Merge branch 'main' into SEP-1664

Author: yyyyyyyan

changelog.d/SEP-1628.config.md

@@ -0,0 +1 @@
+Snippet sync now honours the shipped extension filter. `settings.yaml` declared the filter under `SEP.SNIPPETS.FILTER_EXTENSIONS`, which is not a settings field and was silently dropped at load, so every file under `SNIPPETS_DIR` synced regardless of extension. The key is replaced with the real `SEP.SNIPPETS.SYNC_FILTER: [.sh]`, restricting sync to shell scripts. Deployments carrying `FILTER_EXTENSIONS` in their own configuration overrides should rename it to `SYNC_FILTER`. Two upgrade notes for a deployment that has been syncing unfiltered: non-approved snippet rows whose files no longer match the filter are pruned on the next sync, and an approved row whose file no longer matches is kept but stops being refreshed from disk, so it should be removed manually if unwanted.

frontend/packages/shell/tests/vite-proxy.config.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Copyright (C) 2026 Percona LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import viteConfig from '../vite.config';
+import viteQaConfig from '../vite.qa.config';
+
+describe('Vite backend proxy prefixes', () => {
+  it('proxies /static to the local dev backend', () => {
+    const proxy = viteConfig.server?.proxy;
+    expect(proxy).toBeDefined();
+    expect(proxy?.['/static']).toMatchObject({
+      target: 'http://localhost:8000',
+      changeOrigin: true,
+    });
+  });
+
+  it('proxies /static to the QA backend alongside other entries', () => {
+    const proxy = viteQaConfig.server?.proxy;
+    expect(proxy).toBeDefined();
+    expect(proxy?.['/static']).toMatchObject({
+      target: process.env.SEP_QA_BACKEND ?? 'http://127.0.0.1:18002',
+      changeOrigin: true,
+      cookieDomainRewrite: 'localhost',
+    });
+  });
+});

frontend/packages/shell/vite.config.ts

@@ -66,6 +66,12 @@ export default defineConfig({
         target: 'http://localhost:8000',
         changeOrigin: true,
       },
+      // App static mounts (snippets, dipper) and anonymous legacy Jinja assets
+      // (see app/sep/main.py). Without this, SPA fallback returns index.html.
+      '/static': {
+        target: 'http://localhost:8000',
+        changeOrigin: true,
+      },
     },
   },
   optimizeDeps: {
@@ -108,6 +114,7 @@ export default defineConfig({
           if (id.includes('/node_modules/@tanstack/react-query/')) {
             return 'vendor-query';
           }
+          return undefined;
         },
       },
     },

frontend/packages/shell/vite.qa.config.ts

@@ -69,6 +69,9 @@ export default defineConfig({
       '/stream-logs': proxyEntry,
       '/execution-events': proxyEntry,
       '/files': proxyEntry,
+      // App static mounts (snippets, dipper) and anonymous legacy Jinja assets
+      // (see app/sep/main.py). Without this, SPA fallback returns index.html.
+      '/static': proxyEntry,
     },
   },
   optimizeDeps: {

settings.yaml

@@ -40,7 +40,11 @@ default:
     ANNOTATIONS_TIMEOUT: 5  # Optional: PMM annotation request timeout in seconds
   SEP:
     SNIPPETS:
-      FILTER_EXTENSIONS:
+      # Restrict snippet sync to shell scripts. Bare strings are parsed as
+      # extension filters; MIME-type filters use the "mime:<value>" form.
+      # Files that don't match are skipped, so add ".py" here to sync Python
+      # snippets even though an interpreter for them is configured by default.
+      SYNC_FILTER:
         - .sh
     UVICORN_HOST: "127.0.0.1"
     UVICORN_PORT: 8000

tests/app/sep/snippets/test_config.py

@@ -17,19 +17,27 @@
 
 import json
 import re
+from collections.abc import Iterator
 from typing import Any
 
 import pytest
+import yaml
 from pydantic import ValidationError
 from sqlalchemy_celery_beat.models import Period
 
+from app import BASE_DIR
 from app.core.celery.models import IntervalSchedule
 from app.core.settings_override.registry import (
     is_hot_reloadable,
     materialize_override_value,
 )
 from app.sep.apps.framework.schema import EXECUTION_HOST_LABEL
-from app.sep.snippets.config import SnippetsSettings, SnippetSudoOption
+from app.sep.snippets.config import (
+    SnippetFilter,
+    SnippetFilterType,
+    SnippetsSettings,
+    SnippetSudoOption,
+)
 from app.sep.snippets.models.snippet import BaseSnippet, SUDO_INPUT_NAME
 
 EXECUTOR_HOSTS = frozenset({("host1", "host1")})
@@ -355,3 +363,44 @@ def test_invalid_override_rejected(self, bad: Any) -> None:
             materialize_override_value(
                 SnippetsSettings, "SYNC_INTERVAL", field_info, bad
             )
+
+
+class TestShippedSyncFilterConfig:
+    """Guard the shipped ``settings.yaml`` snippet sync filter declaration.
+
+    ``FILTER_EXTENSIONS`` was never a ``SnippetsSettings`` field, so the shipped
+    key was silently dropped by ``extra="ignore"`` and snippet sync ran
+    unfiltered. These tests pin the live ``SYNC_FILTER`` key and keep the dead
+    key from creeping back in.
+    """
+
+    @staticmethod
+    def _shipped_settings() -> dict[str, Any]:
+        """Load the repository's tracked ``settings.yaml``."""
+        return yaml.safe_load((BASE_DIR / "settings.yaml").read_text())
+
+    @staticmethod
+    def _iter_keys(node: Any) -> Iterator[str]:
+        """Yield every mapping key found anywhere in a parsed YAML document."""
+        if isinstance(node, dict):
+            for key, value in node.items():
+                yield key
+                yield from TestShippedSyncFilterConfig._iter_keys(value)
+        elif isinstance(node, list):
+            for item in node:
+                yield from TestShippedSyncFilterConfig._iter_keys(item)
+
+    def test_no_dead_filter_extensions_key(self):
+        """Assert no section of the shipped config declares the dead key."""
+        assert "FILTER_EXTENSIONS" not in set(self._iter_keys(self._shipped_settings()))
+
+    def test_sync_filter_declares_shell_scripts_only(self):
+        """Assert the shipped config restricts sync to ``.sh`` via the live field."""
+        snippets = self._shipped_settings()["default"]["SEP"]["SNIPPETS"]
+        assert snippets["SYNC_FILTER"] == [".sh"]
+
+    def test_shipped_sync_filter_parses_to_extension_filter(self):
+        """Verify the shipped value validates into an extension ``SnippetFilter``."""
+        snippets = self._shipped_settings()["default"]["SEP"]["SNIPPETS"]
+        parsed = SnippetsSettings(SYNC_FILTER=snippets["SYNC_FILTER"])
+        assert {SnippetFilter(".sh", SnippetFilterType.EXTENSION)} == parsed.SYNC_FILTER