Merge pull request #292 from webtech-network/sandbox-file-injection

feat: implement static asset placement for sandbox executions

Author: ArthurCRodrigues

.env.example

@@ -27,3 +27,11 @@ JSON_LOGS=false  # Set to 'true' for JSON-formatted logs (recommended for produc
 # Optional: Upstash Redis for result export
 # UPSTASH_REDIS_URL=your-redis-url
 # UPSTASH_REDIS_TOKEN=your-redis-token
+
+# S3 Assets Configuration
+CRITERIA_ASSETS_BUCKET_NAME=autograder-assets
+CRITERIA_ASSETS_IN_MEMORY_CACHE_LIMIT=100
+AWS_ACCESS_KEY_ID=test
+AWS_SECRET_ACCESS_KEY=test
+AWS_REGION=us-east-1
+S3_ENDPOINT_URL=http://localhost:4566

autograder/models/config/setup.py

@@ -0,0 +1,57 @@
+from typing import List, Optional, Any
+from pydantic import BaseModel, Field, field_validator
+
+
+class AssetConfig(BaseModel):
+    """Configuration for a static asset to be injected into the sandbox."""
+    source: str = Field(..., description="Relative path for the asset on the S3 provider")
+    target: str = Field(..., description="Absolute path for the asset inside the container")
+    read_only: bool = Field(True, description="Whether the asset should be read-only (0444)")
+
+    @field_validator('source')
+    @classmethod
+    def validate_source(cls, v: str) -> str:
+        if not v:
+            raise ValueError("source must not be empty")
+        if v.startswith('/'):
+            raise ValueError("source must be a relative path")
+        if '..' in v:
+            raise ValueError("source must not contain path traversal (..)")
+        return v
+
+    @field_validator('target')
+    @classmethod
+    def validate_target(cls, v: str) -> str:
+        if not v:
+            raise ValueError("target must not be empty")
+        if not v.startswith('/'):
+            raise ValueError("target must be an absolute path (starting with /)")
+        if '..' in v:
+            raise ValueError("target must not contain path traversal (..)")
+        return v
+
+
+class LanguageSetupConfig(BaseModel):
+    """Language-specific setup configuration."""
+    required_files: List[str] = Field(default_factory=list)
+    setup_commands: List[Any] = Field(default_factory=list)
+
+
+class SetupConfig(BaseModel):
+    """Root configuration for sandbox setup, including global assets and language-specific configs."""
+    assets: List[AssetConfig] = Field(default_factory=list)
+    
+    # Language-specific configurations are handled dynamically
+    # but we can provide hints for common languages
+    python: Optional[LanguageSetupConfig] = None
+    java: Optional[LanguageSetupConfig] = None
+    node: Optional[LanguageSetupConfig] = None
+    cpp: Optional[LanguageSetupConfig] = None
+
+    # Allow extra fields for other languages
+    model_config = {"extra": "allow"}
+
+    @classmethod
+    def from_dict(cls, data: dict) -> "SetupConfig":
+        """Create and validate setup config from dictionary."""
+        return cls.model_validate(data or {})

autograder/models/dataclass/asset.py

@@ -0,0 +1,8 @@
+from dataclasses import dataclass
+
+@dataclass
+class ResolvedAsset:
+    """Resolved asset ready for injection into a sandbox."""
+    target: str
+    content: bytes
+    read_only: bool = True

