[GSK-1623] Secure Giskard readonly demo space at Hugging Face Spaces

[Inokinoki]

Description

Preventing any requests with modifications (POST, PUT, DELETE) when giskardai/giskard detected.

Preventing Create, Update, Delete operations in DB after initialization.

Related Issue

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Checklist

• I've read the CODE_OF_CONDUCT.md document.
• I've read the CONTRIBUTING.md guide.
• I've updated the code style using make codestyle.
• I've written tests for all new methods and classes that I created.
• I've written the docstring in Google format for all the methods and classes that I used.

[linear]

GSK-1623 Secure the demo space

Avoid uploading new projects

[andreybavt]

since we're sending some POST requests like predict or explain we can't actually block on HTTP method level.

Instead I suggest we do it on a DB level (more precisely at JPA).

for example, if you define a class like

import jakarta.persistence.PrePersist;
import jakarta.persistence.PreRemove;
import jakarta.persistence.PreUpdate;


public class ReadOnlyListener {
    private boolean isReadOnlyGiskardInstance() {
        // TODO: implement this, probably in another class
        return true;
    }

    @PrePersist
    @PreUpdate
    @PreRemove
    void onCUD(Object o) {
        if (isReadOnlyGiskardInstance()) {
            throw new IllegalStateException("This is a read-only Giskard instance. You cannot modify entities.");
        }
    }
}

Then you'll be able to use it at an @Entity level:

@Entity(name = "api_keys")
@Getter
@NoArgsConstructor
@EntityListeners(ReadOnlyListener.class)
public class ApiKey extends AbstractAuditingEntity

In this case we could even allow some modifications but not others, like writing TestSuiteExecution (I think we could also have a scheduled method to delete old executions on demo instance so that the DB doesn't get polluted to much)

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
5 Code Smells

33.3% Coverage
0.0% Duplication

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
1 Code Smell

0.0% Coverage
0.0% Duplication

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
1 Code Smell

0.0% Coverage
0.0% Duplication