revert: remove Go function (runtime compilation timeout)

console/deploy/console.yaml

@@ -46,7 +46,7 @@ spec:
       serviceAccountName: fission-console
       containers:
         - name: console
-          image: naeel/fission-console:v0.3.1
+          image: naeel/fission-console:v0.3.4
           ports:
             - containerPort: 8090
           env:

console/main.go

@@ -6,9 +6,11 @@ import (
 	"context"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
+	"net"
 	"net/http"
 	"os"
 	"sort"
@@ -39,11 +41,12 @@ var (
 const defaultSATokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
 
 type server struct {
-	dyn         dynamic.Interface
-	ns          string
-	routerURL   string
-	http        *http.Client
-	saTokenPath string
+	dyn           dynamic.Interface
+	ns            string
+	routerURL     string
+	http          *http.Client
+	saTokenPath   string
+	invokeTimeout time.Duration
 
 	authUser string
 	authPass string
@@ -71,6 +74,8 @@ func main() {
 	namespace := envDefault("FISSION_NAMESPACE", "default")
 	routerURL := strings.TrimRight(envDefault("FISSION_ROUTER_URL", "http://router.fission.svc.cluster.local"), "/")
 	port := envDefault("PORT", "8090")
+	httpTimeout := envDurationDefault("FISSION_HTTP_TIMEOUT", 30*time.Second)
+	invokeTimeout := envDurationDefault("FISSION_INVOKE_TIMEOUT", 20*time.Second)
 
 	cfg, err := buildConfig(kubeconfig)
 	if err != nil {
@@ -87,13 +92,14 @@ func main() {
 	saTokenPath := envDefault("SA_TOKEN_PATH", defaultSATokenPath)
 
 	s := &server{
-		dyn:         dyn,
-		ns:          namespace,
-		routerURL:   routerURL,
-		http:        &http.Client{Timeout: 30 * time.Second},
-		saTokenPath: saTokenPath,
-		authUser:    authUser,
-		authPass:    authPass,
+		dyn:           dyn,
+		ns:            namespace,
+		routerURL:     routerURL,
+		http:          &http.Client{Timeout: httpTimeout},
+		saTokenPath:   saTokenPath,
+		invokeTimeout: invokeTimeout,
+		authUser:      authUser,
+		authPass:      authPass,
 	}
 
 	mux := http.NewServeMux()
@@ -126,7 +132,7 @@ func main() {
 
 	httpServer := &http.Server{
 		Addr:              ":" + port,
-		Handler:           withCORS(logRequests(mux)),
+		Handler:           withSecurityHeaders(withCORS(logRequests(mux))),
 		ReadHeaderTimeout: 10 * time.Second,
 	}
 
@@ -341,12 +347,7 @@ func (s *server) handleGetFunction(w http.ResponseWriter, r *http.Request, name
 	if packageName != "" {
 		pkg, pkgErr := s.dyn.Resource(packageGVR).Namespace(s.ns).Get(ctx, packageName, metav1.GetOptions{})
 		if pkgErr == nil {
-			literal, _, _ := unstructured.NestedString(pkg.Object, "spec", "deployment", "literal")
-			if literal != "" {
-				if decodedCode, decErr := decodeLiteralToSource(literal); decErr == nil {
-					code = decodedCode
-				}
-			}
+			code = s.extractPackageSourceCode(ctx, pkg)
 		}
 	}
 
@@ -459,7 +460,12 @@ func (s *server) handleInvokeFunction(w http.ResponseWriter, r *http.Request, na
 		bodyBytes = []byte("{}")
 	}
 
-	ctx, cancel := context.WithTimeout(r.Context(), 25*time.Second)
+	invokeTimeout := s.invokeTimeout
+	if invokeTimeout <= 0 {
+		invokeTimeout = 20 * time.Second
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), invokeTimeout)
 	defer cancel()
 
 	invokeURL := fmt.Sprintf("%s/fission-function/v2/functions/%s", s.routerURL, name)
@@ -516,6 +522,15 @@ func (s *server) handleInvokeFunction(w http.ResponseWriter, r *http.Request, na
 
 	resp, err := s.http.Do(req)
 	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) {
+			writeJSONError(w, http.StatusBadGateway, fmt.Sprintf("invoke %q timeout after %s: function specialization likely failed (for example, syntax error)", name, invokeTimeout))
+			return
+		}
+		var netErr net.Error
+		if errors.As(err, &netErr) && netErr.Timeout() {
+			writeJSONError(w, http.StatusBadGateway, fmt.Sprintf("invoke %q timeout after %s: function specialization likely failed (for example, syntax error)", name, invokeTimeout))
+			return
+		}
 		writeJSONError(w, http.StatusBadGateway, fmt.Sprintf("invoke %q: %v", name, err))
 		return
 	}
@@ -694,6 +709,17 @@ func withCORS(next http.Handler) http.Handler {
 	})
 }
 
+func withSecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+		w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content")
+		next.ServeHTTP(w, r)
+	})
+}
+
 func envDefault(key, fallback string) string {
 	if v := strings.TrimSpace(os.Getenv(key)); v != "" {
 		return v
@@ -701,6 +727,19 @@ func envDefault(key, fallback string) string {
 	return fallback
 }
 
+func envDurationDefault(key string, fallback time.Duration) time.Duration {
+	raw := strings.TrimSpace(os.Getenv(key))
+	if raw == "" {
+		return fallback
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil || d <= 0 {
+		log.Printf("invalid duration for %s=%q, using default %s", key, raw, fallback)
+		return fallback
+	}
+	return d
+}
+
 func normalizeMethods(in []string) []string {
 	if len(in) == 0 {
 		return []string{"GET"}
@@ -721,12 +760,78 @@ func normalizeMethods(in []string) []string {
 	return out
 }
 
+func (s *server) extractPackageSourceCode(ctx context.Context, pkg *unstructured.Unstructured) string {
+	literalPaths := [][]string{
+		{"spec", "source", "literal"},
+		{"spec", "deployment", "literal"},
+	}
+	for _, p := range literalPaths {
+		literal, found, _ := unstructured.NestedString(pkg.Object, p...)
+		if !found || strings.TrimSpace(literal) == "" {
+			continue
+		}
+		if decodedCode, decErr := decodeLiteralToSource(literal); decErr == nil && strings.TrimSpace(decodedCode) != "" {
+			return decodedCode
+		}
+	}
+
+	urlPaths := [][]string{
+		{"spec", "source", "url"},
+		{"spec", "deployment", "url"},
+	}
+	for _, p := range urlPaths {
+		urlValue, found, _ := unstructured.NestedString(pkg.Object, p...)
+		if !found || strings.TrimSpace(urlValue) == "" {
+			continue
+		}
+
+		archiveBytes, fetchErr := s.fetchPackageArchive(ctx, urlValue)
+		if fetchErr != nil {
+			continue
+		}
+
+		decodedCode, decErr := decodeArchiveBytesToSource(archiveBytes)
+		if decErr == nil && strings.TrimSpace(decodedCode) != "" {
+			return decodedCode
+		}
+	}
+
+	return ""
+}
+
+func (s *server) fetchPackageArchive(ctx context.Context, archiveURL string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, archiveURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := s.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("archive request failed: %s", resp.Status)
+	}
+
+	return io.ReadAll(resp.Body)
+}
+
 func decodeLiteralToSource(literal string) (string, error) {
 	decoded, err := base64.StdEncoding.DecodeString(literal)
 	if err != nil {
 		return "", err
 	}
 
+	return decodeArchiveBytesToSource(decoded)
+}
+
+func decodeArchiveBytesToSource(decoded []byte) (string, error) {
+	if len(decoded) == 0 {
+		return "", fmt.Errorf("empty payload")
+	}
+
 	if utf8.Valid(decoded) {
 		return string(decoded), nil
 	}
@@ -737,7 +842,7 @@ func decodeLiteralToSource(literal string) (string, error) {
 		}
 	}
 
-	return string(decoded), nil
+	return "", fmt.Errorf("payload does not contain utf-8 source")
 }
 
 func decodeZipSource(zipBytes []byte) (string, error) {

console/main_test.go

@@ -142,6 +142,77 @@ func TestUpdateFunctionCode(t *testing.T) {
 	}
 }
 
+func TestGetFunctionUsesSourceLiteralWhenDeploymentLiteralMissing(t *testing.T) {
+	env := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "fission.io/v1",
+		"kind":       "Environment",
+		"metadata":   map[string]any{"name": "go-acc", "namespace": "default"},
+	}}
+
+	s := newTestServer(env)
+
+	pkg := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "fission.io/v1",
+		"kind":       "Package",
+		"metadata": map[string]any{
+			"name":      "fn-go-acc-pkg",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"source": map[string]any{
+				"literal": base64.StdEncoding.EncodeToString([]byte("package main\n\nfunc Handler() {}\n")),
+			},
+			"deployment": map[string]any{
+				"type": "url",
+				"url":  "http://storagesvc.fission/v1/archive?id=dummy",
+			},
+		},
+	}}
+
+	fn := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "fission.io/v1",
+		"kind":       "Function",
+		"metadata": map[string]any{
+			"name":      "fn-go-acc",
+			"namespace": "default",
+		},
+		"spec": map[string]any{
+			"environment": map[string]any{"name": "go-acc", "namespace": "default"},
+			"package": map[string]any{
+				"functionName": "Handler",
+				"packageref": map[string]any{
+					"name":      "fn-go-acc-pkg",
+					"namespace": "default",
+				},
+			},
+		},
+	}}
+
+	if _, err := s.dyn.Resource(packageGVR).Namespace("default").Create(context.Background(), pkg, metav1.CreateOptions{}); err != nil {
+		t.Fatalf("create package: %v", err)
+	}
+	if _, err := s.dyn.Resource(functionGVR).Namespace("default").Create(context.Background(), fn, metav1.CreateOptions{}); err != nil {
+		t.Fatalf("create function: %v", err)
+	}
+
+	getReq := httptest.NewRequest(http.MethodGet, "/api/functions/fn-go-acc", nil)
+	getRec := httptest.NewRecorder()
+	s.handleGetFunction(getRec, getReq, "fn-go-acc")
+	if getRec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", getRec.Code, getRec.Body.String())
+	}
+
+	var out map[string]any
+	if err := json.Unmarshal(getRec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("decode get response: %v", err)
+	}
+
+	code, _ := out["code"].(string)
+	if !strings.Contains(code, "func Handler") {
+		t.Fatalf("expected source code from spec.source.literal, got %q", code)
+	}
+}
+
 func TestInvokeFunctionWithJWTAuth(t *testing.T) {
 	// Mock router: /auth/login returns JWT, /inv-fn returns hello
 	var gotAuth string

console/ui/index.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>NUBES Fission Console</title>
-  <link rel="icon" type="image/png" href="https://nubes.ru/themes/custom/nubes_2025/favicon.png">
+  <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAACXBIWXMAAA7DAAAOwwHHb6hkAAAAGXRFWHRTb2Z0d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAAA4ZJREFUeJztm8+Lm0UYxz/fySZUoWIrVtbmXfyBP05Fa3e3rogsglJRK0p7E2svnrz6B3gQ8eRJFooXET14KKJ4FUQo3UQQ9CRC6W4WQW0VXZduTd7HQ9c22bzbTCY/ZpO8n0syb56Z+c437zPvhMzIzJhkXGwBsckNiC0gNrkBsQXEZsonSJLj4GNPgb2ACo9j9gDOvrSV6qkB6+sJ6WSJ5MIxUo4h5sDuI9U7tlZ57/+YTAN0zyOPUi+9jOxJxMOUj9wJOBBg117QvqGMwhNpcQ/J+rOkPIc0j+xeytyGsaWXa2+kvc312gxQMleHYgFtrQ9GYJmgmSfup3z15xuDNW/dGXOAjd680NgshlYdvcH2mfEwQIU0tOp4GNADuQGxBcRmPAyQgh/W42FAD+QGxBYQm/EwIF8HhJMbEFtAX3DreQqEkhsQW0BsxsMAlz8Gg8kNiC0gNuNhgJvK54BQcgNiC+gLhUlPgcuTbkAP5AbEFhCbcAOM4LyLitIW3eEGyP7qWUwMHFdaixNO1v4Av5pG8H/yfWfvesk7tq5GczHDAHnmtu727nTQbJYe8o51+qOl2BYgNv1a0iHvTgeNGq94x6buYnOx3YCU3/1asn06ePQZ744HiXTCO3a6/m1zsd0Ax/f+HTc+kU76598AUDL/LpjfjjWxYdXqRvOljDvAfezfO3dQvvCDtLjHu04f0czsaSx9y7uC8eP2S20GWO38Z+A7DwDwIOX135TMvylpKI9VJQv7lcx+hfEhurELsCPOfdDWVtZ5ASWzZ4GXArQ1QJfA/kTW6BhtLgX+7qL9IqTTmKa7GjgAumKry7dsv5q9Vfbfq29QLL1I9wulAtgB4ADmoy9kY4fodugAODuT2dpOJ0aUzH8E6asBXe0+zP5h7bvbzay+/aOdv+Ha8mnE5YEKGxqF17MGDzcxwMzqTBUWgc65vKuxT7cm9kx2TIHrATOzxzHOEpZ5sanYamXuZgEdJzlbqXyOmzrO6N0J56hVj3YK8prl7eK5L6g3DmFc6l3XEDCWbLWyYGYdf9h1TIGWYMmRHDlDaqcY0qKnO/Qr4oStLH/jXSPk4KSShf2ovoTZ80Db4iICv2D2ttWqS91WDDKgpYHy4adR8TWww8BdmN2KrOg5Zwoo+PV0/ThICmyArWHua9D7Vjv/U5j6Phgw6uzCPB4uuQGxBcRm4g34D1IN9ODV8oQpAAAAAElFTkSuQmCC">
   <script>
     if (window.location.protocol !== 'https:' && window.location.hostname !== 'localhost' && window.location.hostname !== '127.0.0.1') {
       window.location.replace('https://' + window.location.host + window.location.pathname + window.location.search + window.location.hash);

examples/auto-funcs/code/ok/main.py

@@ -1,2 +1,2 @@
 def main():
-    return "ok-auto-func-UPDATED-v2"
+    return "ok-auto-func-UPDATED-v3-with-comment"