Merge pull request #165 from parente/remove-kg-envs

Remove KG_AUTH_TOKEN from kernel env

Dockerfile.dev

@@ -7,3 +7,7 @@ RUN pip install nose traitlets==4.2.0
 # Setup a sphinx environment for doc building
 COPY docs/environment.yml /tmp
 RUN conda env create -f /tmp/environment.yml
+
+# Add to the python2 environment for testing
+RUN bash -c 'source activate python2 && \
+    conda install -y requests nose'

Makefile

@@ -62,7 +62,7 @@ sdist: ## Build a dist/*.tar.gz source distribution
 
 test: test-python3 ## Run tests on Python 3 in a docker container
 
-test-python2: PRE_CMD:=source activate python2; pip install requests;
+test-python2: PRE_CMD:=source activate python2;
 test-python2: _test ## Run tests on Python 2 in a docker container
 
 test-python3: _test

docs/environment.yml

@@ -1,6 +1,7 @@
 name: kernel_gateway_docs
 dependencies:
 - sphinx_rtd_theme
+- pyzmq
 - pip:
     - sphinx>=1.3.6
     - recommonmark

kernel_gateway/services/kernels/manager.py

@@ -97,10 +97,16 @@ def start_kernel(self, *args, **kwargs):
         raise gen.Return(kernel_id)
 
 class KernelGatewayIOLoopKernelManager(IOLoopKernelManager):
-    """Extends the IOLoopKernelManager used by the SeedingMappingKernelManager
-    to include the environment variable 'KERNEL_GATEWAY' set to '1', indicating
-    that the notebook is executing within a Jupyter Kernel Gateway
+    """Extends the IOLoopKernelManager used by the SeedingMappingKernelManager.
+    
+    Sets the environment variable 'KERNEL_GATEWAY' to '1' to indicate that the
+    kernel is executing within a Jupyter Kernel Gateway instance. Removes the
+    KG_AUTH_TOKEN from the environment variables passed to the kernel when it 
+    starts.
     """
     def _launch_kernel(self, kernel_cmd, **kw):
-        kw['env']['KERNEL_GATEWAY'] = '1'
+        env = kw['env']
+        env['KERNEL_GATEWAY'] = '1'
+        if 'KG_AUTH_TOKEN' in env:
+            del env['KG_AUTH_TOKEN']
         return super(KernelGatewayIOLoopKernelManager, self)._launch_kernel(kernel_cmd, **kw)

kernel_gateway/tests/test_jupyter_websocket.py

@@ -51,6 +51,50 @@ def spawn_kernel(self, kernel_body='{}'):
 
         ws = yield websocket_connect(ws_url)
         raise Return(ws)
+
+    def execute_request(self, code):
+        """Creates an execute_request message.
+        
+        Parameters
+        ----------
+        code : str
+            Code to execute
+        
+        Returns
+        -------
+        dict
+            The message
+        """
+        return {
+            'header': {
+                'username': '',
+                'version': '5.0',
+                'session': '',
+                'msg_id': 'fake-msg-id',
+                'msg_type': 'execute_request'
+            },
+            'parent_header': {},
+            'channel': 'shell',
+            'content': {
+                'code': code,
+                'silent': False,
+                'store_history': False,
+                'user_expressions' : {}
+            },
+            'metadata': {},
+            'buffers': {}
+        }
+
+    @coroutine
+    def await_stream(self, ws):
+        """Returns stream output associated with an execute_request."""
+        while 1:
+            msg = yield ws.read_message()
+            msg = json_decode(msg)
+            msg_type = msg['msg_type']
+            parent_msg_id = msg['parent_header']['msg_id']
+            if msg_type == 'stream' and parent_msg_id == 'fake-msg-id':
+                raise Return(msg['content'])
 
 class TestDefaults(TestJupyterWebsocket):
     """Tests gateway behavior."""
@@ -459,43 +503,16 @@ def test_kernel_env(self):
             }
         })
         ws = yield self.spawn_kernel(kernel_body)
-
-        ws.write_message(json_encode({
-            'header': {
-                'username': '',
-                'version': '5.0',
-                'session': '',
-                'msg_id': 'fake-msg-id',
-                'msg_type': 'execute_request'
-            },
-            'parent_header': {},
-            'channel': 'shell',
-            'content': {
-                'code': 'import os; print(os.getenv("KERNEL_FOO"), os.getenv("NOT_KERNEL"), os.getenv("KERNEL_GATEWAY"))',
-                'silent': False,
-                'store_history': False,
-                'user_expressions' : {}
-            },
-            'metadata': {},
-            'buffers': {}
-        }))
-
-        # Read messages until we see the output from the print or hit the
-        # test timeout
-        while 1:
-            msg = yield ws.read_message()
-            msg = json_decode(msg)
-            msg_type = msg['msg_type']
-            parent_msg_id = msg['parent_header']['msg_id']
-            if msg_type == 'stream' and parent_msg_id == 'fake-msg-id':
-                content = msg['content']
-                self.assertEqual(content['name'], 'stdout')
-                self.assertIn('kernel-foo-value', content['text'])
-                self.assertNotIn('ignored', content['text'])
-                self.assertNotIn('overridden', content['text'])
-                break
+        req = self.execute_request('import os; print(os.getenv("KERNEL_FOO"), os.getenv("NOT_KERNEL"), os.getenv("KERNEL_GATEWAY"))')
+        ws.write_message(json_encode(req))
+        content = yield self.await_stream(ws)
+        self.assertEqual(content['name'], 'stdout')
+        self.assertIn('kernel-foo-value', content['text'])
+        self.assertNotIn('ignored', content['text'])
+        self.assertNotIn('overridden', content['text'])
 
         ws.close()
+
     @gen_test
     def test_get_swagger_yaml_spec(self):
         """Getting the swagger.yaml spec should be ok"""
@@ -508,6 +525,21 @@ def test_get_swagger_json_spec(self):
         response = yield self.http_client.fetch(self.get_url('/api/swagger.json'))
         self.assertEqual(response.code, 200)
 
+    @gen_test
+    def test_kernel_env_auth_token(self):
+        """Kernel should not have KG_AUTH_TOKEN in its environment."""
+        os.environ['KG_AUTH_TOKEN'] = 'fake-secret'
+
+        try:
+            ws = yield self.spawn_kernel()
+            req = self.execute_request('import os; print(os.getenv("KG_AUTH_TOKEN"))')
+            ws.write_message(json_encode(req))
+            content = yield self.await_stream(ws)
+            self.assertNotIn('fake-secret', content['text'])
+        finally:
+            del os.environ['KG_AUTH_TOKEN']
+            ws.close()
+
 class TestCustomDefaultKernel(TestJupyterWebsocket):
     """Tests gateway behavior when setting a custom default kernelspec."""
     def setup_app(self):
@@ -646,38 +678,11 @@ def test_seed(self):
 
         # Print the encoded "zen of python" string, the kernel should have
         # it imported
-        ws.write_message(json_encode({
-            'header': {
-                'username': '',
-                'version': '5.0',
-                'session': '',
-                'msg_id': 'fake-msg-id',
-                'msg_type': 'execute_request'
-            },
-            'parent_header': {},
-            'channel': 'shell',
-            'content': {
-                'code': 'print(this.s)',
-                'silent': False,
-                'store_history': False,
-                'user_expressions' : {}
-            },
-            'metadata': {},
-            'buffers': {}
-        }))
-
-        # Read messages until we see the output from the print or hit the
-        # test timeout
-        while 1:
-            msg = yield ws.read_message()
-            msg = json_decode(msg)
-            msg_type = msg['msg_type']
-            parent_msg_id = msg['parent_header']['msg_id']
-            if msg_type == 'stream' and parent_msg_id == 'fake-msg-id':
-                content = msg['content']
-                self.assertEqual(content['name'], 'stdout')
-                self.assertIn('Gur Mra bs Clguba', content['text'])
-                break
+        req = self.execute_request('print(this.s)')
+        ws.write_message(json_encode(req))
+        content = yield self.await_stream(ws)
+        self.assertEqual(content['name'], 'stdout')
+        self.assertIn('Gur Mra bs Clguba', content['text'])
 
         ws.close()
 
@@ -762,38 +767,11 @@ def test_seed_language_support(self):
 
         # Print the encoded "zen of python" string, the kernel should have
         # it imported
-        ws.write_message(json_encode({
-            'header': {
-                'username': '',
-                'version': '5.0',
-                'session': '',
-                'msg_id': 'fake-msg-id',
-                'msg_type': 'execute_request'
-            },
-            'parent_header': {},
-            'channel': 'shell',
-            'content': {
-                'code': code,
-                'silent': False,
-                'store_history': False,
-                'user_expressions' : {}
-            },
-            'metadata': {},
-            'buffers': {}
-        }))
-
-        # Read messages until we see the output from the print or hit the
-        # test timeout
-        while 1:
-            msg = yield ws.read_message()
-            msg = json_decode(msg)
-            msg_type = msg['msg_type']
-            parent_msg_id = msg['parent_header']['msg_id']
-            if msg_type == 'stream' and parent_msg_id == 'fake-msg-id':
-                content = msg['content']
-                self.assertEqual(content['name'], 'stdout')
-                self.assertIn('Gur Mra bs Clguba', content['text'])
-                break
+        req = self.execute_request(code)
+        ws.write_message(json_encode(req))
+        content = yield self.await_stream(ws)
+        self.assertEqual(content['name'], 'stdout')
+        self.assertIn('Gur Mra bs Clguba', content['text'])
 
         ws.close()
 
@@ -809,25 +787,9 @@ def test_api_lists_kernels_with_flag_set(self):
         one client connected to it.
         """
         ws = yield self.spawn_kernel()
-        ws.write_message(json_encode({
-            'header': {
-                'username': '',
-                'version': '5.0',
-                'session': '',
-                'msg_id': 'fake-msg-id',
-                'msg_type': 'execute_request'
-            },
-            'parent_header': {},
-            'channel': 'shell',
-            'content': {
-                'code': 'import time\ntime.sleep(1)',
-                'silent': False,
-                'store_history': False,
-                'user_expressions' : {}
-            },
-            'metadata': {},
-            'buffers': {}
-        }))
+        req = self.execute_request('import time\ntime.sleep(1)')
+        ws.write_message(json_encode(req))
+
         # Get the first set of activities
         response = yield self.http_client.fetch(
             self.get_url('/_api/activity'),