Skip to content

Static graph icons + default icon#12396

Merged
nithyatsu merged 6 commits into
mainfrom
static-graph-icons
Jul 17, 2026
Merged

Static graph icons + default icon#12396
nithyatsu merged 6 commits into
mainfrom
static-graph-icons

Conversation

@nithyatsu

@nithyatsu nithyatsu commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Static (modeled) graph now emits iconHash and a matching icons map from the CLI-embedded manifest — rad app graph app.bicep renders icons with no control plane.

  • Default-icon substitution at registration time: types registered without an SVG get the product default hash stamped on the record

  • Graceful degradation — "icon absence is not an error": broken embedded asset logs and continues, callers set icon Hash to nil.

Note: static graphs can have only default icons for non default types, since we need control plane to register the tyep with an icon. All default.yaml types should render with icons in both static and run time graphs.

Fixes #12339

How to test

Contsruct an app.bicep with RRTs and and built in types and some types of your own.
rad app graph /Users/nithya/radius/my-radius-recipes/deploy/app.bicep should produce app-graph.json that includes icons.

@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

Unit Tests

    2 files  ± 0    456 suites  ±0   7m 12s ⏱️ -14s
5 995 tests +29  5 993 ✅ +29  2 💤 ±0  0 ❌ ±0 
7 198 runs  +29  7 196 ✅ +29  2 💤 ±0  0 ❌ ±0 

Results for commit 23fd4ff. ± Comparison against base commit 8b19616.

This pull request removes 12 and adds 41 tests. Note that renamed tests count towards both.
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_convertGraphResponseWithIcons_AttachesIconHashPerNode
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_convertGraphResponseWithIcons_NilIconsLookup
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/empty_input
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/empty_namespace
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/empty_type_name
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/missing_separator
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/well-formed
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_splitResourceType/well-formed_built-in
github.com/radius-project/radius/pkg/ucp/api/v20231001preview ‑ Test_ResourceType_Icon_VersionedToDataModel/no_icon_leaves_icon_and_hash_unset
…
github.com/radius-project/radius/pkg/cli/graph ‑ TestBuildModeledGraph_IncludeIconsControlsIconsMap
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_attachIconHashes_AttachesIconHashPerNode
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_attachIconHashes_NilIconsLookup
github.com/radius-project/radius/pkg/corerp/frontend/controller/applications/v20250801preview ‑ Test_fetchIcons_IntegrityCheck
github.com/radius-project/radius/pkg/ucp/api/v20231001preview ‑ Test_ResourceType_Icon_VersionedToDataModel/no_icon_substitutes_the_product_default_hash
github.com/radius-project/radius/pkg/ucp/datamodel ‑ TestValidateIcon/SMIL_animateMotion_element
github.com/radius-project/radius/pkg/ucp/datamodel ‑ TestValidateIcon/SMIL_animateTransform_element
github.com/radius-project/radius/pkg/ucp/datamodel ‑ TestValidateIcon/SMIL_animate_element_targeting_url-bearing_attribute
github.com/radius-project/radius/pkg/ucp/datamodel ‑ TestValidateIcon/SMIL_discard_element
github.com/radius-project/radius/pkg/ucp/datamodel ‑ TestValidateIcon/SMIL_set_element_targeting_href
…

♻️ This comment has been updated with latest results.

@codecov

codecov Bot commented Jul 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 28.88889% with 384 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.41%. Comparing base (8b19616) to head (23fd4ff).

Files with missing lines Patch % Lines
...roller/applications/v20250801preview/graph_util.go 7.38% 336 Missing and 15 partials ⚠️
pkg/cli/graph/modeled.go 71.79% 7 Missing and 4 partials ⚠️
...roller/applications/v20250801preview/graphicons.go 79.41% 3 Missing and 4 partials ⚠️
...p/frontend/controller/resourceproviders/geticon.go 76.00% 3 Missing and 3 partials ⚠️
...ntroller/applications/v20250801preview/getgraph.go 54.54% 4 Missing and 1 partial ⚠️
pkg/cli/cmd/app/graph/graph.go 33.33% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #12396      +/-   ##
==========================================
- Coverage   53.70%   53.41%   -0.30%     
==========================================
  Files         761      762       +1     
  Lines       49771    50246     +475     
==========================================
+ Hits        26729    26837     +108     
- Misses      20544    20882     +338     
- Partials     2498     2527      +29     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

Functional Tests - ucp-noncloud

14 tests  ±0   14 ✅ ±0   1m 5s ⏱️ ±0s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 674c461. ± Comparison against base commit 5cdab24.

♻️ This comment has been updated with latest results.

@nithyatsu
nithyatsu force-pushed the static-graph-icons branch from c036089 to 32810da Compare July 14, 2026 18:21
@nithyatsu
nithyatsu marked this pull request as ready for review July 14, 2026 23:37
@nithyatsu
nithyatsu requested review from a team as code owners July 14, 2026 23:37
Copilot AI review requested due to automatic review settings July 14, 2026 23:37

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends the resource-type icon work to support static (modeled) application graphs (no control plane) and ensures every registered resource type gets an iconHash via default-hash substitution when no SVG is supplied. It also wires the default-icon fallback through the icon endpoint and the runtime graph’s icons map so consumers can resolve bytes for defaulted types.

Changes:

  • Add a CLI/control-plane shared deploy/manifest icon catalog (embedded default SVG + embedded per-type SVGs) with helpers to look up icons and default hashes.
  • Default-hash substitution at resource-type registration time (when icon is absent), plus icon-endpoint fallback to serve embedded default bytes when the stored hash matches the default.
  • Modeled graph now emits iconHash per node and (optionally) an icons map via rad app graph <bicep> --include-icons, plus updated tests/docs.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
specs/003-resource-type-icons/plan.md Updates Slice 2 plan/status and documents delivered changes for default icon substitution + static graph icons.
pkg/ucp/integrationtests/resourceproviders/testdata/resourcetype_v20231001preview_responsebody.json Updates integration test fixture to include iconHash in resource type summary response.
pkg/ucp/integrationtests/resourceproviders/testdata/resourcetype_v20231001preview_list_responsebody.json Updates list fixture to include iconHash.
pkg/ucp/integrationtests/resourceproviders/testdata/resourcetype_manifest_responsebody.json Updates manifest fixture to include iconHash.
pkg/ucp/integrationtests/resourceproviders/testdata/resourcetype_manifest_list_responsebody.json Updates manifest list fixture to include iconHash.
pkg/ucp/integrationtests/resourceproviders/summary_test.go Asserts default-hash substitution is reflected in provider summary results.
pkg/ucp/initializer/service.go Substitutes product default icon hash when registering a type without icon bytes (built-in manifest path).
pkg/ucp/initializer/service_test.go Updates tests to assert default-hash substitution behavior.
pkg/ucp/frontend/controller/resourceproviders/getresourceprovidersummary.go Removes FR references from comments; retains includeIcons behavior and hash-only semantics.
pkg/ucp/frontend/controller/resourceproviders/geticon.go Serves embedded default icon bytes when stored hash matches default but stored bytes are nil.
pkg/ucp/frontend/controller/resourceproviders/geticon_test.go Adds coverage for default-hash fallback serving embedded bytes.
pkg/ucp/datamodel/icon_validation.go Clarifies/modernizes comments for icon validation without spec-number coupling.
pkg/ucp/api/v20231001preview/resourcetype_conversion.go Substitutes default icon hash when ARM PUT registration omits icon bytes (conversion path).
pkg/ucp/api/v20231001preview/resourcetype_conversion_test.go Updates conversion tests to assert default-hash substitution.
pkg/corerp/frontend/controller/applications/v20250801preview/graphicons.go Switches icon enrichment to use shared SplitResourceType and applies default-hash fallback per node.
pkg/corerp/frontend/controller/applications/v20250801preview/graphicons_test.go Updates tests for attachIconHashes/default fallback behavior (but needs renames for clarity).
pkg/corerp/frontend/controller/applications/v20250801preview/graph_util.go Adds v20250801preview-typed graph computation pipeline (version-local model typing).
pkg/corerp/frontend/controller/applications/v20250801preview/getgraph.go Uses v20250801preview-typed pipeline and fills icons map with embedded default bytes when appropriate.
pkg/corerp/frontend/controller/applications/getgraph.go Clarifies that v20250801preview owns its own end-to-end graph pipeline (no shared versioned model types).
pkg/cli/graph/modeled.go Adds per-node iconHash resolution from embedded manifest and optional icons map for modeled graphs.
pkg/cli/graph/modeled_test.go Updates modeled-graph tests for new signature + includeIcons behavior.
pkg/cli/cmd/app/graph/graph.go Extends --include-icons semantics to modeled graphs and plumbs the flag through Runner.
docs/architecture/application-graph.md Documents default icon substitution and static graph icon behavior (but diagram needs to keep iconHash optional).
deploy/manifest/icons.go New embedded icon catalog: default icon + built-in icons + helpers (Lookup/Default/DefaultHash/IsDefault/SplitResourceType).
deploy/manifest/icons_test.go Adds tests pinning default icon invariants and lookup behavior.
deploy/manifest/default-icon.svg Adds canonical product default icon SVG embedded into binaries.

Comment thread docs/architecture/application-graph.md
Comment thread pkg/corerp/frontend/controller/applications/v20250801preview/graphicons_test.go Outdated
Comment thread pkg/corerp/frontend/controller/applications/v20250801preview/graphicons_test.go Outdated
Comment thread pkg/corerp/frontend/controller/applications/v20250801preview/graph_util.go Outdated
@nithyatsu nithyatsu changed the title Static graph icons Static graph icons + default icon Jul 15, 2026

@brooke-hamilton brooke-hamilton left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of minor doc/comment nits — nothing blocking. Nice, well-tested change.

Comment thread pkg/cli/graph/modeled.go Outdated
Comment thread pkg/cli/graph/modeled.go Outdated
@willtsai
willtsai self-requested a review July 15, 2026 16:26
@willtsai

Copy link
Copy Markdown
Contributor

Recommend looking into these Copilot findings regarding validation of SVG data against malicious code:

Only partially. ValidateIcon rejects common active-content vectors:

  • <script> and <foreignObject>
  • on* event handlers
  • External href/xlink:href
  • Malformed XML, non-SVG roots, and oversized SVGs

It is not a complete SVG sanitizer. It permits <style>, style attributes, data: URLs, and other URL-bearing SVG/CSS attributes. Also, embedded static icons are hashed but never passed through ValidateIcon, and gathered graph SVGs are not revalidated. The endpoint’s CSP helps direct HTTP responses, but not necessarily consumers rendering SVG bytes from the graph’s inline icons map.

@nithyatsu

Copy link
Copy Markdown
Contributor Author

Recommend looking into these Copilot findings regarding validation of SVG data against malicious code:

Only partially. ValidateIcon rejects common active-content vectors:

  • <script> and <foreignObject>
  • on* event handlers
  • External href/xlink:href
  • Malformed XML, non-SVG roots, and oversized SVGs

It is not a complete SVG sanitizer. It permits <style>, style attributes, data: URLs, and other URL-bearing SVG/CSS attributes. Also, embedded static icons are hashed but never passed through ValidateIcon, and gathered graph SVGs are not revalidated. The endpoint’s CSP helps direct HTTP responses, but not necessarily consumers rendering SVG bytes from the graph’s inline icons map.

Addressed these issues in the validation.

@nithyatsu
nithyatsu force-pushed the static-graph-icons branch from b11e1b1 to 407ddb2 Compare July 16, 2026 16:30
@nithyatsu
nithyatsu force-pushed the static-graph-icons branch from 407ddb2 to 9009c41 Compare July 16, 2026 17:19
@willtsai

Copy link
Copy Markdown
Contributor

Some more findings, please check to see if these can also be addressed:

The PR now rejects <style>, style attributes, external paint URLs, and validates all embedded icons in CI—good improvements.

pkg/ucp/datamodel/icon_validation.go
    Line 159: URL-bearing attributes remain uncovered. For example, marker-start="url(https://attacker/...)" and cursor="url(...)" pass validation and may trigger network requests. The string scan is also bypassable with CSS escapes such as fill="u\72l(https://attacker/...)". Use a complete URL-capable attribute allowlist and restricted CSS-value parsing before claiming validated SVGs never access the network.

Separately, the earlier integrity gap remains: gathered SVG bytes are still not re-hashed and compared with their advertised iconHash.

@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown

Functional Tests - upgrade-noncloud

3 tests  ±0   3 ✅ ±0   3m 34s ⏱️ - 1m 17s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 5b99663. ± Comparison against base commit e670142.

♻️ This comment has been updated with latest results.

@willtsai willtsai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested tightening SVG validation to reject SMIL animation elements that can mutate checked attributes after validation.

Comment thread pkg/ucp/datamodel/icon_validation.go
willtsai
willtsai previously approved these changes Jul 16, 2026

@willtsai willtsai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for addressing the icon validation feedback.

Comment thread pkg/ucp/datamodel/icon_validation.go
@radius-functional-tests

radius-functional-tests Bot commented Jul 17, 2026

Copy link
Copy Markdown

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details
Name Value
Repository radius-project/radius
Commit ref 23fd4ff
Unique ID func5965491d84
Image tag pr-func5965491d84
  • Dapr: 1.14.4
  • Azure KeyVault CSI driver: 1.4.2
  • Azure Workload identity webhook: 1.3.0
  • Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func5965491d84
  • Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
  • applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func5965491d84
  • dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func5965491d84
  • controller test image location: ghcr.io/radius-project/dev/controller:pr-func5965491d84
  • ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func5965491d84
  • deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

@nithyatsu
nithyatsu added this pull request to the merge queue Jul 17, 2026
Merged via the queue into main with commit 9cdd784 Jul 17, 2026
77 checks passed
@nithyatsu
nithyatsu deleted the static-graph-icons branch July 17, 2026 01:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants