open/portfolio-optimiser
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

feat(ingest): gate http behind allow_network run-flag + dispatch (I6)

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-07-04 17:04:05 +02:00
commit bbdcd62ae6
3 changed files with 219 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/test_ingest_materialize.py
View file

@ -242,10 +242,11 @@ def test_two_runs_with_identical_inputs_are_byte_identical(tmp_path: Path) -> No
assert first == second # §10 idempotence at file level
def test_http_source_has_no_connector(tmp_path: Path) -> None:
# The polymorphic schema VALIDATES http (brief assumption 1); executing it is the gated
# I6 extension point — attempting to materialize is an explicit refusal, never a silent
# no-op. (sql now EXECUTES, I4; see tests/test_ingest_sql.py.)
def test_http_source_is_refused_without_network_flag(tmp_path: Path) -> None:
# The polymorphic schema VALIDATES http (brief assumption 1). Since I6 the http connector
# EXISTS, but materialize refuses it fail-fast unless the per-run allow_network flag is set —
# the manifest cannot grant itself network access (§8). Default (no flag) → explicit refusal,
# never a silent no-op. (The allow-branch is covered in tests/test_ingest_http_loadbearing.py.)
manifest_path, bundle_dir = _project(
tmp_path, source={"type": "http", "id": "api", "base_url": "https://host/api"}
)