""Get a single training run with full config and metrics."""
|
|
run = get_run(run_id)
|
|
if run is None:
|
|
raise HTTPException(status_code = 404, detail = f"Run {run_id} not found")
|
|
|
|
try:
|
|
config = json.loads(run.get("config_json", "{}"))
|
|
except (json.JSONDecodeError, TypeError):
|
|
logger.debug("Failed to parse config_json for run %s", run_id)
|
|
config = {}
|
|
|
|
metrics_data = get_run_metrics(run_id)
|
|
|
|
return TrainingRunDetailResponse(
|
|
run = TrainingRunSummary(
|
|
**{
|
|
**{k: v for k, v in run.items() if k != "config_json"},
|
|
"can_resume": can_resume_run(run),
|
|
**_preview_fields(run.get("output_dir"), get_preview_sharing_enabled()),
|
|
}
|
|
),
|
|
config = config,
|
|
metrics = TrainingRunMetrics(**metrics_data),
|
|
)
|
|
|
|
|
|
@router.patch("/runs/{run_id}", response_model = TrainingRunSummary)
|
|
async def update_training_run(
|
|
run_id: str,
|
|
payload: TrainingRunUpdateRequest,
|
|
current_subject: str = Depends(get_current_subject),
|
|
):
|
|
"""Update mutable fields on a training run (currently only display_name)."""
|
|
run = get_run(run_id)
|
|
if run is None:
|
|
raise HTTPException(status_code = 404, detail = f"Run {run_id} not found")
|
|
|
|
if "display_name" in payload.model_fields_set:
|
|
next_display = payload.display_name
|
|
if next_display is not None:
|
|
next_display = next_display.strip() or None
|
|
update_run_display_name(run_id, next_display)
|
|
|
|
refreshed = get_run(run_id)
|
|
if refreshed is None:
|
|
raise HTTPException(status_code = 404, detail = f"Run {run_id} not found")
|
|
return TrainingRunSummary(
|
|
**{
|
|
**{k: v for k, v in refreshed.items() if k != "config_json"},
|
|
"can_resume": can_resume_run(refreshed),
|
|
**_preview_fields(refreshed.get("output_dir"), get_preview_sharing_enabled()),
|
|
}
|
|
)
|
|
|
|
|
|
@router.delete("/runs/{run_id}", response_model = TrainingRunDeleteResponse)
|
|
async def delete_training_run(run_id: str, current_subject: str = Depends(get_current_subject)):
|
|
"""Delete a training run and its metrics (CASCADE)."""
|
|
run = get_run(run_id)
|
|
if run is None:
|
|
raise HTTPException(status_code = 404, detail = f"Run {run_id} not found")
|
|
if run["status"] == "running":
|
|
raise HTTPException(status_code = 409, detail = "Cannot delete a running training run")
|
|
logger.info("Deleting training run %s", run_id)
|
|
delete_run(run_id)
|
|
return TrainingRunDeleteResponse(
|
|
status = "deleted",
|
|
message = f"Run {run_id} deleted",
|
|
)
|