Support file handler

fps_plugins/voila/fps_voila/routes.py

@@ -1,21 +1,25 @@
-import sys
+import re
 import os
-import uuid
 from pathlib import Path
 from typing import Optional
 
 from voila.handler import _VoilaHandler, _get
 from voila.treehandler import _VoilaTreeHandler, _get as _get_tree
 
 from mimetypes import guess_type
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException
 from fastapi.responses import RedirectResponse, StreamingResponse, HTMLResponse, Response
 from fastapi.staticfiles import StaticFiles
 from fps.hooks import register_router  # type: ignore
 
 from .config import get_voila_config
 
 
+class Config:
+    pass
+
+CONFIG = Config()
+
 class FPSVoilaTreeHandler(_VoilaTreeHandler):
     is_fps = True
 
@@ -40,7 +44,7 @@ def redirect(self, url):
         return RedirectResponse(url)
 
     def get_argument(self, name, default):
-        if self.fps_arguments[name] is None:
+        if self.fps_arguments.get(name) is None:
             return default
         return self.fps_arguments[name]
 
@@ -64,9 +68,16 @@ def init_voila_handler(
     static_paths,
     settings,
     log,
+    whitelist,
+    blacklist,
+    root_dir,
 ):
     global fps_voila_handler, fps_voila_tree_handler
 
+    CONFIG.whitelist = whitelist
+    CONFIG.blacklist = blacklist
+    CONFIG.root_dir = root_dir
+
     fps_voila_handler = FPSVoilaHandler()
     fps_voila_handler.initialize(
         notebook_path=notebook_path,
@@ -125,21 +136,38 @@ async def get_path(name):
 async def get_tree(path):
     return _get_tree(fps_voila_tree_handler, path)
 
+@router.get("/voila/files/{path:path}")
+def get_authorized_file(path):
+    whitelisted = any(re.fullmatch(pattern, path) for pattern in CONFIG.whitelist)
+    blacklisted = any(re.fullmatch(pattern, path) for pattern in CONFIG.blacklist)
+    if not whitelisted:
+        raise HTTPException(status_code=403, detail="File not whitelisted")
+    if blacklisted:
+        raise HTTPException(status_code=403, detail="File blacklisted")
+    return _get_file(path)
+
 @router.get("/voila/static/{path}")
-def get_file1(path):
-    return get_file(path)
+def get_static_file(path):
+    return _get_static_file(path)
 
 @router.get("/voila/templates/lab/static/{path:path}")
-def get_file2(path):
-    return get_file(path)
+def get_template_static_file(path):
+    return _get_static_file(path)
 
-def get_file(path):
+def _get_static_file(path):
     for i, static_path in enumerate(fps_voila_handler.static_paths):
         file_path = Path(static_path) / path
         if os.path.exists(file_path):
-            with open(file_path) as f:
-                content = f.read()
-            content_type, _ = guess_type(file_path)
-            return Response(content, media_type=content_type)
+            return _get_file(file_path)
+    else:
+        raise HTTPException(status_code=404, detail="File not found")
+
+def _get_file(path):
+    if os.path.exists(path):
+        with open(path) as f:
+            content = f.read()
+        content_type, _ = guess_type(path)
+        return Response(content, media_type=content_type)
+    raise HTTPException(status_code=404, detail="File not found")
 
 r = register_router(router)

voila/app.py

@@ -486,6 +486,9 @@ def start(self):
                 self.static_paths,
                 self.tornado_settings,
                 self.log,
+                self.voila_configuration.file_whitelist,
+                self.voila_configuration.file_blacklist,
+                self.root_dir,
             )
             fps_app()
         else:

voila/treehandler.py

@@ -9,6 +9,7 @@
 import os
 
 from tornado import web
+from fastapi import HTTPException
 
 from jupyter_server.base.handlers import JupyterHandler
 from jupyter_server.utils import url_path_join, url_escape
@@ -54,7 +55,10 @@ def allowed_content(content):
             self.log.debug("Redirecting %s to %s", self.request.path, url)
         return self.redirect(url)
     else:
-        raise web.HTTPError(404)
+        if self.is_fps:
+            raise HTTPException(status_code=404, detail=f"{path} not found")
+        else:
+            raise web.HTTPError(404)
 
 
 class _VoilaTreeHandler: