feat(network): update sandbox egress policy in place, re-evaluating live flows

CubeAPI/src/cubemaster/mod.rs

@@ -158,6 +158,22 @@ impl CubeMasterClient {
         parse_response(resp).await
     }
 
+    /// POST /cube/sandbox/network — replace a running sandbox's egress policy.
+    pub async fn update_sandbox_network(
+        &self,
+        req: &SandboxNetworkRequest,
+    ) -> Result<SandboxNetworkResponse, CubeMasterError> {
+        let url = format!("{}/cube/sandbox/network", self.base_url);
+        let resp = self
+            .inner
+            .post(&url)
+            .json(req)
+            .send()
+            .await
+            .map_err(CubeMasterError::Http)?;
+        parse_response(resp).await
+    }
+
     /// POST /cube/sandbox/refresh — extend TTL by a delta (seconds).
     /// ❌ New API required on CubeMaster.
     pub async fn refresh_sandbox(
@@ -1430,6 +1446,32 @@ pub struct SandboxUpdateResponse {
     pub ret: RetCode,
 }
 
+// ─── Update sandbox network policy ────────────────────────────────────────
+// ✅ Implemented: POST /cube/sandbox/network
+
+#[derive(Debug, Serialize)]
+pub struct SandboxNetworkRequest {
+    #[serde(rename = "RequestID", alias = "requestID")]
+    pub request_id: String,
+    #[serde(rename = "sandboxID")]
+    pub sandbox_id: String,
+    #[serde(rename = "instanceType")]
+    pub instance_type: String,
+    /// Complete desired policy. Always sent, even when empty, because an empty
+    /// policy is a meaningful request: it clears every egress rule.
+    pub cube_network_config: CubeNetworkConfig,
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+pub struct SandboxNetworkResponse {
+    #[serde(rename = "RequestID", alias = "requestID")]
+    pub request_id: String,
+    #[serde(rename = "sandboxID", default)]
+    pub sandbox_id: String,
+    pub ret: RetCode,
+}
+
 // ─── Set sandbox timeout (absolute) ───────────────────────────────────────
 // ✅ Implemented: POST /cube/sandbox/timeout
 

CubeAPI/src/handlers/sandboxes.rs

@@ -16,7 +16,7 @@ use crate::{
     models::{
         ApiError, ConnectSandbox, ListSandboxesQuery, ListSandboxesV2Query, NewSandbox,
         RefreshRequest, ResumedSandbox, Sandbox, SandboxDetail, SandboxLogsQuery,
-        SandboxLogsV2Query, SandboxLogsV2Response, SetTimeoutRequest,
+        SandboxLogsV2Query, SandboxLogsV2Response, SetTimeoutRequest, UpdateSandboxNetworkRequest,
     },
     state::AppState,
 };
@@ -519,6 +519,58 @@ pub async fn set_sandbox_timeout(
     Ok(StatusCode::NO_CONTENT)
 }
 
+// ─── PUT /sandboxes/:sandboxID/network ────────────────────────────────────────
+
+#[utoipa::path(
+    put,
+    path = "/sandboxes/{sandboxID}/network",
+    params(
+        ("sandboxID" = String, Path, description = "Sandbox identifier")
+    ),
+    request_body = UpdateSandboxNetworkRequest,
+    responses(
+        (status = 204, description = "Network policy updated"),
+        (status = 400, description = "Invalid network policy", body = ApiError),
+        (status = 404, description = "Sandbox not found", body = ApiError),
+        (status = 409, description = "Sandbox is not running", body = ApiError),
+        (status = 500, description = "Unexpected backend error", body = ApiError)
+    )
+)]
+pub async fn update_sandbox_network(
+    State(state): State<AppState>,
+    Path(sandbox_id): Path<String>,
+    Json(body): Json<UpdateSandboxNetworkRequest>,
+) -> AppResult<impl IntoResponse> {
+    state
+        .logger
+        .log(
+            LogEvent::new(LogLevel::Debug, "api.request")
+                .field("handler", "update_sandbox_network")
+                .field("sandbox_id", &sandbox_id),
+        )
+        .await;
+
+    state
+        .services
+        .sandboxes
+        .update_network(
+            &sandbox_id,
+            body.allow_internet_access,
+            body.network.as_ref(),
+        )
+        .await?;
+
+    tracing::info!(sandbox_id = %sandbox_id, "update_sandbox_network: success");
+    state
+        .logger
+        .log(
+            LogEvent::new(LogLevel::Info, "sandbox.network.updated")
+                .field("sandbox_id", &sandbox_id),
+        )
+        .await;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 // ─── POST /sandboxes/:sandboxID/refreshes ─────────────────────────────────────
 
