test(webui): exercise scan_outputs callback at the data-consumption point

Lift scan_outputs out of the build_ui closure so the Output Explorer
callback is directly testable, and add callback-level tests that call it
with traversal args (denied, returns []) and a valid in-tree output area
(digested, reads config.yaml). This replaces the prior approximation
tests that only re-checked relative_to() in isolation.

Author: WODE25500

skillopt_webui/app.py

@@ -46,6 +46,58 @@ def load_config(path: str) -> dict:
         return yaml.safe_load(f)
 
 
+def scan_outputs(out_dir: str) -> list:
+    """Digest experiment results strictly under PROJECT_ROOT.
+
+    The Output Explorer callback. Any path that escapes PROJECT_ROOT is
+    rejected (empty result) at the point data is read, so a traversal arg
+    can never read files outside the project.
+    """
+    rows = []
+    if not out_dir:
+        return rows
+    base = (PROJECT_ROOT / out_dir).resolve()
+    project_resolved = PROJECT_ROOT.resolve()
+    try:
+        base.relative_to(project_resolved)
+    except ValueError:
+        return rows
+    if not base.exists() or not base.is_dir():
+        return rows
+    for bench_dir in sorted(base.iterdir()):
+        if not bench_dir.is_dir():
+            continue
+        for run_dir in sorted(bench_dir.iterdir()):
+            if not run_dir.is_dir():
+                continue
+            cfg_file = run_dir / "config.yaml"
+            score = "—"
+            steps = "—"
+            if cfg_file.exists():
+                try:
+                    c = yaml.safe_load(cfg_file.read_text())
+                    steps = str(c.get("train", {}).get("num_steps", "—"))
+                except Exception:
+                    pass
+            # Try to find best score from logs
+            for log_f in run_dir.glob("**/*.jsonl"):
+                try:
+                    with open(log_f) as f:
+                        for line in f:
+                            d = json.loads(line)
+                            if "score" in d:
+                                score = f"{d['score']:.4f}"
+                except Exception:
+                    pass
+            rows.append([
+                run_dir.name,
+                bench_dir.name,
+                score,
+                steps,
+            ])
+    return rows
+
+
 def config_to_display(cfg: dict) -> str:
     """Pretty-print config for display."""
     return yaml.dump(cfg, default_flow_style=False, sort_keys=False)
@@ -602,51 +654,6 @@ def on_refresh():
                     label="Experiments",
                 )
 
-                def scan_outputs(out_dir):
-                    rows = []
-                    if not out_dir:
-                        return rows
-                    base = (PROJECT_ROOT / out_dir).resolve()
-                    project_resolved = PROJECT_ROOT.resolve()
-                    try:
-                        base.relative_to(project_resolved)
-                    except ValueError:
-                        return rows
-                    if not base.exists() or not base.is_dir():
-                        return rows
-                    for bench_dir in sorted(base.iterdir()):
-                        if not bench_dir.is_dir():
-                            continue
-                        for run_dir in sorted(bench_dir.iterdir()):
-                            if not run_dir.is_dir():
-                                continue
-                            cfg_file = run_dir / "config.yaml"
-                            score = "—"
-                            steps = "—"
-                            if cfg_file.exists():
-                                try:
-                                    c = yaml.safe_load(cfg_file.read_text())
-                                    steps = str(c.get("train", {}).get("num_steps", "—"))
-                                except Exception:
-                                    pass
-                            # Try to find best score from logs
-                            for log_f in run_dir.glob("**/*.jsonl"):
-                                try:
-                                    with open(log_f) as f:
-                                        for line in f:
-                                            d = json.loads(line)
-                                            if "score" in d:
-                                                score = f"{d['score']:.4f}"
-                                except Exception:
-                                    pass
-                            rows.append([
-                                run_dir.name,
-                                bench_dir.name,
-                                score,
-                                steps,
-                            ])
-                    return rows
-
                 scan_btn.click(scan_outputs, output_dir, results_table)
 
     return app

tests/test_webui_security.py

@@ -123,40 +123,35 @@ def test_main_no_auth_by_default(webui, monkeypatch):
 
 
 def test_scan_outputs_rejects_path_traversal(webui, tmp_path, monkeypatch):
-    """scan_outputs must not enumerate directories outside PROJECT_ROOT."""
-    webui_mod = webui
-    monkeypatch.setattr(webui_mod, "PROJECT_ROOT", tmp_path)
+    """The scan_outputs callback must not enumerate directories outside PROJECT_ROOT."""
+    monkeypatch.setattr(webui, "PROJECT_ROOT", tmp_path)
     (tmp_path / "outputs").mkdir()
-
-    outside = tmp_path / "outputs"
-    result = webui_mod.build_ui.__wrapped__ if hasattr(webui_mod.build_ui, "__wrapped__") else None
-
-    from pathlib import Path
-    base = (tmp_path / "outputs" / "../../etc").resolve()
-    project_resolved = tmp_path.resolve()
-    try:
-        base.relative_to(project_resolved)
-        escaped = False
-    except ValueError:
-        escaped = True
-    assert escaped, "Path traversal via Output Explorer must be blocked"
+    # Every traversal / escape form is denied at consumption: no rows, no reads.
+    for bad in ("/../../etc/passwd", "../outside", "outputs/../../../etc", "C:\\Windows"):
+        assert webui.scan_outputs(bad) == [], f"traversal {bad!r} must be denied"
 
 
 def test_scan_outputs_allows_valid_subdir(webui, tmp_path, monkeypatch):
     """scan_outputs must accept directories within PROJECT_ROOT."""
-    from pathlib import Path
-    project = tmp_path
-    monkeypatch.setattr(webui, "PROJECT_ROOT", project)
-    (project / "outputs" / "bench1" / "run1").mkdir(parents=True)
-
-    base = (project / "outputs").resolve()
-    project_resolved = project.resolve()
-    try:
-        base.relative_to(project_resolved)
-        contained = True
-    except ValueError:
-        contained = False
-    assert contained, "Valid subdirectory must pass containment check"
+    monkeypatch.setattr(webui, "PROJECT_ROOT", tmp_path)
+    (tmp_path / "outputs" / "bench1" / "run1").mkdir(parents=True)
+    (tmp_path / "outputs" / "bench1" / "run1" / "config.yaml").write_text("a: 1\n", encoding="utf-8")
+    rows = webui.scan_outputs("outputs")
+    assert rows, "valid in-tree output area must be digested"
+
+
+def test_scan_outputs_callback_consumes_within_project(webui, tmp_path, monkeypatch):
+    """The registered scan_outputs callback must digest data only inside PROJECT_ROOT
+    at the point data is actually read (traversal denied, in-tree consumed)."""
+    monkeypatch.setattr(webui, "PROJECT_ROOT", tmp_path)
+    # A traversal arg must be denied at consumption: no rows, no data read.
+    assert webui.scan_outputs("/../../etc/passwd") == []
+    assert webui.scan_outputs("../outside") == []
+    # A valid in-tree output area is digested (config.yaml read per run dir).
+    (tmp_path / "outputs/bench1/run1").mkdir(parents=True)
+    (tmp_path / "outputs/bench1/run1/config.yaml").write_text("alpha: 1\n", encoding="utf-8")
+    rows = webui.scan_outputs("outputs")
+    assert rows, f"expected rows from a valid in-tree output area, got {rows!r}"
 
 
 def test_main_rejects_incomplete_cli_auth_user_only(webui, monkeypatch):