Merge branch 'main' into kafka-regions

Author: korgan00

client/qiskit_serverless/core/client.py

@@ -157,8 +157,12 @@ def upload(self, program: QiskitFunction) -> Optional[RunnableQiskitFunction]:
         """Uploads program."""
 
     @abstractmethod
-    def functions(self, **kwargs) -> List[RunnableQiskitFunction]:
-        """Returns list of available programs."""
+    def functions(self, provider: Optional[str] = None, **kwargs) -> List[RunnableQiskitFunction]:
+        """Returns list of available programs.
+
+        Args:
+            provider: if given, only functions belonging to this provider are returned.
+        """
 
     @abstractmethod
     def function(self, title: str, provider: Optional[str] = None) -> Optional[RunnableQiskitFunction]:
@@ -174,12 +178,16 @@ def get(self, title: str, provider: Optional[str] = None) -> Optional[RunnableQi
         )
         return self.function(title, provider=provider)
 
-    def list(self, **kwargs) -> List[RunnableQiskitFunction]:
-        """Returns list of available programs."""
+    def list(self, provider: Optional[str] = None, **kwargs) -> List[RunnableQiskitFunction]:
+        """Returns list of available programs.
+
+        Args:
+            provider: if given, only functions belonging to this provider are returned.
+        """
         warnings.warn(
             "`list` method has been deprecated. "
             "And will be removed in future releases. "
             "Please, use `get_functions` instead.",
             DeprecationWarning,
         )
-        return self.functions(**kwargs)
+        return self.functions(provider=provider, **kwargs)

client/qiskit_serverless/core/clients/serverless_client.py

@@ -611,13 +611,21 @@ def upload(self, program: QiskitFunction) -> Optional[RunnableQiskitFunction]:
         return function_uploaded
 
     @_trace_functions("list")
-    def functions(self, **kwargs) -> List[RunnableQiskitFunction]:
-        """Returns list of available functions."""
+    def functions(self, provider: Optional[str] = None, **kwargs) -> List[RunnableQiskitFunction]:
+        """Returns list of available functions.
+
+        Args:
+            provider: if given, only functions belonging to this provider are returned,
+                e.g. ``functions(provider="q-ctrl")``.
+        """
+        params = dict(kwargs)
+        if provider:
+            params["provider"] = provider
         response_data = safe_json_request_as_list(
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/programs",
                 headers=get_headers(token=self.token, instance=self.instance, channel=self.channel),
-                params=kwargs,
+                params=params,
                 timeout=REQUESTS_TIMEOUT,
             )
         )

client/requirements-dev.txt

@@ -3,7 +3,7 @@ pylint>=4.0.8
 nbqa>=1.9.1
 treon>=0.1.4
 pytest>=9.1.1
-pytest-randomly>=4.1.0
+pytest-randomly>=5.0.0
 mypy>=2.3.1
 mypy-extensions>=1.1.0
 jupyter-sphinx>=0.5.3
@@ -16,6 +16,6 @@ black[jupyter]~=26.5
 requests-mock>=1.12.1
 # new versions of testcontainers don't support docker compose
 testcontainers>=4.15.0
-tox>=4.61.1
+tox>=4.61.2
 pre-commit>=4.6.2
 setuptools>=84.0.0

client/tests/core/test_serverless_client_functions.py

@@ -218,6 +218,20 @@ def test_functions_passes_query_parameters(self, mock_get, mock_client):
         call_kwargs = mock_get.call_args[1]
         assert call_kwargs["params"] == {"limit": 5, "offset": 10, "provider": "test-provider"}
 
+    @patch("qiskit_serverless.core.clients.serverless_client.requests.get")
+    def test_functions_passes_provider_filter(self, mock_get, mock_client):
+        """functions(provider=...) forwards the provider as a query parameter."""
+        mock_response = Mock()
+        mock_response.ok = True
+        mock_response.text = "[]"
+        mock_response.json.return_value = []
+        mock_get.return_value = mock_response
+
+        mock_client.functions(provider="q-ctrl")
+
+        mock_get.assert_called_once()
+        assert mock_get.call_args[1]["params"] == {"provider": "q-ctrl"}
+
     @patch("qiskit_serverless.core.clients.serverless_client.requests.get")
     def test_functions_returns_empty_list_when_no_functions(self, mock_get, mock_client):
         """functions() returns an empty list when no functions are available."""

