Skip to content

Resolve analytic functions by registry name or allowed module prefix (ISSUE-169) - #516

Merged
dwolfson merged 1 commit into
odpi:mainfrom
dwolfson:fix/analytic-resolver-allowlist
Oct 31, 2026
Merged

dwolfson merged 1 commit into
odpi:mainfrom
dwolfson:fix/analytic-resolver-allowlist

Conversation

@dwolfson

Copy link
Copy Markdown
Member

format_set_executor._resolve_analytic_function imported whatever module a report spec's analytic_function named. It now resolves names as follows:

  1. A registered name (from analytic_registry) resolves to that entry's function.
  2. A dotted path that a registered entry declares is trusted, as before.
  3. Any other dotted path must sit under an allowed module prefix. The list comes from PYEGERIA_ANALYTIC_MODULE_PREFIXES (comma-separated) and defaults to pyegeria and trellis_analytics. Each prefix is matched as a package boundary, so pyegeria does not admit pyegeria_extras. These resolutions log at DEBUG only.
  4. Anything else raises AnalyticFunctionRefused (a ValueError) before any import happens.

The same check covers action fetch/analytic steps and analytic_binders factories. There is deliberately no deprecation warning yet. Neither egeria-workspaces nor trellis has a spec that names a module outside the default prefixes.

Tests: tests/micro-tests/test_issue_169_analytic_resolver.py covers a registered name, a registered path outside the allowlist, an allowed dotted path (DEBUG only), the package-boundary match, refused paths (no import call, nothing in sys.modules), an unregistered bare name, the env-var override, and binder factories. test_issue_138_140_149_analytic_envelope.py now adds its fake module to the allowlist. All micro-tests pass.

Note: this is one of four related PRs (ISSUE-169..172). Each adds an entry near the top of PYEGERIA_ISSUES.md, so whichever merges later needs a trivial conflict resolution there.

🤖 Generated with Claude Code

https://claude.ai/code/session_015pdMuPkqttD1yKAKJLS9Fc

…(ISSUE-169)

_resolve_analytic_function imported any dotted path a report spec named.
It now resolves a registered name to its entry's function, trusts a
dotted path a registered entry declares, and accepts other dotted paths
only under PYEGERIA_ANALYTIC_MODULE_PREFIXES (default: pyegeria,
trellis_analytics), logging those at DEBUG. Anything else raises
AnalyticFunctionRefused before any import. The same check covers action
fetch/analytic steps and binder factories. No deprecation warning yet.

Claude-Session: https://claude.ai/code/session_015pdMuPkqttD1yKAKJLS9Fc
Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
@dwolfson
dwolfson merged commit 2d56d41 into odpi:main Oct 31, 2026
6 checks passed
dwolfson added a commit that referenced this pull request Oct 31, 2026
ISSUE-168 was released in 6.2.16 (#513) but still read "not merged";
ISSUE-169..172 are merged (#516..#519) and ship in 6.2.17. Their
statuses now say so, the five entries move to Fixed / Resolved, and the
open-items index and at-a-glance count (now 2: ISSUE-155, 150) match.
No entry's content changed beyond its status line.

Claude-Session: https://claude.ai/code/session_015pdMuPkqttD1yKAKJLS9Fc

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant