adapt-server 0.2.2__tar.gz → 0.2.3__tar.gz

{adapt_server-0.2.2/adapt_server.egg-info → adapt_server-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adapt-server
-Version: 0.2.2
+Version: 0.2.3
 Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
 Author-email: notesofcliff <notesofcliff@gmail.com>
 License-Expression: MIT

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/admin/api_keys.py

@@ -1,13 +1,14 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlalchemy import asc, desc
 from sqlmodel import Session, select
-from typing import List
-from datetime import datetime, timedelta, timezone
-import logging
 
 from ..auth import require_superuser
 from ..storage import User, APIKey, get_db_session
-from ..api_keys import generate_api_key
+from ..api_keys import create_api_key_record, revoke_api_key_record
 from ..audit import log_action
 from . import router
 from .models import APIKeyCreate
@@ -27,8 +28,6 @@ def list_api_keys(
     user = Depends(require_superuser)
 ):
     """List all API keys in the system with optional query parameters."""
-    import json
-
     stmt = select(APIKey)
 
     if user_id is not None:
@@ -73,28 +72,15 @@ def create_api_key(key_data: APIKeyCreate, request: Request, db: Session = Depen
     if not target_user:
         logger.warning("Attempted to create API key for non-existent user %d", key_data.user_id)
         raise HTTPException(status_code=404, detail="User not found")
-        
-    raw_key, key_hash = generate_api_key()
-    
-    expires_at = None
-    if key_data.expires_in_days is not None:
-        if key_data.expires_in_days > 365:
-            raise HTTPException(status_code=400, detail="Expiration cannot exceed 1 year (365 days)")
-        expires_at = datetime.now(tz=timezone.utc) + timedelta(days=key_data.expires_in_days)
-        
-    api_key = APIKey(
-        user_id=key_data.user_id,
-        key_hash=key_hash,
-        description=key_data.description,
-        expires_at=expires_at
-    )
-    db.add(api_key)
-    db.commit()
-    db.refresh(api_key)
-    
+
+    try:
+        raw_key, api_key = create_api_key_record(db, key_data.user_id, key_data.description, key_data.expires_in_days)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
     log_action(request, "create_api_key", "apikey", f"Created API key for user {target_user.username}", user.id)
     logger.info("Created API key %d for user %s", api_key.id, target_user.username)
-    
+
     # Return the raw key only once!
     return {
         "id": api_key.id,
@@ -108,16 +94,12 @@ def create_api_key(key_data: APIKeyCreate, request: Request, db: Session = Depen
 @router.delete("/api-keys/{key_id}")
 def revoke_api_key(key_id: int, request: Request, db: Session = Depends(get_db_session), user = Depends(require_superuser)):
     """Revoke an API key by ID."""
-    api_key = db.get(APIKey, key_id)
+    api_key = revoke_api_key_record(db, key_id)
     if not api_key:
         logger.warning("Attempted to revoke non-existent API key %d", key_id)
         raise HTTPException(status_code=404, detail="API Key not found")
-        
-    api_key.is_active = False
-    db.add(api_key)
-    db.commit()
-    
+
     log_action(request, "revoke_api_key", "apikey", f"Revoked API key {key_id}", user.id)
     logger.info("Revoked API key %d", key_id)
-    
+
     return {"success": True}

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/admin/locks.py

@@ -1,11 +1,14 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlmodel import Session, select
-from typing import List
-import logging
 
 from ..auth import require_superuser
 from ..storage import LockRecord, get_db_session
 from ..locks import LockManager
+from ..utils.query import apply_filter, apply_sort, apply_pagination
 from ..audit import log_action
 from . import router
 
@@ -22,9 +25,6 @@ def list_locks(
     user = Depends(require_superuser)
 ):
     """List all active locks with optional query parameters."""
-    from ..utils.query import apply_filter, apply_sort, apply_pagination
-    import json
-    
     locks = db.exec(select(LockRecord)).all()
     
     # Convert to dicts for filtering/sorting

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/admin/users.py

@@ -1,10 +1,13 @@
+import json
+import logging
+from typing import List
+
 from fastapi import Depends, HTTPException, Request, Query
 from sqlmodel import Session, select
-from typing import List
-import logging
 
 from ..auth import require_superuser, hash_password
 from ..storage import User, get_db_session
+from ..utils.query import apply_filter, apply_sort, apply_pagination
 from ..audit import log_action
 from . import router
 from .models import UserCreate, UserPublic
@@ -22,9 +25,6 @@ def list_users(
     user: User = Depends(require_superuser)
 ):
     """List all users with optional query parameters."""
-    from ..utils.query import apply_filter, apply_sort, apply_pagination
-    import json
-    
     query = select(User)
     users = db.exec(query).all()
     
@@ -75,7 +75,6 @@ def create_user(user_data: UserCreate, request: Request, db: Session = Depends(g
     """Create a new user."""
     # Check if server is in read-only mode
     if request.app.state.config.readonly:
-        from fastapi import HTTPException
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
     
     existing = db.exec(select(User).where(User.username == user_data.username)).first()
@@ -109,7 +108,6 @@ def delete_user(user_id: int, request: Request, db: Session = Depends(get_db_ses
     """Delete a user by ID."""
     # Check if server is in read-only mode
     if request.app.state.config.readonly:
-        from fastapi import HTTPException
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
     
     target = db.get(User, user_id)

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/api_keys.py

@@ -1,9 +1,10 @@
+"""adapt.api_keys — API key generation, verification, and lifecycle helpers."""
 from __future__ import annotations
 
 import logging
 import secrets
 import hashlib
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from sqlmodel import Session, select
 from fastapi import Request, HTTPException, Security
 from fastapi.security import APIKeyHeader
@@ -60,6 +61,55 @@ def verify_api_key(db: Session, raw_key: str) -> User | None:
     logger.info(f"API key verified successfully for user {api_key.user_id}")
     return db.get(User, api_key.user_id)
 
+def create_api_key_record(
+    db: Session,
+    user_id: int,
+    description: str | None,
+    expires_in_days: int | None,
+) -> tuple[str, APIKey]:
+    """Create and persist an API key. Returns (raw_key, api_key).
+
+    Raises ValueError if expires_in_days exceeds 365.
+    """
+    if expires_in_days is not None and expires_in_days > 365:
+        raise ValueError("Expiration cannot exceed 1 year (365 days)")
+    expires_at = None
+    if expires_in_days is not None:
+        expires_at = datetime.now(tz=timezone.utc) + timedelta(days=expires_in_days)
+    raw_key, key_hash = generate_api_key()
+    api_key = APIKey(
+        user_id=user_id,
+        key_hash=key_hash,
+        description=description,
+        expires_at=expires_at,
+        created_at=datetime.now(tz=timezone.utc),
+        is_active=True,
+    )
+    db.add(api_key)
+    db.commit()
+    db.refresh(api_key)
+    return raw_key, api_key
+
+
+def revoke_api_key_record(
+    db: Session,
+    key_id: int,
+    *,
+    owner_id: int | None = None,
+) -> APIKey | None:
+    """Set an API key inactive. If owner_id is given, enforces ownership.
+
+    Returns the key on success, None if not found or ownership mismatch.
+    """
+    api_key = db.get(APIKey, key_id)
+    if not api_key or (owner_id is not None and api_key.user_id != owner_id):
+        return None
+    api_key.is_active = False
+    db.add(api_key)
+    db.commit()
+    return api_key
+
+
 def get_user_from_api_key(
     request: Request, 
     api_key: str = Security(API_KEY_HEADER)

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/app.py

@@ -1,27 +1,30 @@
+"""adapt.app — FastAPI application factory and middleware configuration."""
 from __future__ import annotations
 
 import asyncio
 import logging
+import time
 from contextlib import asynccontextmanager
 from pathlib import Path
 
-from fastapi import FastAPI, Request, Depends
+from fastapi import FastAPI, HTTPException, Request, Depends
 from fastapi.openapi.docs import get_swagger_ui_html, get_swagger_ui_oauth2_redirect_html
 from fastapi.openapi.utils import get_openapi
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.middleware.trustedhost import TrustedHostMiddleware
 from fastapi.routing import APIRoute
-from datetime import datetime, timezone
-import time
-from .auth.dependencies import get_current_user
-_START_TIME = time.time()
 from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 from sqlmodel import Session, select, delete
 from datetime import datetime, timezone
 
+from .auth import router as auth_router
+from .auth.dependencies import get_current_user
+from .auth.session import get_session
+from .admin import router as admin_router
 from .config import AdaptConfig
 from .discovery import discover_resources
+from .permissions import PermissionChecker
 from .routes import generate_routes
 from .storage import User, DBSession, init_database
 from .locks import LockManager
@@ -36,6 +39,8 @@ from .security import (
 )
 from .security_urls import login_redirect_url
 
+_START_TIME = time.time()
+
 logger = logging.getLogger(__name__)
 
 _DOCS_INTERNAL_PATHS = frozenset({"/docs", "/docs/", "/docs/oauth2-redirect", "/openapi.json"})
@@ -206,6 +211,23 @@ async def lifespan(app: FastAPI):
         logger.debug("Application shutdown: database engine disposed")
 
 
+def _init_infrastructure(config: AdaptConfig):
+    """Initialize database, cache, lock manager, and resource discovery.
+
+    Returns:
+        Tuple of (engine, lock_manager, resources).
+    """
+    engine = init_database(config.db_path)
+    cache.configure(str(config.db_path))
+    lock_manager = LockManager(engine)
+    cleaned = lock_manager.release_stale_locks(max_age_seconds=300)
+    if cleaned > 0:
+        logging.warning("Cleaned %d stale locks on startup", cleaned)
+    resources = discover_resources(config.root, config)
+    logger.debug("Discovered %d resources", len(resources))
+    return engine, lock_manager, resources
+
+
 def create_app(config: AdaptConfig) -> FastAPI:
     """Create and configure the FastAPI application.
 
@@ -216,28 +238,18 @@ def create_app(config: AdaptConfig) -> FastAPI:
         The configured FastAPI app instance.
     """
     logger.debug("Creating FastAPI app with config: %s", config)
-    engine = init_database(config.db_path)
-    cache.configure(str(config.db_path))
+    engine, lock_manager, resources = _init_infrastructure(config)
+
     app = FastAPI(title="Adapt", version=config.version, lifespan=lifespan, docs_url=None, redoc_url=None, openapi_url=None)
     app.state.config = config
     app.state.db_engine = engine
     app.state.use_tls = bool(config.tls_cert and config.tls_key)
+    app.state.lock_manager = lock_manager
+    app.state.resources = resources
 
     allowed_hosts = build_allowed_hosts(config.host)
     if allowed_hosts != ["*"]:
         app.add_middleware(TrustedHostMiddleware, allowed_hosts=allowed_hosts)
-    
-    # Initialize lock manager
-    lock_manager = LockManager(engine)
-    # Clean up stale locks from previous crash
-    cleaned = lock_manager.release_stale_locks(max_age_seconds=300)  # 5 minutes
-    if cleaned > 0:
-        logging.warning(f"Cleaned {cleaned} stale locks on startup")
-    app.state.lock_manager = lock_manager
-    
-    resources = discover_resources(config.root, config)
-    app.state.resources = resources
-    logger.debug("Discovered %d resources", len(resources))
 
     # Set up Jinja2 templates
     templates_dir = Path(__file__).parent / "templates"
@@ -276,8 +288,6 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.middleware("http")
     async def auth_middleware(request: Request, call_next):
         """Middleware to handle user authentication via session cookies."""
-        from .auth.session import get_session
-        from sqlmodel import Session
         token = request.cookies.get("adapt_session")
         request.state.user = None
         if token:
@@ -295,11 +305,9 @@ def create_app(config: AdaptConfig) -> FastAPI:
         return response
 
     # Mount authentication routes
-    from .auth import router as auth_router
     app.include_router(auth_router, prefix="", tags=["auth"])
 
     # Mount admin routes
-    from .admin import router as admin_router
     app.include_router(admin_router)
 
     # Generate and mount routes
@@ -365,18 +373,15 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.get("/ui/media")
     def media_gallery(request: Request):
         """Render the media gallery UI for authenticated users."""
-        from .auth.dependencies import get_current_user
         user = get_current_user(request)
         if not user:
-            # Redirect to login if not authenticated
             logger.debug("Unauthenticated access to media gallery, redirecting to login")
             return RedirectResponse(url=login_redirect_url("/ui/media"), status_code=302)
-        
+
         all_media = [r for r in request.app.state.resources if r.resource_type == "media"]
         if getattr(user, "is_superuser", False):
             permitted_media = all_media
         else:
-            from .permissions import PermissionChecker
             with Session(engine) as db:
                 checker = PermissionChecker(db)
                 permitted_media = [
@@ -384,7 +389,6 @@ def create_app(config: AdaptConfig) -> FastAPI:
                     if checker.has_permission(user, r.relative_path.with_suffix("").as_posix(), "read")
                 ]
         if not permitted_media and not getattr(user, "is_superuser", False):
-            from fastapi import HTTPException
             logger.warning("Permission denied for user %s: no accessible media resources", user.username)
             raise HTTPException(status_code=403, detail="No accessible media resources")
 
@@ -417,9 +421,6 @@ def create_app(config: AdaptConfig) -> FastAPI:
     @app.get("/")
     def root(request: Request):
         """Handle root requests, rendering HTML landing page or JSON API response."""
-        from .auth.dependencies import get_current_user
-        from .utils import build_accessible_ui_links
-        
         accept = request.headers.get("accept", "")
         if "text/html" in accept:
             # Render landing page
@@ -445,8 +446,6 @@ def create_app(config: AdaptConfig) -> FastAPI:
             return {"resources": resources}
 
     # Exception handler for auth redirects
-    from fastapi import HTTPException
-
     @app.exception_handler(HTTPException)
     async def auth_exception_handler(request: Request, exc: HTTPException):
         """Handle HTTP exceptions, redirecting to login for 401 errors in HTML requests."""

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/audit.py

@@ -1,3 +1,4 @@
+"""adapt.audit — Structured audit logging for user actions."""
 from __future__ import annotations
 
 import logging

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/auth/dependencies.py

@@ -1,15 +1,17 @@
+"""adapt.auth.dependencies — FastAPI dependency functions for authentication and authorization."""
 from fastapi import Request, HTTPException, status, Depends
 from sqlmodel import Session, select
 import logging
 
 from ..storage import User, UserGroup, GroupPermission, Permission
+from .session import get_session
+from ..api_keys import verify_api_key
 
 logger = logging.getLogger(__name__)
 
 def get_current_user(request: Request) -> User | None:
     """Get the current authenticated user from session or API key."""
     # 1. Try Session Cookie
-    from .session import get_session
     token = request.cookies.get("adapt_session")
     if token:
         with Session(request.app.state.db_engine) as db:
@@ -23,7 +25,6 @@ def get_current_user(request: Request) -> User | None:
     # 2. Try API Key
     api_key_header = request.headers.get("X-API-Key")
     if api_key_header:
-        from ..api_keys import verify_api_key
         with Session(request.app.state.db_engine) as db:
             user = verify_api_key(db, api_key_header)
             if user:

{adapt_server-0.2.2 → adapt_server-0.2.3}/adapt/auth/routes.py

@@ -3,15 +3,14 @@ from fastapi.responses import RedirectResponse
 from fastapi.security import OAuth2PasswordRequestForm
 from sqlmodel import Session, select
 from pydantic import BaseModel
-from datetime import datetime, timedelta, timezone
 import logging
 
 from ..storage import User, DBSession, APIKey, get_db_session
-from ..config import AdaptConfig
 from ..audit import log_action
-from ..api_keys import generate_api_key
+from ..api_keys import create_api_key_record, revoke_api_key_record
+from ..utils import build_accessible_ui_links
 from .password import verify_password
-from .session import create_session
+from .session import create_session, SESSION_COOKIE
 from .dependencies import require_auth
 from . import router
 
@@ -58,7 +57,6 @@ def login(form: OAuth2PasswordRequestForm = Depends(), request: Request = None,
 @router.post("/auth/logout")
 def logout(request: Request, response: Response):
     """Handle user logout."""
-    from .session import SESSION_COOKIE
     token = request.cookies.get(SESSION_COOKIE)
     if token:
         db_engine = request.app.state.db_engine
@@ -79,7 +77,6 @@ def logout(request: Request, response: Response):
 @router.get("/profile")
 def profile_page(request: Request, user: User = Depends(require_auth)):
     """Render the user profile page."""
-    from ..utils import build_accessible_ui_links
     ui_links = build_accessible_ui_links(request, user)
     logger.debug("Rendering profile page for user %s", user.username)
     return request.app.state.templates.TemplateResponse(request, "profile.html", {
@@ -103,45 +100,25 @@ def create_api_key(
     db: Session = Depends(get_db_session)
 ):
     """Create a new API key for the authenticated user."""
-    # Check if server is in read-only mode
     if req.app.state.config.readonly:
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
-    
+
     logger.debug("User %s creating API key", user.username)
-    
-    # Validate expiration
-    expires_at = None
-    if request.expires_in_days is not None:
-        if request.expires_in_days > 365:
-            raise HTTPException(status_code=400, detail="Expiration cannot exceed 1 year (365 days)")
-        expires_at = datetime.now(tz=timezone.utc) + timedelta(days=request.expires_in_days)
-    
-    # Generate key
-    raw_key, key_hash = generate_api_key()
-    
-    # Create API key record
-    api_key = APIKey(
-        key_hash=key_hash,
-        user_id=user.id,
-        description=request.description,
-        expires_at=expires_at,
-        created_at=datetime.now(tz=timezone.utc),
-        is_active=True
-    )
-    db.add(api_key)
-    db.commit()
-    db.refresh(api_key)
-    
-    # Log audit
+
+    try:
+        raw_key, api_key = create_api_key_record(db, user.id, request.description, request.expires_in_days)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
     log_action(req, "create_api_key", "apikey", f"Created API key for user {user.username}", user.id)
-    
     logger.info("User %s created API key %d", user.username, api_key.id)
+
     return {
         "id": api_key.id,
         "key": raw_key,  # Only returned once
         "description": api_key.description,
         "expires_at": api_key.expires_at.isoformat() if api_key.expires_at else None,
-        "created_at": api_key.created_at.isoformat()
+        "created_at": api_key.created_at.isoformat(),
     }
 
 
@@ -178,21 +155,14 @@ def revoke_api_key(
     db: Session = Depends(get_db_session)
 ):
     """Revoke an API key owned by the authenticated user."""
-    # Check if server is in read-only mode
     if req.app.state.config.readonly:
         raise HTTPException(status_code=405, detail="Server is in read-only mode")
-    
+
     logger.debug("User %s revoking API key %d", user.username, key_id)
-    
-    api_key = db.get(APIKey, key_id)
-    if not api_key or api_key.user_id != user.id:
+
+    api_key = revoke_api_key_record(db, key_id, owner_id=user.id)
+    if not api_key:
         raise HTTPException(status_code=404, detail="API key not found")
-    
-    api_key.is_active = False
-    db.add(api_key)
-    db.commit()
-    
-    # Log audit
+
     log_action(req, "revoke_api_key", "apikey", f"Revoked API key {key_id} for user {user.username}", user.id)
-    
     logger.info("User %s revoked API key %d", user.username, key_id)