adapt-server 0.2.0__tar.gz → 0.2.3__tar.gz

{adapt_server-0.2.0/adapt_server.egg-info → adapt_server-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adapt-server
-Version: 0.2.0
+Version: 0.2.3
 Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
 Author-email: notesofcliff <notesofcliff@gmail.com>
 License-Expression: MIT

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.1.1"
+__version__ = "0.2.3"

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/admin/api_keys.py

@@ -1,13 +1,14 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlalchemy import asc, desc
 from sqlmodel import Session, select
-from typing import List
-from datetime import datetime, timedelta, timezone
-import logging
 
 from ..auth import require_superuser
 from ..storage import User, APIKey, get_db_session
-from ..api_keys import generate_api_key
+from ..api_keys import create_api_key_record, revoke_api_key_record
 from ..audit import log_action
 from . import router
 from .models import APIKeyCreate
@@ -27,8 +28,6 @@ def list_api_keys(
     user = Depends(require_superuser)
 ):
     """List all API keys in the system with optional query parameters."""
-    import json
-
     stmt = select(APIKey)
 
     if user_id is not None:
@@ -73,28 +72,15 @@ def create_api_key(key_data: APIKeyCreate, request: Request, db: Session = Depen
     if not target_user:
         logger.warning("Attempted to create API key for non-existent user %d", key_data.user_id)
         raise HTTPException(status_code=404, detail="User not found")
-        
-    raw_key, key_hash = generate_api_key()
-    
-    expires_at = None
-    if key_data.expires_in_days is not None:
-        if key_data.expires_in_days > 365:
-            raise HTTPException(status_code=400, detail="Expiration cannot exceed 1 year (365 days)")
-        expires_at = datetime.now(tz=timezone.utc) + timedelta(days=key_data.expires_in_days)
-        
-    api_key = APIKey(
-        user_id=key_data.user_id,
-        key_hash=key_hash,
-        description=key_data.description,
-        expires_at=expires_at
-    )
-    db.add(api_key)
-    db.commit()
-    db.refresh(api_key)
-    
+
+    try:
+        raw_key, api_key = create_api_key_record(db, key_data.user_id, key_data.description, key_data.expires_in_days)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
     log_action(request, "create_api_key", "apikey", f"Created API key for user {target_user.username}", user.id)
     logger.info("Created API key %d for user %s", api_key.id, target_user.username)
-    
+
     # Return the raw key only once!
     return {
         "id": api_key.id,
@@ -108,16 +94,12 @@ def create_api_key(key_data: APIKeyCreate, request: Request, db: Session = Depen
 @router.delete("/api-keys/{key_id}")
 def revoke_api_key(key_id: int, request: Request, db: Session = Depends(get_db_session), user = Depends(require_superuser)):
     """Revoke an API key by ID."""
-    api_key = db.get(APIKey, key_id)
+    api_key = revoke_api_key_record(db, key_id)
     if not api_key:
         logger.warning("Attempted to revoke non-existent API key %d", key_id)
         raise HTTPException(status_code=404, detail="API Key not found")
-        
-    api_key.is_active = False
-    db.add(api_key)
-    db.commit()
-    
+
     log_action(request, "revoke_api_key", "apikey", f"Revoked API key {key_id}", user.id)
     logger.info("Revoked API key %d", key_id)
-    
+
     return {"success": True}

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/admin/locks.py

@@ -1,11 +1,14 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlmodel import Session, select
-from typing import List
-import logging
 
 from ..auth import require_superuser
 from ..storage import LockRecord, get_db_session
 from ..locks import LockManager
+from ..utils.query import apply_filter, apply_sort, apply_pagination
 from ..audit import log_action
 from . import router
 
@@ -22,9 +25,6 @@ def list_locks(
     user = Depends(require_superuser)
 ):
     """List all active locks with optional query parameters."""
-    from ..utils.query import apply_filter, apply_sort, apply_pagination
-    import json
-    
     locks = db.exec(select(LockRecord)).all()
     
     # Convert to dicts for filtering/sorting

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/admin/resources.py

@@ -2,8 +2,10 @@ from pathlib import Path
 from typing import List
 import logging
 
+from .. import cache
 from ..config import AdaptConfig
 from ..discovery import discover_resources
+from ..storage import init_database
 
 logger = logging.getLogger(__name__)
 
@@ -14,6 +16,9 @@ def list_resources(root: Path) -> List[str]:
     Returns a list of resource identifiers including sub-namespaces for multi-resource files.
     """
     config = AdaptConfig(root=root)
+    config.load_from_file()
+    init_database(config.db_path)
+    cache.configure(str(config.db_path))
     resources = discover_resources(root, config)
     resource_names = []
     for r in resources:

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/admin/users.py

@@ -1,10 +1,13 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlmodel import Session, select
-from typing import List
-import logging
 
 from ..auth import require_superuser, hash_password
 from ..storage import User, get_db_session
+from ..utils.query import apply_filter, apply_sort, apply_pagination
 from ..audit import log_action
 from . import router
 from .models import UserCreate, UserPublic
@@ -22,9 +25,6 @@ def list_users(
     user: User = Depends(require_superuser)
 ):
     """List all users with optional query parameters."""
-    from ..utils.query import apply_filter, apply_sort, apply_pagination
-    import json
-    
     query = select(User)
     users = db.exec(query).all()
     
@@ -75,7 +75,6 @@ def create_user(user_data: UserCreate, request: Request, db: Session = Depends(g
     """Create a new user."""
     # Check if server is in read-only mode
     if request.app.state.config.readonly:
-        from fastapi import HTTPException
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
     
     existing = db.exec(select(User).where(User.username == user_data.username)).first()
@@ -109,7 +108,6 @@ def delete_user(user_id: int, request: Request, db: Session = Depends(get_db_ses
     """Delete a user by ID."""
     # Check if server is in read-only mode
     if request.app.state.config.readonly:
-        from fastapi import HTTPException
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
     
     target = db.get(User, user_id)

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/api_keys.py

@@ -1,9 +1,10 @@
+"""adapt.api_keys — API key generation, verification, and lifecycle helpers."""
 from __future__ import annotations
 
 import logging
 import secrets
 import hashlib
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from sqlmodel import Session, select
 from fastapi import Request, HTTPException, Security
 from fastapi.security import APIKeyHeader
@@ -60,6 +61,55 @@ def verify_api_key(db: Session, raw_key: str) -> User | None:
     logger.info(f"API key verified successfully for user {api_key.user_id}")
     return db.get(User, api_key.user_id)
 
+def create_api_key_record(
+    db: Session,
+    user_id: int,
+    description: str | None,
+    expires_in_days: int | None,
+) -> tuple[str, APIKey]:
+    """Create and persist an API key. Returns (raw_key, api_key).
+
+    Raises ValueError if expires_in_days exceeds 365.
+    """
+    if expires_in_days is not None and expires_in_days > 365:
+        raise ValueError("Expiration cannot exceed 1 year (365 days)")
+    expires_at = None
+    if expires_in_days is not None:
+        expires_at = datetime.now(tz=timezone.utc) + timedelta(days=expires_in_days)
+    raw_key, key_hash = generate_api_key()
+    api_key = APIKey(
+        user_id=user_id,
+        key_hash=key_hash,
+        description=description,
+        expires_at=expires_at,
+        created_at=datetime.now(tz=timezone.utc),
+        is_active=True,
+    )
+    db.add(api_key)
+    db.commit()
+    db.refresh(api_key)
+    return raw_key, api_key
+
+
+def revoke_api_key_record(
+    db: Session,
+    key_id: int,
+    *,
+    owner_id: int | None = None,
+) -> APIKey | None:
+    """Set an API key inactive. If owner_id is given, enforces ownership.
+
+    Returns the key on success, None if not found or ownership mismatch.
+    """
+    api_key = db.get(APIKey, key_id)
+    if not api_key or (owner_id is not None and api_key.user_id != owner_id):
+        return None
+    api_key.is_active = False
+    db.add(api_key)
+    db.commit()
+    return api_key
+
+
 def get_user_from_api_key(
     request: Request, 
     api_key: str = Security(API_KEY_HEADER)

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/app.py

@@ -1,24 +1,30 @@
+"""adapt.app — FastAPI application factory and middleware configuration."""
 from __future__ import annotations
 
 import asyncio
 import logging
+import time
 from contextlib import asynccontextmanager
 from pathlib import Path
 
-from fastapi import FastAPI, Request, Depends
+from fastapi import FastAPI, HTTPException, Request, Depends
+from fastapi.openapi.docs import get_swagger_ui_html, get_swagger_ui_oauth2_redirect_html
+from fastapi.openapi.utils import get_openapi
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.middleware.trustedhost import TrustedHostMiddleware
-from datetime import datetime, timezone
-import time
-from .auth.dependencies import get_current_user
-_START_TIME = time.time()
+from fastapi.routing import APIRoute
 from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 from sqlmodel import Session, select, delete
 from datetime import datetime, timezone
 
+from .auth import router as auth_router
+from .auth.dependencies import get_current_user
+from .auth.session import get_session
+from .admin import router as admin_router
 from .config import AdaptConfig
 from .discovery import discover_resources
+from .permissions import PermissionChecker
 from .routes import generate_routes
 from .storage import User, DBSession, init_database
 from .locks import LockManager
@@ -33,8 +39,14 @@ from .security import (
 )
 from .security_urls import login_redirect_url
 
+_START_TIME = time.time()
+
 logger = logging.getLogger(__name__)
 
+_DOCS_INTERNAL_PATHS = frozenset({"/docs", "/docs/", "/docs/oauth2-redirect", "/openapi.json"})
+_PUBLIC_OPENAPI_PATHS = frozenset({"/", "/auth/login", "/health"})
+_AUTHENTICATED_OPENAPI_PATHS = frozenset({"/auth/logout", "/auth/me", "/profile", "/api/apikeys"})
+
 
 async def cleanup_expired_sessions(engine, interval_hours=24):
     """Background task to clean up expired sessions."""
@@ -52,6 +64,132 @@ async def cleanup_expired_sessions(engine, interval_hours=24):
                 logger.info("Cleaned up %d expired sessions", result.rowcount)
 
 
+def _normalize_path(path: str) -> str:
+    """Normalize route paths so matching is consistent with and without trailing slashes."""
+    normalized = path.rstrip("/")
+    return normalized or "/"
+
+
+def _resource_namespaces(resource) -> set[str]:
+    """Return the supported permission namespaces for a discovered resource."""
+    namespace_no_ext = resource.relative_path.with_suffix("").as_posix()
+    namespace_with_ext = resource.relative_path.as_posix()
+    if "sub_namespace" in resource.metadata:
+        suffix = f"/{resource.metadata['sub_namespace']}"
+        namespace_no_ext += suffix
+        namespace_with_ext += suffix
+    return {namespace_no_ext, namespace_with_ext}
+
+
+def _all_resource_namespaces(resources) -> set[str]:
+    """Collect all permission namespaces exposed by discovered resources."""
+    namespaces: set[str] = set()
+    for resource in resources:
+        namespaces.update(_resource_namespaces(resource))
+    return namespaces
+
+
+def _visible_resource_namespaces(request: Request, user: User | None) -> set[str]:
+    """Return the resource namespaces that should be visible to the current user."""
+    resources = request.app.state.resources
+    if not user:
+        return set()
+
+    if getattr(user, "is_superuser", False):
+        return _all_resource_namespaces(resources)
+
+    from .permissions import PermissionChecker
+
+    visible: set[str] = set()
+    with Session(request.app.state.db_engine) as db:
+        checker = PermissionChecker(db)
+        for resource in resources:
+            for namespace in _resource_namespaces(resource):
+                if checker.has_permission(user, namespace, "read"):
+                    visible.add(namespace)
+    return visible
+
+
+def _extract_resource_namespace(path: str, all_namespaces: set[str]) -> str | None:
+    """Extract the resource namespace from a route path if it maps to a discovered resource."""
+    normalized_path = _normalize_path(path)
+    stripped_path = normalized_path.lstrip("/")
+    if stripped_path in all_namespaces:
+        return stripped_path
+
+    for prefix in ("/api/", "/schema/", "/ui/", "/media/"):
+        if normalized_path.startswith(prefix):
+            candidate = normalized_path[len(prefix):]
+            if candidate in all_namespaces:
+                return candidate
+    return None
+
+
+def _route_is_visible(route: APIRoute, request: Request, user: User | None, all_namespaces: set[str], visible_namespaces: set[str]) -> bool:
+    """Decide whether a route should appear in the current request's OpenAPI schema."""
+    path = _normalize_path(route.path)
+
+    if path in _DOCS_INTERNAL_PATHS:
+        return False
+
+    if path.startswith("/admin") or "admin" in (route.tags or []):
+        return bool(user and getattr(user, "is_superuser", False))
+
+    if path in _PUBLIC_OPENAPI_PATHS:
+        return True
+
+    if path in _AUTHENTICATED_OPENAPI_PATHS:
+        return user is not None
+
+    if path == "/ui/media":
+        media_namespaces = {
+            ns
+            for r in request.app.state.resources
+            if r.resource_type == "media"
+            for ns in _resource_namespaces(r)
+        }
+        return bool(media_namespaces & visible_namespaces)
+
+    resource_namespace = _extract_resource_namespace(path, all_namespaces)
+    if resource_namespace is not None:
+        return resource_namespace in visible_namespaces
+
+    if path.startswith("/auth/"):
+        return user is not None
+
+    return False
+
+
+def _build_openapi_schema(app: FastAPI, request: Request, user: User | None) -> dict:
+    """Build a filtered OpenAPI schema for the current request context."""
+    all_namespaces = _all_resource_namespaces(request.app.state.resources)
+    visible_namespaces = _visible_resource_namespaces(request, user)
+    visible_routes = [
+        route
+        for route in app.routes
+        if isinstance(route, APIRoute)
+        and route.include_in_schema
+        and _route_is_visible(route, request, user, all_namespaces, visible_namespaces)
+    ]
+
+    return get_openapi(
+        title=app.title,
+        version=app.version,
+        description=app.description,
+        routes=visible_routes,
+    )
+
+
+def _visible_resource_paths(request: Request, user: User | None) -> list[str]:
+    """Return resource paths visible to the current user for JSON discovery responses."""
+    visible_namespaces = _visible_resource_namespaces(request, user)
+    visible_resources: list[str] = []
+    for resource in request.app.state.resources:
+        if _resource_namespaces(resource) & visible_namespaces:
+            visible_resources.append(resource.relative_path.as_posix())
+    return visible_resources
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     """Handle application startup and shutdown events."""
@@ -68,6 +206,26 @@ async def lifespan(app: FastAPI):
         await cleanup_task
     except asyncio.CancelledError:
         logger.debug("Application shutdown: cleanup task cancelled")
+    finally:
+        engine.dispose()
+        logger.debug("Application shutdown: database engine disposed")
+
+
+def _init_infrastructure(config: AdaptConfig):
+    """Initialize database, cache, lock manager, and resource discovery.
+
+    Returns:
+        Tuple of (engine, lock_manager, resources).
+    """
+    engine = init_database(config.db_path)
+    cache.configure(str(config.db_path))
+    lock_manager = LockManager(engine)
+    cleaned = lock_manager.release_stale_locks(max_age_seconds=300)
+    if cleaned > 0:
+        logging.warning("Cleaned %d stale locks on startup", cleaned)
+    resources = discover_resources(config.root, config)
+    logger.debug("Discovered %d resources", len(resources))
+    return engine, lock_manager, resources
 
 
 def create_app(config: AdaptConfig) -> FastAPI:
@@ -80,28 +238,18 @@ def create_app(config: AdaptConfig) -> FastAPI:
         The configured FastAPI app instance.
     """
     logger.debug("Creating FastAPI app with config: %s", config)
-    engine = init_database(config.db_path)
-    cache.configure(str(config.db_path))
-    app = FastAPI(title="Adapt", version=config.version, lifespan=lifespan)
+    engine, lock_manager, resources = _init_infrastructure(config)
+
+    app = FastAPI(title="Adapt", version=config.version, lifespan=lifespan, docs_url=None, redoc_url=None, openapi_url=None)
     app.state.config = config
     app.state.db_engine = engine
     app.state.use_tls = bool(config.tls_cert and config.tls_key)
+    app.state.lock_manager = lock_manager
+    app.state.resources = resources
 
     allowed_hosts = build_allowed_hosts(config.host)
     if allowed_hosts != ["*"]:
         app.add_middleware(TrustedHostMiddleware, allowed_hosts=allowed_hosts)
-    
-    # Initialize lock manager
-    lock_manager = LockManager(engine)
-    # Clean up stale locks from previous crash
-    cleaned = lock_manager.release_stale_locks(max_age_seconds=300)  # 5 minutes
-    if cleaned > 0:
-        logging.warning(f"Cleaned {cleaned} stale locks on startup")
-    app.state.lock_manager = lock_manager
-    
-    resources = discover_resources(config.root, config)
-    app.state.resources = resources
-    logger.debug("Discovered %d resources", len(resources))
 
     # Set up Jinja2 templates
     templates_dir = Path(__file__).parent / "templates"
@@ -140,8 +288,6 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.middleware("http")
     async def auth_middleware(request: Request, call_next):
         """Middleware to handle user authentication via session cookies."""
-        from .auth.session import get_session
-        from sqlmodel import Session
         token = request.cookies.get("adapt_session")
         request.state.user = None
         if token:
@@ -159,15 +305,34 @@ def create_app(config: AdaptConfig) -> FastAPI:
         return response
 
     # Mount authentication routes
-    from .auth import router as auth_router
     app.include_router(auth_router, prefix="", tags=["auth"])
 
     # Mount admin routes
-    from .admin import router as admin_router
     app.include_router(admin_router)
 
     # Generate and mount routes
     generate_routes(app, resources, config)
+
+    @app.get("/openapi.json", include_in_schema=False)
+    def openapi_schema(request: Request):
+        """Return an OpenAPI document filtered to the current user's visible routes."""
+        user = get_current_user(request)
+        return JSONResponse(_build_openapi_schema(app, request, user))
+
+    @app.get("/docs", include_in_schema=False)
+    @app.get("/docs/", include_in_schema=False)
+    def swagger_ui():
+        """Render Swagger UI against the request-filtered OpenAPI schema."""
+        return get_swagger_ui_html(
+            openapi_url="/openapi.json",
+            title=f"{app.title} - API Docs",
+            oauth2_redirect_url="/docs/oauth2-redirect",
+        )
+
+    @app.get("/docs/oauth2-redirect", include_in_schema=False)
+    def swagger_ui_redirect():
+        """Serve the Swagger UI OAuth redirect helper."""
+        return get_swagger_ui_oauth2_redirect_html()
     
     @app.get("/health", tags=["system"])
     async def health(request: Request, user=Depends(get_current_user)):
@@ -208,18 +373,27 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.get("/ui/media")
     def media_gallery(request: Request):
         """Render the media gallery UI for authenticated users."""
-        from .auth.dependencies import get_current_user
         user = get_current_user(request)
         if not user:
-            # Redirect to login if not authenticated
             logger.debug("Unauthenticated access to media gallery, redirecting to login")
             return RedirectResponse(url=login_redirect_url("/ui/media"), status_code=302)
-        
-        media_resources = [r for r in request.app.state.resources if r.resource_type == "media"]
+
+        all_media = [r for r in request.app.state.resources if r.resource_type == "media"]
+        if getattr(user, "is_superuser", False):
+            permitted_media = all_media
+        else:
+            with Session(engine) as db:
+                checker = PermissionChecker(db)
+                permitted_media = [
+                    r for r in all_media
+                    if checker.has_permission(user, r.relative_path.with_suffix("").as_posix(), "read")
+                ]
+        if not permitted_media and not getattr(user, "is_superuser", False):
+            logger.warning("Permission denied for user %s: no accessible media resources", user.username)
+            raise HTTPException(status_code=403, detail="No accessible media resources")
+
         media_items = []
-        for r in media_resources:
-            # Check permission, but for simplicity, assume read permission
-            # In full impl, check permission
+        for r in permitted_media:
             media_items.append({
                 "name": r.path.name,
                 "relative_path": r.relative_path.as_posix(),
@@ -247,17 +421,14 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.get("/")
     def root(request: Request):
         """Handle root requests, rendering HTML landing page or JSON API response."""
-        from .auth.dependencies import get_current_user
-        from .utils import build_accessible_ui_links
-        
         accept = request.headers.get("accept", "")
         if "text/html" in accept:
             # Render landing page
             user = get_current_user(request)
             accessible_resources = build_accessible_ui_links(request, user)
             
-            # Add media gallery if there are media files
-            if any(r.resource_type == "media" for r in request.app.state.resources):
+            # Add media gallery link only if the user can access at least one media file
+            if any(link["type"] == "media" for link in accessible_resources):
                 accessible_resources.append({"name": "Media Gallery", "url": "/ui/media", "type": "media"})
             
             context = {
@@ -269,13 +440,12 @@ def create_app(config: AdaptConfig) -> FastAPI:
             return request.app.state.templates.TemplateResponse(request, "landing.html", context)
         else:
             # JSON API response
-            resources = [r.relative_path.as_posix() for r in request.app.state.resources]
+            user = get_current_user(request)
+            resources = _visible_resource_paths(request, user)
             logger.debug("Returning JSON API response with %d resources", len(resources))
             return {"resources": resources}
 
     # Exception handler for auth redirects
-    from fastapi import HTTPException
-
     @app.exception_handler(HTTPException)
     async def auth_exception_handler(request: Request, exc: HTTPException):
         """Handle HTTP exceptions, redirecting to login for 401 errors in HTML requests."""

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/audit.py

@@ -1,3 +1,4 @@
+"""adapt.audit — Structured audit logging for user actions."""
 from __future__ import annotations
 
 import logging

{adapt_server-0.2.0 → adapt_server-0.2.3}/adapt/auth/dependencies.py

@@ -1,15 +1,17 @@
+"""adapt.auth.dependencies — FastAPI dependency functions for authentication and authorization."""
 from fastapi import Request, HTTPException, status, Depends
 from sqlmodel import Session, select
 import logging
 
 from ..storage import User, UserGroup, GroupPermission, Permission
+from .session import get_session
+from ..api_keys import verify_api_key
 
 logger = logging.getLogger(__name__)
 
 def get_current_user(request: Request) -> User | None:
     """Get the current authenticated user from session or API key."""
     # 1. Try Session Cookie
-    from .session import get_session
     token = request.cookies.get("adapt_session")
     if token:
         with Session(request.app.state.db_engine) as db:
@@ -23,7 +25,6 @@ def get_current_user(request: Request) -> User | None:
     # 2. Try API Key
     api_key_header = request.headers.get("X-API-Key")
     if api_key_header:
-        from ..api_keys import verify_api_key
         with Session(request.app.state.db_engine) as db:
             user = verify_api_key(db, api_key_header)
             if user: