pdstools.infinity.resources.prediction_studio.model_security

Lightweight security helpers for Pega ONNX models.

Provides: - Extensible allow-list validation for pegaMetadata keys. - Size-limit checks (predictor count, possible values, string length). - SHA-256 hashing / verification of model files.

Usage

>>> from pdstools.infinity.resources.prediction_studio.model_security import (
...     ModelSecurityValidator,
...     compute_model_hash,
...     verify_model_hash,
... )
>>> validator = ModelSecurityValidator()
>>> result = validator.validate_metadata(metadata_dict)

Attributes

logger

ALLOWED_PEGA_KEYS

ALLOWED_PREDICTOR_KEYS

ALLOWED_OUTPUT_KEYS

MAX_STRING_LENGTH

MAX_PREDICTOR_COUNT

MAX_POSSIBLE_VALUES

Classes

SecurityResult

Simple validation result container.

ModelSecurityValidator

Validate pegaMetadata dictionaries against an extensible allow-list.

Functions

compute_model_hash(→ str)

Compute the SHA-256 hex digest of an ONNX model file.

verify_model_hash(→ bool)

Return True if the file's SHA-256 matches expected_hash.

Module Contents

logger
ALLOWED_PEGA_KEYS: set[str]
ALLOWED_PREDICTOR_KEYS: set[str]
ALLOWED_OUTPUT_KEYS: set[str]
MAX_STRING_LENGTH: int = 10000
MAX_PREDICTOR_COUNT: int = 1000
MAX_POSSIBLE_VALUES: int = 100
class SecurityResult

Simple validation result container.

is_secure: bool = True
issues: list[str] = []
_add(msg: str, *, fail: bool = False) → None
Parameters:
Return type:

None

__str__() → str
Return type:

str

class ModelSecurityValidator(extra_allowed_keys: set[str] | None = None)

Validate pegaMetadata dictionaries against an extensible allow-list.

Parameters:

extra_allowed_keys (set[str] | None) – Additional top-level pegaMetadata keys to accept.

allowed_keys
validate_metadata(metadata: dict[str, Any]) → SecurityResult

Check metadata against the allow-list and size limits.

Parameters:

metadata (dict[str, Any])

Return type:

SecurityResult

sanitize_metadata(metadata: dict[str, Any]) → dict[str, Any]

Return a copy of metadata with only allowed keys retained.

Parameters:

metadata (dict[str, Any])

Return type:

dict[str, Any]

static _check_string_lengths(data: Any, result: SecurityResult, path: str = '') → None
Parameters:
Return type:

None

compute_model_hash(model_path: str | pathlib.Path) → str

Compute the SHA-256 hex digest of an ONNX model file.

Parameters:

model_path (str | pathlib.Path)

Return type:

str

verify_model_hash(model_path: str | pathlib.Path, expected_hash: str) → bool

Return True if the file’s SHA-256 matches expected_hash.

Parameters:
Return type:

bool