bazaar-compute-node 0.2.1rc5__tar.gz → 0.2.1rc7__tar.gz

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazaar-compute-node
-Version: 0.2.1rc5
+Version: 0.2.1rc7
 Summary: Runtime-agnostic computer node daemon for agents and channels.
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
@@ -21,6 +21,9 @@ Requires-Dist: python-multipart>=0.0.32
 Requires-Dist: yarl>=1.18
 Requires-Dist: markdown-it-py>=4.2.0
 Requires-Dist: pygments>=2.20.0
+Requires-Dist: authlib>=1.8.0
+Requires-Dist: joserfc>=1.7.5
+Requires-Dist: httpx2>=2.13.1
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/yuchanns/bazaar-compute-node
 Description-Content-Type: text/markdown

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc5"
+version = "0.2.1rc7"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"
@@ -24,6 +24,9 @@ dependencies = [
     "yarl>=1.18",
     "markdown-it-py>=4.2.0",
     "pygments>=2.20.0",
+    "authlib>=1.8.0",
+    "joserfc>=1.7.5",
+    "httpx2>=2.13.1",
 ]
 
 [project.urls]

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc5"
+version = "0.2.1rc7"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"
@@ -24,6 +24,9 @@ dependencies = [
     "yarl>=1.18",
     "markdown-it-py>=4.2.0",
     "pygments>=2.20.0",
+    "authlib>=1.8.0",
+    "joserfc>=1.7.5",
+    "httpx2>=2.13.1",
 ]
 
 [project.urls]

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/access.py

@@ -0,0 +1,156 @@
+"""What the signed-in account may do and may see: the one place the pages ask."""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable, Sequence
+from functools import wraps
+
+from starlette.exceptions import HTTPException
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, Response
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from .permissions import Permission, PermissionHandler
+from .storage import Account, IStorage, Role
+
+type Handler[S] = Callable[[S, Request], Awaitable[Response]]
+
+
+class Access:
+    """Two kinds of permission point. A functional point says whether a
+    feature may be used at all (`computers.create`, `agents.update`, ...); a
+    data point says which objects of a kind may be touched, read from the
+    relations the account stands in. Roles, shares and the rights a share
+    carries all arrive here; the pages keep asking the same few things."""
+
+    def __init__(
+        self, account: Account, storage: IStorage, roles: Sequence[Role] = ()
+    ) -> None:
+        self._targets: dict[tuple[str, Permission], set[str]] = {}
+        self._account = account
+        self._storage = storage
+        self._permissions = frozenset(
+            point for role in roles for point in role.permissions
+        )
+
+    @classmethod
+    def of(cls, request: Request) -> Access:
+        """The one the AccessGate gave this request."""
+
+        return request.state.access
+
+    @property
+    def account(self) -> Account:
+        return self._account
+
+    @property
+    def subject_id(self) -> str:
+        """Whose relations a list query is scoped to."""
+
+        return self._account.id
+
+    @property
+    def is_admin(self) -> bool:
+        return self._account.auth_type == "local" and self._account.name == "admin"
+
+    def allows(self, point: Permission) -> bool:
+        return self.is_admin or point in self._permissions
+
+    async def can(self, kind: str, target_id: str, point: Permission) -> bool:
+        if not self.allows(point):
+            return False
+        return target_id in await self.targets(kind, point)
+
+    async def targets(self, kind: str, point: Permission) -> set[str]:
+        if not self.allows(point):
+            return set()
+        key = (kind, point)
+        if key not in self._targets:
+            self._targets[key] = await self._storage.allowed_targets(
+                self.subject_id, kind, point
+            )
+        return self._targets[key]
+
+    async def can_share(self, kind: str, target_id: str) -> bool:
+        return self.is_admin or await self._storage.has_relation(
+            self.subject_id, f"{kind}_owner", target_id
+        )
+
+    async def can_see(self, kind: str, target_id: str) -> bool:
+        point = (
+            Permission.COMPUTERS_VIEW if kind == "computer" else Permission.AGENTS_VIEW
+        )
+        return await self.can(kind, target_id, point)
+
+    async def visible(self, kind: str, target_ids: Sequence[str]) -> set[str]:
+        point = (
+            Permission.COMPUTERS_VIEW if kind == "computer" else Permission.AGENTS_VIEW
+        )
+        if not self.allows(point):
+            return set()
+        return set(target_ids) & await self.targets(kind, point)
+
+
+def allowed[S](
+    point: Permission, kind: str | None = None
+) -> Callable[[Handler[S]], Handler[S]]:
+    """The handler is behind a functional point: without it, there is no
+    such page."""
+
+    permission = PermissionHandler(point, kind)
+
+    def guard(handler: Handler[S]) -> Handler[S]:
+        @wraps(handler)
+        async def guarded(self: S, request: Request) -> Response:
+            if not Access.of(request).allows(point):
+                raise HTTPException(status_code=403)
+            if not await permission(Access.of(request), request.path_params):
+                return HTMLResponse("", status_code=404)
+            return await handler(self, request)
+
+        return guarded
+
+    return guard
+
+
+def sees[S](kind: str, param: str) -> Callable[[Handler[S]], Handler[S]]:
+    """The handler is about one object of a kind, named by a path parameter:
+    one the account may not see is not there."""
+
+    def guard(handler: Handler[S]) -> Handler[S]:
+        @wraps(handler)
+        async def guarded(self: S, request: Request) -> Response:
+            access = Access.of(request)
+            target_id = request.path_params[param]
+            if kind == "computer" and "agent_id" in request.path_params:
+                agent_id = request.path_params["agent_id"]
+                visible = await access.can_see("agent", agent_id)
+                computer_id = await access._storage.agent_computer(agent_id)
+                if not visible or computer_id != target_id:
+                    return HTMLResponse("", status_code=404)
+            elif not await access.can_see(kind, target_id):
+                return HTMLResponse("", status_code=404)
+            return await handler(self, request)
+
+        return guarded
+
+    return guard
+
+
+class AccessGate:
+    """Behind the Gate: gives every request that has an account its Access."""
+
+    def __init__(self, app: ASGIApp, *, storage: IStorage) -> None:
+        self._app = app
+        self._storage = storage
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        state = scope.get("state")
+        if state is not None and "account" in state:
+            account = state["account"]
+            roles = await self._storage.list_roles(account.id)
+            state["access"] = Access(account, self._storage, roles)
+        await self._app(scope, receive, send)
+
+
+__all__ = ["Access", "AccessGate", "allowed", "sees"]

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/src/bazaar_compute_server/app.py

@@ -54,7 +54,7 @@ def create_app(configuration: ServerConfiguration, data_dir: Path) -> Starlette:
         )
     )
 
-    sessions = Sessions()
+    sessions = Sessions(max_age=configuration.session_minutes * 60)
     images = Images(sessions)
     refs = Refs(storage)
     controls = Controls()

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/src/bazaar_compute_server/cli.py

@@ -41,6 +41,8 @@ def run(config: Path | None) -> None:
         host=configuration.listen_host,
         port=configuration.listen_port,
         log_level="info",
+        # OIDC callback query strings contain one-time codes and state.
+        access_log=False,
         # going down comes first: a node's poll held open or a page still
         # waiting on a computer is not waited out past this
         timeout_graceful_shutdown=SHUTDOWN_SECONDS,

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/src/bazaar_compute_server/config.py

@@ -23,6 +23,7 @@ class ServerConfiguration(BaseModel):
     # host and port, read the way a URL is: `127.0.0.1:8765`, `[::1]:8765`,
     # or the same with a scheme in front
     listen: str = "127.0.0.1:8765"
+    session_minutes: int = Field(default=10, ge=1, strict=True)
     retention_days: int = Field(default=30, ge=1, strict=True)
     storage: str = Field(default="sqlite", min_length=1)
     # a storage's own settings live in a table named after it
@@ -103,6 +104,7 @@ def _serialize(configuration: ServerConfiguration) -> str:
     lines = [
         f'listen = "{configuration.listen}"',
         f"retention_days = {configuration.retention_days}",
+        f"session_minutes = {configuration.session_minutes}",
         f'storage = "{configuration.storage}"',
     ]
     return "\n".join(lines) + "\n"

{bazaar_compute_node-0.2.1rc5 → bazaar_compute_node-0.2.1rc7}/src/bazaar_compute_server/contrib/sqlite/migrations/registry.py

@@ -10,6 +10,10 @@ from ....clock import now_ms
 from .model import Migration
 from .v01_initial_server_schema import SCHEMA_MIGRATION
 from .v02_refs import REFS_MIGRATION
+from .v03_roles_oidc import ROLES_OIDC_MIGRATION
+from .v04_login_order import LOGIN_ORDER_MIGRATION
+from .v05_provider_description import PROVIDER_DESCRIPTION_MIGRATION
+from .v06_provider_default_role import PROVIDER_DEFAULT_ROLE_MIGRATION
 
 
 class MigrationError(RuntimeError):
@@ -27,7 +31,14 @@ def _migration_ledger(*migrations: Migration) -> tuple[Migration, ...]:
     return migrations
 
 
-MIGRATIONS = _migration_ledger(SCHEMA_MIGRATION, REFS_MIGRATION)
+MIGRATIONS = _migration_ledger(
+    SCHEMA_MIGRATION,
+    REFS_MIGRATION,
+    ROLES_OIDC_MIGRATION,
+    LOGIN_ORDER_MIGRATION,
+    PROVIDER_DESCRIPTION_MIGRATION,
+    PROVIDER_DEFAULT_ROLE_MIGRATION,
+)
 
 
 async def apply_migrations(connection: aiosqlite.Connection) -> int:

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/contrib/sqlite/migrations/v03_roles_oidc.py

@@ -0,0 +1,51 @@
+"""Roles and external login identities for BCS."""
+
+from .model import Migration
+
+ROLES_OIDC_MIGRATION = Migration(
+    version=3,
+    name="roles_oidc",
+    statements=(
+        "ALTER TABLE accounts ADD COLUMN auth_type TEXT NOT NULL DEFAULT 'local'",
+        "ALTER TABLE accounts ADD COLUMN session_version INTEGER NOT NULL DEFAULT 0",
+        """CREATE TABLE roles (
+            id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE,
+            permissions TEXT NOT NULL, created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )""",
+        """CREATE TABLE account_roles (
+            account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+            role_id TEXT NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+            PRIMARY KEY(account_id, role_id)
+        )""",
+        "CREATE INDEX account_roles_by_role ON account_roles(role_id)",
+        """CREATE TABLE auth_settings (
+            id INTEGER PRIMARY KEY CHECK(id = 1),
+            default_role_id TEXT REFERENCES roles(id)
+        )""",
+        "INSERT INTO auth_settings(id) VALUES (1)",
+        """CREATE TABLE oidc_providers (
+            id TEXT PRIMARY KEY, name TEXT NOT NULL, logo_url TEXT NOT NULL,
+            issuer TEXT NOT NULL, client_id TEXT NOT NULL, client_secret TEXT NOT NULL,
+            redirect_uri TEXT NOT NULL, created_at_ms INTEGER NOT NULL,
+            updated_at_ms INTEGER NOT NULL
+        )""",
+        """CREATE TABLE oidc_identities (
+            issuer TEXT NOT NULL, subject TEXT NOT NULL,
+            account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+            provider_id TEXT NOT NULL REFERENCES oidc_providers(id),
+            display_name TEXT NOT NULL, email TEXT NOT NULL,
+            PRIMARY KEY(issuer, subject)
+        )""",
+        "CREATE INDEX oidc_identities_by_account ON oidc_identities(account_id)",
+        """CREATE TABLE oidc_transactions (
+            state TEXT PRIMARY KEY,
+            provider_id TEXT NOT NULL REFERENCES oidc_providers(id) ON DELETE CASCADE,
+            browser_hash TEXT NOT NULL, nonce TEXT NOT NULL,
+            code_verifier TEXT NOT NULL, redirect_uri TEXT NOT NULL,
+            expires_at_ms INTEGER NOT NULL,
+            issuer TEXT NOT NULL DEFAULT '', subject TEXT NOT NULL DEFAULT ''
+        )""",
+        "CREATE INDEX oidc_transactions_by_expiry ON oidc_transactions(expires_at_ms)",
+    ),
+)

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/contrib/sqlite/migrations/v04_login_order.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from .model import Migration
+
+LOGIN_ORDER_MIGRATION = Migration(
+    version=4,
+    name="login_order",
+    statements=(
+        "ALTER TABLE auth_settings ADD COLUMN login_order TEXT NOT NULL DEFAULT '[\"password\"]'",
+        (
+            "UPDATE auth_settings SET login_order=(SELECT json_group_array(id) FROM "
+            "(SELECT 'password' AS id UNION ALL SELECT id FROM "
+            "(SELECT id FROM oidc_providers ORDER BY created_at_ms, id))) WHERE id=1"
+        ),
+    ),
+)

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/contrib/sqlite/migrations/v05_provider_description.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from .model import Migration
+
+PROVIDER_DESCRIPTION_MIGRATION = Migration(
+    version=5,
+    name="provider_description",
+    statements=(
+        "ALTER TABLE oidc_providers ADD COLUMN description TEXT NOT NULL DEFAULT ''",
+    ),
+)

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/contrib/sqlite/migrations/v06_provider_default_role.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from .model import Migration
+
+PROVIDER_DEFAULT_ROLE_MIGRATION = Migration(
+    version=6,
+    name="provider_default_role",
+    statements=(
+        "ALTER TABLE oidc_providers ADD COLUMN default_role_id TEXT REFERENCES roles(id)",
+    ),
+)