gateway/api/use_cases/programs/list.py

@@ -20,26 +20,32 @@ def execute(
         user: AbstractUser,
         accessible_functions: FunctionAccessResult,
         type_filter: str | None,
+        provider: str | None = None,
     ) -> list[Function]:
-        """Return functions the user can see, filtered by type_filter."""
+        """Return functions the user can see, filtered by type_filter and provider.
+
+        When provider is given, results are narrowed to that provider's functions. The
+        narrowing is applied after permission scoping, so it can only reduce the set the
+        user is already allowed to see -- an unknown or inaccessible provider yields [].
+        """
         if type_filter == TypeFilter.SERVERLESS:
-            return list(Function.objects.user_functions(user))
-
-        if type_filter == TypeFilter.CATALOG:
-            return list(
-                Function.objects.provider_functions().with_permission(
-                    user,
-                    accessible_functions=accessible_functions,
-                    legacy_permission_name=RUN_PROGRAM_PERMISSION,
-                    permission=PLATFORM_PERMISSION_READ,
-                )
+            queryset = Function.objects.user_functions(user)
+        elif type_filter == TypeFilter.CATALOG:
+            queryset = Function.objects.provider_functions().with_permission(
+                user,
+                accessible_functions=accessible_functions,
+                legacy_permission_name=RUN_PROGRAM_PERMISSION,
+                permission=PLATFORM_PERMISSION_READ,
             )
-
-        return list(
-            Function.objects.with_permission(
+        else:
+            queryset = Function.objects.with_permission(
                 user,
                 accessible_functions=accessible_functions,
                 legacy_permission_name=VIEW_PROGRAM_PERMISSION,
                 permission=PLATFORM_PERMISSION_READ,
             )
-        )
+
+        if provider:
+            queryset = queryset.filter(provider__name=provider)
+
+        return list(queryset)

gateway/api/v1/views/programs/list.py

@@ -58,6 +58,13 @@ class Meta:
             type=openapi.TYPE_STRING,
             required=False,
         ),
+        openapi.Parameter(
+            "provider",
+            openapi.IN_QUERY,
+            description="Return only functions belonging to this provider",
+            type=openapi.TYPE_STRING,
+            required=False,
+        ),
     ],
     responses={status.HTTP_200_OK: OutputSerializer(many=True)},
 )
@@ -67,15 +74,22 @@ class Meta:
 def list_programs(request: Request) -> Response:
     """List Qiskit Functions accessible to the authenticated user."""
     type_filter = request.query_params.get("filter")
+    provider = request.query_params.get("provider")
     user = cast(AbstractUser, request.user)
     accessible_functions = cast(FunctionAccessResult, request.auth.accessible_functions)
     logger.info(
-        "[programs-list] user_id=%s filter=%s accessible_functions=%s",
+        "[programs-list] user_id=%s filter=%s provider=%s accessible_functions=%s",
         user.id,
         type_filter,
+        provider,
         accessible_functions,
     )
 
-    functions = ListFunctionsUseCase().execute(user, accessible_functions, type_filter)
-    logger.info("[programs-list] user_id=%s filter=%s | Functions listed ok", user.id, type_filter)
+    functions = ListFunctionsUseCase().execute(user, accessible_functions, type_filter, provider)
+    logger.info(
+        "[programs-list] user_id=%s filter=%s provider=%s | Functions listed ok",
+        user.id,
+        type_filter,
+        provider,
+    )
     return Response(OutputSerializer(functions, many=True).data)

gateway/requirements-dev.txt

@@ -9,6 +9,6 @@ requests-mock>=1.12.1
 coverage>=7.16.0
 pytest-cov>=7.1.0
 responses>=0.26.3
-tox>=4.61.1
+tox>=4.61.2
 pre-commit>=4.6.2
-import-linter>=2.14
+import-linter>=2.15

