bazaar-compute-node 0.2.1rc7__tar.gz → 0.2.1rc9__tar.gz

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazaar-compute-node
-Version: 0.2.1rc7
+Version: 0.2.1rc9
 Summary: Runtime-agnostic computer node daemon for agents and channels.
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc7"
+version = "0.2.1rc9"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc7"
+version = "0.2.1rc9"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/contrib/sqlite/migrations/registry.py

@@ -14,6 +14,7 @@ from .v03_roles_oidc import ROLES_OIDC_MIGRATION
 from .v04_login_order import LOGIN_ORDER_MIGRATION
 from .v05_provider_description import PROVIDER_DESCRIPTION_MIGRATION
 from .v06_provider_default_role import PROVIDER_DEFAULT_ROLE_MIGRATION
+from .v07_oidc_session_settings import OIDC_SESSION_SETTINGS_MIGRATION
 
 
 class MigrationError(RuntimeError):
@@ -38,6 +39,7 @@ MIGRATIONS = _migration_ledger(
     LOGIN_ORDER_MIGRATION,
     PROVIDER_DESCRIPTION_MIGRATION,
     PROVIDER_DEFAULT_ROLE_MIGRATION,
+    OIDC_SESSION_SETTINGS_MIGRATION,
 )
 
 

bazaar_compute_node-0.2.1rc9/src/bazaar_compute_server/contrib/sqlite/migrations/v07_oidc_session_settings.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from .model import Migration
+
+OIDC_SESSION_SETTINGS_MIGRATION = Migration(
+    version=7,
+    name="oidc_session_settings",
+    statements=(
+        "ALTER TABLE oidc_providers ADD COLUMN session_minutes INTEGER NOT NULL DEFAULT 10",
+        "DROP TABLE oidc_transactions",
+    ),
+)

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/contrib/sqlite/storage.py

@@ -15,7 +15,7 @@ from uuid import uuid7
 import aiosqlite
 
 from ...clock import now_ms
-from ...permissions import Permission
+from ...permissions import SHARE_POINTS, Permission
 from ...protocol import Event
 from ...secrets import derive, hash_secret, new_secret, verify_secret
 from ...storage import (
@@ -25,7 +25,6 @@ from ...storage import (
     Enrolment,
     IStorage,
     OIDCProvider,
-    OIDCTransaction,
     Role,
     RoleShare,
     StoredEvent,
@@ -300,10 +299,10 @@ class SqliteStorage(IStorage):
     async def save_oidc_provider(self, provider: OIDCProvider) -> None:
         async def save(db: aiosqlite.Connection) -> None:
             await db.execute(
-                "INSERT INTO oidc_providers(id,name,logo_url,issuer,client_id,client_secret,redirect_uri,created_at_ms,updated_at_ms,description,default_role_id)"
-                " VALUES (?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET"
+                "INSERT INTO oidc_providers(id,name,logo_url,issuer,client_id,client_secret,redirect_uri,created_at_ms,updated_at_ms,description,default_role_id,session_minutes)"
+                " VALUES (?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET"
                 " name=excluded.name,logo_url=excluded.logo_url,issuer=excluded.issuer,client_id=excluded.client_id,"
-                " client_secret=excluded.client_secret,redirect_uri=excluded.redirect_uri,updated_at_ms=excluded.updated_at_ms,description=excluded.description,default_role_id=excluded.default_role_id",
+                " client_secret=excluded.client_secret,redirect_uri=excluded.redirect_uri,updated_at_ms=excluded.updated_at_ms,description=excluded.description,default_role_id=excluded.default_role_id,session_minutes=excluded.session_minutes",
                 (
                     provider.id,
                     provider.name,
@@ -316,6 +315,7 @@ class SqliteStorage(IStorage):
                     provider.updated_at_ms,
                     provider.description,
                     provider.default_role_id,
+                    provider.session_minutes,
                 ),
             )
             await db.execute(
@@ -376,41 +376,6 @@ class SqliteStorage(IStorage):
 
         return await self._write(resolve)
 
-    async def save_oidc_transaction(self, transaction: OIDCTransaction) -> None:
-        async def save(db: aiosqlite.Connection) -> None:
-            await db.execute(
-                "DELETE FROM oidc_transactions WHERE expires_at_ms <= ?", (now_ms(),)
-            )
-            await db.execute(
-                "INSERT INTO oidc_transactions(state,provider_id,browser_hash,nonce,code_verifier,redirect_uri,expires_at_ms,issuer,subject) VALUES (?,?,?,?,?,?,?,?,?)",
-                (
-                    transaction.state,
-                    transaction.provider_id,
-                    transaction.browser_hash,
-                    transaction.nonce,
-                    transaction.code_verifier,
-                    transaction.redirect_uri,
-                    transaction.expires_at_ms,
-                    transaction.issuer,
-                    transaction.subject,
-                ),
-            )
-
-        await self._write(save)
-
-    async def consume_oidc_transaction(
-        self, state: str, browser_hash: str, provider_id: str
-    ) -> OIDCTransaction | None:
-        async def consume(db: aiosqlite.Connection) -> OIDCTransaction | None:
-            async with db.execute(
-                "DELETE FROM oidc_transactions WHERE state=? AND browser_hash=? AND provider_id=? AND expires_at_ms>? RETURNING *",
-                (state, browser_hash, provider_id, now_ms()),
-            ) as rows:
-                row = await rows.fetchone()
-            return None if row is None else OIDCTransaction(**dict(row))
-
-        return await self._write(consume)
-
     async def list_role_shares(self, kind: str, target_id: str) -> list[RoleShare]:
         async with (
             self._reader() as db,
@@ -514,7 +479,7 @@ class SqliteStorage(IStorage):
     async def allowed_targets(
         self, account_id: str, kind: str, point: Permission
     ) -> set[str]:
-        """Ownership and the union of role grants, including explicit computer-to-agent grants."""
+        """Ownership and grants explicitly attached to this resource kind."""
         account = await self.get_account(account_id)
         if account is None:
             return set()
@@ -537,26 +502,15 @@ class SqliteStorage(IStorage):
                 (account_id, f"{kind}_owner"),
             ) as rows:
                 targets = {row["target_id"] async for row in rows}
+            if point not in SHARE_POINTS[kind]:
+                return targets
             async with db.execute(
-                "SELECT kind,target_id,ext FROM relations WHERE subject_id IN (SELECT role_id FROM account_roles WHERE account_id=?) AND kind IN (?,?)",
-                (account_id, f"{kind}_share_role", "computer_share_role"),
+                "SELECT target_id,ext FROM relations WHERE subject_id IN (SELECT role_id FROM account_roles WHERE account_id=?) AND kind=?",
+                (account_id, f"{kind}_share_role"),
             ) as rows:
-                grants = await rows.fetchall()
-            computers = set()
-            for grant in grants:
-                if point not in json.loads(grant["ext"])["permissions"]:
-                    continue
-                if grant["kind"] == f"{kind}_share_role":
-                    targets.add(grant["target_id"])
-                elif kind == "agent":
-                    computers.add(grant["target_id"])
-            if computers:
-                async with db.execute(
-                    "SELECT target_id,ext FROM relations WHERE kind='agent_owner'"
-                ) as rows:
-                    async for row in rows:
-                        if json.loads(row["ext"])["computer_id"] in computers:
-                            targets.add(row["target_id"])
+                async for row in rows:
+                    if point in json.loads(row["ext"])["permissions"]:
+                        targets.add(row["target_id"])
             return targets
 
     # ---- accounts --------------------------------------------------------

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/fleet.py

@@ -219,7 +219,7 @@ async def _views(
     visible = await access.visible("agent", [agent.id for agent in agents_of(views)])
     computer_actions = {
         point: await access.targets("computer", point)
-        for point in SHARE_POINTS["computer"]
+        for point in (*SHARE_POINTS["computer"], Permission.COMPUTERS_SHARE)
     }
     agent_actions = {
         point: await access.targets("agent", point) for point in SHARE_POINTS["agent"]

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/gate.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from urllib.parse import urlencode, urlsplit
+
 from starlette.requests import Request
 from starlette.responses import RedirectResponse, Response
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
@@ -106,6 +108,23 @@ def _to_login(request: Request) -> Response:
     destination = (
         "/login/oidc/resume" if request.cookies.get(reauth.COOKIE) else LOGIN_PATH
     )
+    if request.cookies.get(reauth.COOKIE):
+        # Partial requests name the page in the browser, not the fragment endpoint.
+        if request.headers.get("HX-Request") == "true":
+            current = request.headers.get("HX-Current-URL", "")
+        elif request.method in ("GET", "HEAD"):
+            current = str(request.url)
+        else:
+            current = request.headers.get("Referer", "")
+        try:
+            current = urlsplit(current)
+            origin = urlsplit(str(request.url))
+            if (current.scheme, current.netloc) == (origin.scheme, origin.netloc):
+                destination += "?" + urlencode(
+                    {"return_to": current._replace(scheme="", netloc="").geturl()}
+                )
+        except ValueError:
+            pass
     # htmx cannot follow a redirect into the shell; it is told to go there whole
     if request.headers.get("HX-Request") == "true":
         return Response(status_code=401, headers={"HX-Redirect": destination})

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/pages/computers.py

@@ -19,6 +19,7 @@ from ..protocol import MAX_NAME_CHARS
 from ..refs import Refs, expanded
 from ..rendering import Renderer
 from ..storage import IStorage
+from .shares import SharePages
 
 
 class ComputerPages:
@@ -71,6 +72,15 @@ class ComputerPages:
         self, request: Request, page: Fleet, selected: ComputerView | None, *, view: str
     ) -> Response:
         await self.refs.load(_named(page.computers, selected))
+        context = {}
+        if (
+            selected is not None
+            and request.query_params.get("tab") == "sharing"
+            and Permission.COMPUTERS_SHARE in selected.actions
+        ):
+            context = await SharePages(self._storage, self._render, self.refs).context(
+                request, "computer", selected.computer.id
+            )
         return self._render.page(
             request,
             "computers",
@@ -83,6 +93,7 @@ class ComputerPages:
             else str(self.refs.ref(selected.computer.id)),
             enrolment=None,
             view=view,
+            **context,
         )
 
     @allowed(Permission.COMPUTERS_VIEW)
@@ -127,7 +138,17 @@ class ComputerPages:
         selected = await self._selected(request)
         if selected is None:
             return HTMLResponse("", status_code=404)
-        return self._render.fragment(request, "computer_detail.html", selected=selected)
+        context = {}
+        if (
+            request.query_params.get("tab") == "sharing"
+            and Permission.COMPUTERS_SHARE in selected.actions
+        ):
+            context = await SharePages(self._storage, self._render, self.refs).context(
+                request, "computer", selected.computer.id
+            )
+        return self._render.fragment(
+            request, "computer_detail.html", selected=selected, **context
+        )
 
     @expanded("computer_id")
     @allowed(Permission.COMPUTERS_VIEW, "computer")

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/pages/oidc.py

@@ -38,6 +38,7 @@ class ProviderForm(BaseModel):
         str, StringConstraints(strip_whitespace=True, max_length=200)
     ] = ""
     default_role_id: str = ""
+    session_minutes: int = Field(default=10, ge=1)
 
     clear_logo: bool = False
     issuer: HttpUrl
@@ -127,6 +128,7 @@ class OIDCPages:
                 "name": selected.name if selected else "",
                 "description": selected.description if selected else "",
                 "default_role_id": (selected.default_role_id or "") if selected else "",
+                "session_minutes": str(selected.session_minutes if selected else 10),
                 "logo_url": selected.logo_url if selected else "",
                 "issuer": selected.issuer if selected else "",
                 "client_id": selected.client_id if selected else "",
@@ -179,6 +181,7 @@ class OIDCPages:
                 "redirect_uri",
             )
         }
+        values["session_minutes"] = str(form.get("session_minutes", "10"))
         values["logo_url"] = selected.logo_url if selected else ""
         logo = form.get("logo")
         logo_url = values["logo_url"]
@@ -241,6 +244,7 @@ class OIDCPages:
             now_ms(),
             description=parsed.description,
             default_role_id=parsed.default_role_id or None,
+            session_minutes=parsed.session_minutes,
         )
         await self._storage.save_oidc_provider(provider)
         await self.refs.load([provider.id])

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/pages/oidc_login.py

@@ -1,30 +1,60 @@
-"""OIDC protocol calls with single-use, browser-bound transactions in BCS storage."""
+"""OIDC protocol calls with short-lived, single-use in-memory login state."""
 
 from __future__ import annotations
 
+from collections import OrderedDict
 from hashlib import sha256
+from pathlib import PurePosixPath
 from secrets import token_urlsafe
 
 from authlib.integrations.base_client import OAuthError
 from authlib.integrations.starlette_client import StarletteOAuth2App
 from httpx2 import HTTPError
 from joserfc.errors import JoseError
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, Field, ValidationError, field_validator
 from starlette.requests import Request
 from starlette.responses import RedirectResponse, Response
+from yarl import URL
 
 from .. import reauth
 from ..clock import now_ms
 from ..gate import set_session
 from ..rendering import Renderer
 from ..sessions import Sessions
-from ..storage import IStorage, OIDCProvider, OIDCTransaction
+from ..storage import IStorage, OIDCProvider
 from .login import HOME
 
 LIFETIME = 600
+MAX_TRANSACTIONS = 1024
 COOKIE = "bcs_oidc"
 
 
+class Destination(BaseModel):
+    return_to: str = Field(default=HOME, max_length=8192)
+
+    @field_validator("return_to")
+    @classmethod
+    def local_path(cls, value: str) -> str:
+        url = URL(value)
+        path = PurePosixPath(url.raw_path)
+        if url.scheme or url.authority or path.root != "/":
+            raise ValueError("return_to must be a local absolute path")
+        return str(
+            url.with_path(str(path), encoded=True, keep_query=True, keep_fragment=True)
+        )
+
+
+class Transaction(Destination):
+    expires_at_ms: int
+    browser_hash: str
+    provider_id: str
+    nonce: str
+    code_verifier: str
+    redirect_uri: str
+    issuer: str
+    subject: str
+
+
 class Callback(BaseModel):
     state: str = Field(min_length=1, max_length=256)
     code: str = Field(default="", max_length=8192)
@@ -39,8 +69,8 @@ class Identity(BaseModel):
 
 
 def client(provider: OIDCProvider) -> StarletteOAuth2App:
-    # BCS stores/consumes state itself; these Authlib protocol methods do not
-    # use the framework session adapter or expose protocol data in cookies.
+    # BCS keeps login state in memory rather than the framework session adapter.
+    # Authlib handles the protocol and token checks.
     return StarletteOAuth2App(
         framework=None,
         client_id=provider.client_id,
@@ -62,6 +92,7 @@ class OIDCLoginPages:
         self._storage = storage
         self._render = renderer
         self._sessions = sessions
+        self._transactions: OrderedDict[str, Transaction] = OrderedDict()
 