autograder/services/assets/__init__.py

@@ -0,0 +1,95 @@
+import os
+import shutil
+import logging
+from typing import Optional, Dict
+import collections
+
+logger = logging.getLogger("AssetCacheManager")
+
+class AssetCacheManager:
+    def __init__(self, in_memory_limit: int = 0, disk_cache_dir: str = "/tmp/autograder_assets_cache"):
+        """
+        Initialize the asset cache manager.
+        
+        Args:
+            in_memory_limit: Maximum number of assets to keep in memory. If 0, in-memory cache is disabled.
+            disk_cache_dir: Directory to use for disk caching.
+        """
+        self.in_memory_limit = in_memory_limit
+        self.disk_cache_dir = disk_cache_dir
+        
+        # LRU cache for in-memory assets (filename -> bytes)
+        self.in_memory_cache: Dict[str, bytes] = collections.OrderedDict()
+        
+        # Ensure disk cache directory exists
+        if not os.path.exists(self.disk_cache_dir):
+            os.makedirs(self.disk_cache_dir, exist_ok=True)
+            
+    def get(self, asset_key: str) -> Optional[bytes]:
+        """Get an asset from cache (memory first, then disk)."""
+        # Try in-memory cache first
+        if self.in_memory_limit > 0 and asset_key in self.in_memory_cache:
+            logger.debug("In-memory cache hit for %s", asset_key)
+            # Move to end to mark as recently used
+            content = self.in_memory_cache.pop(asset_key)
+            self.in_memory_cache[asset_key] = content
+            return content
+            
+        # Try disk cache
+        disk_path = self._get_disk_path(asset_key)
+        if os.path.exists(disk_path):
+            logger.debug("Disk cache hit for %s", asset_key)
+            try:
+                with open(disk_path, "rb") as f:
+                    content = f.read()
+                    
+                # Store in in-memory cache if enabled
+                if self.in_memory_limit > 0:
+                    self._add_to_memory_cache(asset_key, content)
+                    
+                return content
+            except Exception as e:
+                logger.error("Failed to read asset from disk cache: %s", str(e))
+                
+        return None
+        
+    def put(self, asset_key: str, content: bytes) -> None:
+        """Store an asset in both memory and disk caches."""
+        # Save to disk
+        disk_path = self._get_disk_path(asset_key)
+        try:
+            # Create subdirectories if needed (e.g., if asset_key contains '/')
+            os.makedirs(os.path.dirname(disk_path), exist_ok=True)
+            with open(disk_path, "wb") as f:
+                f.write(content)
+            logger.debug("Stored asset %s in disk cache", asset_key)
+        except Exception as e:
+            logger.error("Failed to write asset to disk cache: %s", str(e))
+            
+        # Save to memory if enabled
+        if self.in_memory_limit > 0:
+            self._add_to_memory_cache(asset_key, content)
+            
+    def _add_to_memory_cache(self, asset_key: str, content: bytes) -> None:
+        """Helper to add an asset to the LRU memory cache."""
+        if asset_key in self.in_memory_cache:
+            self.in_memory_cache.pop(asset_key)
+        elif len(self.in_memory_cache) >= self.in_memory_limit:
+            # Remove oldest item (first item in OrderedDict)
+            self.in_memory_cache.popitem(last=False)
+            
+        self.in_memory_cache[asset_key] = content
+        
+    def _get_disk_path(self, asset_key: str) -> str:
+        """Resolve the absolute disk path for an asset key."""
+        # Sanitize asset_key to prevent directory traversal
+        # asset_key is expected to be a hash or a safe relative path
+        safe_key = os.path.normpath(asset_key).lstrip('/')
+        return os.path.join(self.disk_cache_dir, safe_key)
+
+    def clear(self) -> None:
+        """Clear all caches."""
+        self.in_memory_cache.clear()
+        if os.path.exists(self.disk_cache_dir):
+            shutil.rmtree(self.disk_cache_dir)
+            os.makedirs(self.disk_cache_dir, exist_ok=True)

autograder/services/assets/cache_manager.py

@@ -0,0 +1,18 @@
+from abc import ABC, abstractmethod
+from typing import Optional
+
+class AssetProvider(ABC):
+    @abstractmethod
+    def get_asset(self, source: str, target: str, read_only: bool = True) -> Optional[bytes]:
+        """
+        Fetch asset content from the provider and return it as raw bytes.
+        
+        Args:
+            source: Relative path to the asset in the provider.
+            target: Absolute path where the asset should be placed in the container.
+            read_only: Whether the file should be read-only in the container.
+            
+        Returns:
+            Raw content as bytes, or None if not found or on error.
+        """
+        ...

autograder/services/assets/provider.py

@@ -0,0 +1,47 @@
+import os
+import logging
+from typing import List
+from autograder.services.assets.s3_provider import S3AssetProvider
+from autograder.services.assets.cache_manager import AssetCacheManager
+from autograder.models.config.setup import AssetConfig
+from autograder.models.dataclass.asset import ResolvedAsset
+
+logger = logging.getLogger("AssetSourceResolver")
+
+class AssetSourceResolver:
+    def __init__(self):
+        in_memory_limit = int(os.getenv("CRITERIA_ASSETS_IN_MEMORY_CACHE_LIMIT", "100"))
+        self.cache_manager = AssetCacheManager(in_memory_limit=in_memory_limit)
+        self.provider = S3AssetProvider(self.cache_manager)
+        
+    def resolve_assets(self, assets_config: List[AssetConfig]) -> List[ResolvedAsset]:
+        """
+        Resolve all assets in the configuration.
+        
+        Args:
+            assets_config: List of AssetConfig objects.
+            
+        Returns:
+            List of ResolvedAsset objects.
+            If any asset fails to resolve, an exception is raised.
+        """
+        resolved_assets = []
+        
+        for asset in assets_config:
+            source = asset.source
+            target = asset.target
+            read_only = asset.read_only
+            
+            # Resolve asset
+            content = self.provider.get_asset(source, target, read_only)
+            
+            if not content:
+                raise RuntimeError(f"Failed to resolve asset: source={source}, target={target}")
+                
+            resolved_assets.append(ResolvedAsset(
+                target=target,
+                content=content,
+                read_only=read_only
+            ))
+            
+        return resolved_assets

autograder/services/assets/resolver.py

@@ -0,0 +1,58 @@
+import os
+import logging
+import boto3
+from botocore.config import Config
+from typing import Optional
+from autograder.services.assets.provider import AssetProvider
+from autograder.services.assets.cache_manager import AssetCacheManager
+
+logger = logging.getLogger("S3AssetProvider")
+
+class S3AssetProvider(AssetProvider):
+    def __init__(self, cache_manager: AssetCacheManager):
+        self.cache_manager = cache_manager
+        
+        # Environment variables
+        self.bucket_name = os.getenv("CRITERIA_ASSETS_BUCKET_NAME")
+        self.access_key = os.getenv("AWS_ACCESS_KEY_ID") or os.getenv("AWS_ACCESS_ID")
+        self.secret_key = os.getenv("AWS_SECRET_ACCESS_KEY")
+        self.region = os.getenv("AWS_REGION", "us-east-1")
+        self.endpoint_url = os.getenv("S3_ENDPOINT_URL")
+        
+        # Initialize boto3 client
+        self.s3 = boto3.client(
+            's3',
+            endpoint_url=self.endpoint_url,
+            aws_access_key_id=self.access_key,
+            aws_secret_access_key=self.secret_key,
+            region_name=self.region,
+            config=Config(signature_version='s3v4')
+        )
+        
+    def get_asset(self, source: str, target: str, read_only: bool = True) -> Optional[bytes]:
+        """
+        Fetch asset from S3 and return raw content (cached).
+        """
+        # Create a unique cache key based on source
+        # (target and read_only no longer affect the content itself)
+        cache_key = f"{source}.raw".replace('/', '_')
+        
+        # Check cache
+        cached_content = self.cache_manager.get(cache_key)
+        if cached_content:
+            logger.debug("Cache hit for %s", cache_key)
+            return cached_content
+            
+        # Fetch from S3
+        logger.info("Fetching asset from S3: %s", source)
+        try:
+            response = self.s3.get_object(Bucket=self.bucket_name, Key=source)
+            raw_content = response['Body'].read()
+            
+            # Store in cache
+            self.cache_manager.put(cache_key, raw_content)
+            
+            return raw_content
+        except Exception as e:
+            logger.error("Failed to fetch asset from S3 (%s): %s", source, str(e))
+            return None

autograder/services/assets/s3_provider.py

@@ -58,8 +58,11 @@ def resolve_command(
             return None
 
         # Handle special "CMD" placeholder for auto-resolution
-        if isinstance(program_command, str) and program_command == "CMD":
-            return self._auto_resolve_command(language, fallback_filename)
+        if isinstance(program_command, str):
+            if program_command == "CMD":
+                return self._auto_resolve_command(language, fallback_filename)
+            # If it's any other string, use it directly as the command
+            return program_command
 
         # Handle dict format (multi-language)
         if isinstance(program_command, dict):