gateway/requirements.txt

@@ -25,12 +25,12 @@ django-cors-headers>=4.9.0, <5
 whitenoise>=6.12.0, <7
 objsize>=0.8.0, <1
 psutil>=7.2.2, <8
-ibm-platform-services>=0.77.0, <1
+ibm-platform-services>=0.77.1, <1
 python-magic>=0.4.27, <1
 python-json-logger>=4.2.0
 PyJWT>=2.13.0, <3
 ibm-cos-sdk>=2.16.2, <3
-ibm-cloud-sdk-core>=3.26.0, <4
+ibm-cloud-sdk-core>=3.26.1, <4
 jsonschema>=4.26.0,<5
 confluent-kafka>=2.15.0,<3
 mozilla-django-oidc>=5.0.2, <6

gateway/tests/api/test_v1_program.py

@@ -330,6 +330,38 @@ def test_provider_programs_serverless_list(self):
         assert len(programs_response.data) == 1
         assert programs_response.data[0].get("title") == "Program"
 
+    def test_provider_programs_filtered_by_provider(self):
+        """Tests the provider query param narrows the catalog list to one provider."""
+
+        user = TestUtils.authorize_client(user="test_user_4", client=self.client)
+        TestUtils.get_or_create_group(group="runner", permissions=[self.runner_permission])
+        TestUtils.add_user_to_group(user=user, group="runner")
+
+        # Two accessible provider functions under different providers.
+        TestUtils.create_program(
+            program_title="Ibm-Program",
+            author="test_user_3",
+            provider="ibm",
+            instances=["runner"],
+        )
+        TestUtils.create_program(
+            program_title="QCtrl-Program",
+            author="test_user_3",
+            provider="q-ctrl",
+            instances=["runner"],
+        )
+
+        programs_response = self.client.get(
+            reverse("v1:programs-list"),
+            {"filter": "catalog", "provider": "q-ctrl"},
+            format="json",
+        )
+
+        assert programs_response.status_code == status.HTTP_200_OK
+        assert len(programs_response.data) == 1
+        assert programs_response.data[0].get("title") == "QCtrl-Program"
+        assert programs_response.data[0].get("provider") == "q-ctrl"
+
     def test_run(self):
         """Tests run existing authorized."""
 

gateway/tests/api/use_cases/programs/test_list.py

@@ -4,7 +4,9 @@
 from django.contrib.auth.models import User
 
 from api.use_cases.programs.list import ListFunctionsUseCase
+from core.domain.authorization.function_access_entry import FunctionAccessEntry
 from core.domain.authorization.function_access_result import FunctionAccessResult
+from core.domain.business_models import BusinessModel
 from core.models import Program, Provider, PLATFORM_PERMISSION_READ
 from tests.utils import create_function_access_result
 
@@ -71,3 +73,39 @@ def test_empty_list_when_no_functions_exist(self, user):
         result = ListFunctionsUseCase().execute(user, accessible, None)
 
         assert result == []
+
+    def test_provider_filter_narrows_catalog_to_that_provider(self, user):
+        provider_a = Provider.objects.create(name="provider-a")
+        provider_b = Provider.objects.create(name="provider-b")
+        Program.objects.create(title="fn-a", author=user, provider=provider_a)
+        Program.objects.create(title="fn-b", author=user, provider=provider_b)
+        accessible = FunctionAccessResult(
+            use_legacy_authorization=False,
+            functions=[
+                FunctionAccessEntry(
+                    provider_name="provider-a",
+                    function_title="fn-a",
+                    business_model=BusinessModel.SUBSIDIZED,
+                    permissions={PLATFORM_PERMISSION_READ},
+                ),
+                FunctionAccessEntry(
+                    provider_name="provider-b",
+                    function_title="fn-b",
+                    business_model=BusinessModel.SUBSIDIZED,
+                    permissions={PLATFORM_PERMISSION_READ},
+                ),
+            ],
+        )
+
+        result = ListFunctionsUseCase().execute(user, accessible, "catalog", provider="provider-a")
+
+        assert [f.title for f in result] == ["fn-a"]
+
+    def test_provider_filter_does_not_bypass_permissions(self, user, provider):
+        # The function exists under the provider, but the user has no access to it.
+        Program.objects.create(title="provider-fn", author=user, provider=provider)
+        accessible = FunctionAccessResult(use_legacy_authorization=False, functions=[])
+
+        result = ListFunctionsUseCase().execute(user, accessible, "catalog", provider="my-provider")
+
+        assert result == []