Repository navigation
Tooling for custom runestone builds - #1643
Open
ascholerChemeketa wants to merge 2 commits into
Open
ascholerChemeketa wants to merge 2 commits into
ascholerChemeketa wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The pooled upstream client can leak session cookies between students, and the new tests fail to exercise the streaming size-limit guard.
2 open issues
What changed in this PR
Adds support for custom Runestone components embedded in PreTeXt iframes, including automatic resizing and a book-server tunnel to an allowlisted experiment API.
Changes:
- Adds an experiment API endpoint with redirect refusal, response-size limits, and timeout/error handling.
- Reports iframe content-height changes to the parent page.
- Adds proxy tests for allowlist enforcement, credential omission, and upstream failure handling.
| File | Description |
|---|---|
test/bases/rsptx/book_server_api/test_rsproxy.py |
Tests experiment proxy behavior and safeguards. |
bases/rsptx/interactives/webpack.index.js |
Includes the iframe resize script in the interactive bundle. |
bases/rsptx/interactives/runestone/common/js/pretext-iframe-resize.js |
Observes wrapper size and sends height updates to the parent. |
bases/rsptx/book_server_api/routers/rsproxy.py |
Implements the allowlisted experiment API tunnel. |
Review effort: Balanced
|
|
||
| def experiment_client() -> httpx.AsyncClient: | ||
| """Client for explicitly allowlisted experiment APIs.""" | ||
| return _client("experiment", timeout=EXPERIMENT_TIMEOUT, follow_redirects=False) |
Comment on lines
+289
to
+294
| async def test_experiment_api_caps_response(monkeypatch): | ||
| monkeypatch.setattr(rsproxy, "MAX_EXPERIMENT_RESPONSE_BYTES", 10) | ||
| install_mock("experiment", lambda request: httpx.Response(200, content=b"x" * 11)) | ||
| async with book_client() as client: | ||
| resp = await client.get("/rsproxy/experiments/rdaas/api/duck") | ||
| assert resp.status_code == 502 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Handle iframe resizing and add a proxy service for custom builds of runestone running in an interactive's iframe.
This pull request introduces a new allowlisted experiment API tunnel to the book server and adds support for automatic iframe resizing for experimental Runestone components. It also includes comprehensive tests for the new API tunnel.
Experiment API Tunnel
/experiments/{service}/{path}) torsproxy.py, with strict SSRF protections, response size limits, timeout handling, and error mapping. Only explicitly named APIs (currentlyrdaas/api/duck) are accessible, and responses are capped in size and not cached. [1] [2] [3]Frontend: Iframe Resize Support
pretext-iframe-resize.js, a script that enables experimental Runestone components in iframes to automatically request resizing from the parent PreTeXt page when their content changes.webpack.index.js) so it is loaded with other common JS assets.