feat(file-service): complete the model backend for sharing and the hub

[tanishqgandhi1908]

What changes were proposed in this PR?

#7922 gave models the file API the management UI needs. This PR adds the last backend pieces, so model sharing and the hub can be built as frontend-only work.

Cover images — POST /{mid}/update/cover, GET /{mid}/cover (307 redirect), GET /{mid}/cover-url (JSON, since <img src> cannot attach the Authorization header on a private model). The cover_image column already existed.

The resource-agnostic halves move into a shared CoverImageUtils and DatasetResource is refactored onto it, net −55 lines there. The image extension allowlist is a security control, not a convention — a cover is handed to the browser as a presigned URL, so an active document (.svg, .html) would be a stored-XSS vector, and a duplicated allowlist drifts.

Anonymous version browsing — /{mid}/publicVersion/list and /{mid}/publicVersion/{mvid}/rootFileNodes. Without these a logged-out visitor on a public model page gets metadata and then an error.

Framework/format editing — POST /update/framework, POST /update/format, plus other in both whitelists. The labels were create-only, so a mislabelled model had to be recreated.

Routing — /api/model and /api/access/model in nginx, the k8s gateway and the frontend dev proxy. Nothing reaches the resource in a real deployment without them. The nginx location needs a trailing slash: nginx matches prefixes byte-wise, so a bare /api/model would swallow the LLM /api/models route. The Gateway API matches whole path segments and does not have that problem.

One behavior change on the dataset side: covers now get a path-length check. dataset.cover_image is varchar(246) via sql/updates/18.sql, so an over-long path was a jOOQ-wrapped 500 and is now a 400.

Any related issues, documentation, discussions?

• Part of Model sharing, discovery, and docs #6501
• Reviewable on its own. feat(file-service): complete the model file API for the management UI #7922 has merged, and main has been merged in, so the diff is now this PR's work alone: 10 files, +972/−90. No migration, no schema change.

How was this PR tested?

New CoverImageUtilsSpec (18 cases) pins the allowlist, .svg/.html rejection, path traversal, absolute paths and both column-width limits. New ModelHubApiSpec (21 cases) drives the covers end to end through LakeFS/MinIO and covers anonymous browsing, including the negative cases: private model anonymous and no-grant, unknown model and version id, a model unpublished after the fact, and agreement between the public and authenticated file-tree endpoints. ModelApiForUiSpec gains the framework/format update cases.

ModelResourcePermissionsSpec needed the four new @PermitAll endpoint names — the guardrail caught them, as intended. DatasetResourceSpec's 152 tests pass unmodified after the refactor.

284 tests across the eight affected suites, all passing after the merge of main:

sbt "FileService/testOnly *CoverImageUtilsSpec *ModelHubApiSpec *ModelApiForUiSpec *ModelResourcePermissionsSpec *ModelDownloadResourceSpec *ModelUploadResourceSpec *ModelResourceSpec *DatasetResourceSpec"
sbt scalafmtCheckAll "scalafixAll --check"

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 5)

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• Contributors with relevant context: @xuang7, @zyratlo
  You can notify them by mentioning @xuang7, @zyratlo in a comment.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 92.15686% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.23%. Comparing base (5de9bf9) to head (df48af9).

Files with missing lines	Patch %	Lines
...apache/texera/service/resource/ModelResource.scala	89.28%	3 Missing ⚠️
...g/apache/texera/service/util/CoverImageUtils.scala	95.45%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7937      +/-   ##
============================================
+ Coverage     93.21%   93.23%   +0.01%     
- Complexity     4664     4677      +13     
============================================
  Files          1175     1176       +1     
  Lines         47646    47691      +45     
  Branches       5319     5329      +10     
============================================
+ Hits          44413    44464      +51     
+ Misses         1752     1749       -3     
+ Partials       1481     1478       -3     

Flag	Coverage Δ		*Carryforward flag
access-control-service	81.00% <ø> (ø)
agent-service	99.32% <ø> (ø)		Carriedforward from 34eb44b
amber	89.34% <ø> (+0.02%)	⬆️	Carriedforward from 34eb44b
computing-unit-managing-service	73.67% <ø> (ø)
config-service	86.73% <ø> (ø)
file-service	87.09% <92.15%> (+0.39%)	⬆️
frontend	95.67% <ø> (+<0.01%)	⬆️
notebook-migration-service	79.31% <ø> (ø)
pyamber	97.78% <ø> (+0.04%)	⬆️	Carriedforward from 34eb44b
workflow-compiling-service	77.19% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 0 better · 🔴 5 worse · ⚪ 10 noise (<±5%) · 0 without baseline

Compared against main 6b8027e benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	405	0.247	24,499/32,441/32,441 us	🔴 -10.2% / 🔴 +130.6%
🔴	bs=100 sw=10 sl=64	934	0.57	105,597/134,516/134,516 us	🔴 +14.6% / 🔴 +39.4%
⚪	bs=1000 sw=10 sl=64	1,102	0.672	909,838/947,645/947,645 us	⚪ within ±5% / ⚪ within ±5%

Baseline details

Latest main 6b8027e from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	405 tuples/sec	451 tuples/sec	863.81 tuples/sec	-10.2%	-53.1%
bs=10 sw=10 sl=64	MB/s	0.247 MB/s	0.275 MB/s	0.527 MB/s	-10.2%	-53.2%
bs=10 sw=10 sl=64	p50	24,499 us	22,571 us	11,488 us	+8.5%	+113.3%
bs=10 sw=10 sl=64	p95	32,441 us	31,391 us	14,067 us	+3.3%	+130.6%
bs=10 sw=10 sl=64	p99	32,441 us	31,391 us	17,591 us	+3.3%	+84.4%
bs=100 sw=10 sl=64	throughput	934 tuples/sec	980 tuples/sec	1,127 tuples/sec	-4.7%	-17.1%
bs=100 sw=10 sl=64	MB/s	0.57 MB/s	0.598 MB/s	0.688 MB/s	-4.7%	-17.1%
bs=100 sw=10 sl=64	p50	105,597 us	103,084 us	89,893 us	+2.4%	+17.5%
bs=100 sw=10 sl=64	p95	134,516 us	117,393 us	96,506 us	+14.6%	+39.4%
bs=100 sw=10 sl=64	p99	134,516 us	117,393 us	104,915 us	+14.6%	+28.2%
bs=1000 sw=10 sl=64	throughput	1,102 tuples/sec	1,106 tuples/sec	1,156 tuples/sec	-0.4%	-4.6%
bs=1000 sw=10 sl=64	MB/s	0.672 MB/s	0.675 MB/s	0.705 MB/s	-0.4%	-4.7%
bs=1000 sw=10 sl=64	p50	909,838 us	900,978 us	886,448 us	+1.0%	+2.6%
bs=1000 sw=10 sl=64	p95	947,645 us	986,539 us	930,093 us	-3.9%	+1.9%
bs=1000 sw=10 sl=64	p99	947,645 us	986,539 us	963,104 us	-3.9%	-1.6%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,494.29,200,128000,405,0.247,24499.13,32440.86,32440.86
1,100,10,64,20,2140.81,2000,1280000,934,0.570,105597.10,134516.07,134516.07
2,1000,10,64,20,18154.26,20000,12800000,1102,0.672,909837.68,947645.21,947645.21

[tanishqgandhi1908]

/request-review @aicam

[aicam]

A couple of things I hit while reading the new cover-image and label-update endpoints, both of which would surface to end users once a model UI is built on this. Nothing blocking.