 #[utoipa::path(

CubeAPI/src/models/mod.rs

@@ -521,6 +521,21 @@ fn default_log_limit() -> i32 {
     1000
 }
 
+// ─── Sandbox — network policy ─────────────────────────────────────────────
+
+/// Request body for PUT /sandboxes/{id}/network.
+///
+/// The body is the complete desired egress policy, not a patch: any field left
+/// out clears what the sandbox currently has. This mirrors how `network` is
+/// interpreted at create time, so the same object can be sent to either.
+#[derive(Debug, Deserialize, ToSchema)]
+pub struct UpdateSandboxNetworkRequest {
+    #[serde(rename = "allowInternetAccess", alias = "allow_internet_access")]
+    pub allow_internet_access: Option<bool>,
+    #[serde(default)]
+    pub network: Option<SandboxNetworkConfig>,
+}
+
 // ─── Sandbox — timeout / refresh ──────────────────────────────────────────
 
 /// Request body for POST /sandboxes/{id}/timeout

CubeAPI/src/openapi.rs

@@ -19,7 +19,8 @@ use crate::{
         SetTimeoutRequest, SnapshotInfo, SnapshotListItem, TemplateAliasLookupResponse,
         TemplateBuildJob, TemplateBuildStatus, TemplateCompatAdoptResponseView,
         TemplateCompatMatrixView, TemplateCompatRowView, TemplateCompatSummaryView, TemplateDetail,
-        TemplateNodeCompatView, TemplateSummary, Volume, VolumeAndToken,
+        TemplateNodeCompatView, TemplateSummary, UpdateSandboxNetworkRequest, Volume,
+        VolumeAndToken,
     },
 };
 
@@ -77,6 +78,7 @@ impl Modify for SecurityAddon {
         handlers::sandboxes::get_sandbox_logs,
         handlers::sandboxes::get_sandbox_logs_v2,
         handlers::sandboxes::set_sandbox_timeout,
+        handlers::sandboxes::update_sandbox_network,
         handlers::sandboxes::refresh_sandbox,
         handlers::snapshots::create_snapshot,
         handlers::snapshots::list_snapshots,
@@ -111,6 +113,7 @@ impl Modify for SecurityAddon {
         ConnectSandbox,
         ResumedSandbox,
         SetTimeoutRequest,
+        UpdateSandboxNetworkRequest,
         RefreshRequest,
         SandboxLogEntry,
         SandboxLogs,

CubeAPI/src/routes.rs

@@ -98,6 +98,10 @@ fn build_sandbox_routes(state: &AppState, auth_configured: bool) -> Router<AppSt
             "/v2/sandboxes/:sandboxID/logs",
             get(sandboxes::get_sandbox_logs_v2),
         )
+        .route(
+            "/sandboxes/:sandboxID/network",
+            put(sandboxes::update_sandbox_network),
+        )
         .route(
             "/sandboxes/:sandboxID/timeout",
             post(sandboxes::set_sandbox_timeout),

CubeAPI/src/services/sandboxes.rs

@@ -12,8 +12,8 @@ use crate::{
         datetime_from_unix_nanos, extract_template_id, CreateSandboxRequest, CubeEgressRule,
         CubeEgressRuleAction, CubeEgressRuleInject, CubeEgressRuleMatch, CubeMasterClient,
         CubeMasterError, CubeNetworkConfig, DeleteSandboxRequest, ListSandboxRequest, SandboxInfo,
-        SandboxLogsRequest, SandboxRefreshRequest, SandboxStatus, SandboxTimeoutRequest,
-        SandboxUpdateRequest, VolumeSpec,
+        SandboxLogsRequest, SandboxNetworkRequest, SandboxRefreshRequest, SandboxStatus,
+        SandboxTimeoutRequest, SandboxUpdateRequest, VolumeSpec,
     },
     error::{AppError, AppResult},
     models::{
@@ -493,6 +493,42 @@ impl SandboxService {
         Ok(())
     }
 
+    /// Replace a running sandbox's egress policy.
+    ///
+    /// The policy is validated and mapped by the same code as sandbox creation,
+    /// so an update cannot install anything create would have rejected. An
+    /// all-empty body is legal and clears the policy, which is why the mapper's
+    /// "nothing set" `None` is turned back into a default config rather than
+    /// treated as "no change".
+    pub async fn update_network(
+        &self,
+        sandbox_id: &str,
+        allow_internet_access: Option<bool>,
+        network: Option<&SandboxNetworkConfig>,
+    ) -> AppResult<()> {
+        let cube_network_config =
+            build_cube_network_config(allow_internet_access, network)?.unwrap_or_default();
+
+        let req = SandboxNetworkRequest {
+            request_id: new_request_id(),
+            sandbox_id: sandbox_id.to_string(),
+            instance_type: self.instance_type.clone(),
+            cube_network_config,
+        };
+
+        let resp = self
+            .cubemaster
+            .update_sandbox_network(&req)
+            .await
+            .map_err(|e| sandbox_not_found_or_internal(e, sandbox_id))?;
+
+        resp.ret
+            .into_result()
+            .map_err(|e| sandbox_not_found_or_internal(e, sandbox_id))?;
+
+        Ok(())
+    }
+
     pub async fn refresh(&self, sandbox_id: &str, duration: i32) -> AppResult<()> {
         let req = SandboxRefreshRequest {
             request_id: new_request_id(),