     async def failure(self, request: Request, reason: str) -> Response:
         response = self._render.standalone(
@@ -106,6 +137,10 @@ class OIDCLoginPages:
     async def _start(
         self, request: Request, provider: OIDCProvider, hint: reauth.Hint | None = None
     ) -> Response:
+        try:
+            destination = Destination.model_validate(dict(request.query_params))
+        except ValidationError:
+            destination = Destination()
         state, nonce, verifier, browser = (token_urlsafe(32) for _ in range(4))
         oauth = client(provider)
         try:
@@ -121,19 +156,24 @@ class OIDCLoginPages:
             )
         except HTTPError, OAuthError, ValueError, KeyError, RuntimeError:
             return await self.failure(request, "oidc.unavailable")
-        await self._storage.save_oidc_transaction(
-            OIDCTransaction(
-                state,
-                provider.id,
-                sha256(browser.encode()).hexdigest(),
-                nonce,
-                verifier,
-                provider.redirect_uri,
-                now_ms() + LIFETIME * 1000,
-                hint.issuer if hint else "",
-                hint.subject if hint else "",
-            )
+        self._transactions[state] = Transaction(
+            expires_at_ms=now_ms() + LIFETIME * 1000,
+            browser_hash=sha256(browser.encode()).hexdigest(),
+            provider_id=provider.id,
+            nonce=nonce,
+            code_verifier=verifier,
+            redirect_uri=provider.redirect_uri,
+            issuer=hint.issuer if hint else "",
+            subject=hint.subject if hint else "",
+            return_to=destination.return_to,
         )
+        # Each entry is read only when consumed, so the oldest pending entry
+        # is also the least recently used one.
+        while self._transactions and (
+            len(self._transactions) > MAX_TRANSACTIONS
+            or next(iter(self._transactions.values())).expires_at_ms <= now_ms()
+        ):
+            self._transactions.popitem(last=False)
         response = RedirectResponse(authorization["url"], status_code=302)
         response.delete_cookie(reauth.COOKIE, path="/")
         response.set_cookie(
@@ -154,13 +194,16 @@ class OIDCLoginPages:
             values = Callback.model_validate(dict(request.query_params))
         except ValidationError:
             return await self.failure(request, "oidc.expired")
-        transaction = await self._storage.consume_oidc_transaction(
-            values.state,
-            sha256(request.cookies.get(COOKIE, "").encode()).hexdigest(),
-            request.path_params["provider_id"],
-        )
-        if transaction is None:
+        transaction = self._transactions.get(values.state)
+        if (
+            transaction is None
+            or transaction.expires_at_ms <= now_ms()
+            or transaction.browser_hash
+            != sha256(request.cookies.get(COOKIE, "").encode()).hexdigest()
+            or request.path_params["provider_id"] != transaction.provider_id
+        ):
             return await self.failure(request, "oidc.expired")
+        self._transactions.pop(values.state)
         if values.error or not values.code:
             return await self.failure(request, "oidc.failed")
         provider = await self._storage.get_oidc_provider(transaction.provider_id)
@@ -203,12 +246,12 @@ class OIDCLoginPages:
             )
         except ValueError:
             return await self.failure(request, "oidc.default_required")
-        response = RedirectResponse(HOME, status_code=302)
+        response = RedirectResponse(transaction.return_to, status_code=302)
         set_session(
             response,
-            self._sessions.issue(account),
+            self._sessions.issue(account, max_age=provider.session_minutes * 60),
             request=request,
-            max_age=self._sessions.max_age,
+            max_age=provider.session_minutes * 60,
         )
         response.delete_cookie(COOKIE, path="/login/oidc")
         hint = reauth.Hint(

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/pages/profile.py

@@ -352,9 +352,9 @@ class ProfilePages:
         """What one tab shows."""
 
         if tab == "sharing":
-            return await SharePages(
-                self._storage, self._render, self.refs
-            ).agent_context(request)
+            return await SharePages(self._storage, self._render, self.refs).context(
+                request, "agent", request.path_params["agent_id"]
+            )
         if tab == "config":
             agents, reply = await asyncio.gather(
                 held(

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/pages/shares.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 from typing import Any
 
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, ValidationError
 from starlette.requests import Request
 from starlette.responses import HTMLResponse, Response
 
@@ -15,11 +15,6 @@ from ..rendering import Renderer
 from ..storage import IStorage
 
 
-class ShareForm(BaseModel):
-    role: str
-    permissions: list[Permission] = Field(default_factory=list)
-
-
 class ShareChanges(BaseModel):
     grants: dict[str, frozenset[Permission]]
 
@@ -46,7 +41,10 @@ class SharePages:
         target_id = request.path_params["agent_id"]
         if not await access.can_share("agent", target_id):
             return HTMLResponse("", status_code=404)
-        context = await self.agent_context(request)
+        return await self._handle(request, "agent", target_id)
+
+    async def _handle(self, request: Request, kind: str, target_id: str) -> Response:
+        context = await self.context(request, kind, target_id)
         error = None
         if request.method == "POST":
             form = await request.form()
@@ -64,92 +62,46 @@ class SharePages:
                 else:
                     try:
                         await self._storage.save_role_shares(
-                            "agent", target_id, values.grants, points
+                            kind, target_id, values.grants, points
                         )
                     except LookupError:
                         error = "shares.invalid"
                     else:
-                        context = await self.agent_context(request)
+                        context = await self.context(request, kind, target_id)
         context["error"] = error
-        return self._render.fragment(request, "agent_profile_sharing.html", **context)
+        return self._render.fragment(request, "shares.html", **context)
 
-    async def agent_context(self, request: Request) -> dict[str, Any]:
+    async def context(
+        self, request: Request, kind: str, target_id: str
+    ) -> dict[str, Any]:
         access = Access.of(request)
-        target_id = request.path_params["agent_id"]
         points = [
             point
-            for point in SHARE_POINTS["agent"]
-            if await access.can("agent", target_id, point)
+            for point in SHARE_POINTS[kind]
+            if await access.can(kind, target_id, point)
         ]
         roles = await self._storage.list_roles()
-        shares = await self._storage.list_role_shares("agent", target_id)
+        shares = await self._storage.list_role_shares(kind, target_id)
         grants = {
             share.role_id: sorted(share.permissions & set(points)) for share in shares
         }
+        key = self.refs.ref(target_id)
+        url = (
+            f"/computers/{key}/shares"
+            if kind == "computer"
+            else f"/agents/{self.refs.ref(request.path_params['computer_id'])}/{key}/shares"
+        )
         return {
             "points": points,
+            "share_kind": kind,
+            "share_id": f"computer-sharing-{key}"
+            if kind == "computer"
+            else "agent-sharing",
             "share_data": {
                 "roles": [{"id": role.id, "name": role.name} for role in roles],
                 "grants": grants,
+                "default": f"{kind}s.view",
             },
-            "share_url": f"/agents/{self.refs.ref(request.path_params['computer_id'])}/{self.refs.ref(target_id)}/shares",
+            "share_url": url,
             "error": None,
         }
-
-    async def _handle(self, request: Request, kind: str, target_id: str) -> Response:
-        access = Access.of(request)
-        roles = await self._storage.list_roles()
-        points = [
-            point
-            for point in SHARE_POINTS[kind]
-            if await access.can(kind, target_id, point)
-        ]
-        error = None
-        saved = False
-        selected = request.query_params.get("role")
-        if request.method == "POST":
-            form = await request.form()
-            try:
-                values = ShareForm.model_validate(
-                    {
-                        "role": form.get("role"),
-                        "permissions": form.getlist("permissions"),
-                    }
-                )
-            except ValidationError:
-                error = "shares.invalid"
-            else:
-                selected = values.role
-                if selected not in {role.id for role in roles} or not set(
-                    values.permissions
-                ) <= set(points):
-                    error = "shares.invalid"
-                else:
-                    try:
-                        await self._storage.save_role_shares(
-                            kind,
-                            target_id,
-                            {selected: frozenset(values.permissions)},
-                            frozenset(points),
-                        )
-                    except LookupError:
-                        error = "shares.invalid"
-                    else:
-                        saved = True
-        if selected is None and roles:
-            selected = roles[0].id
-        if selected is not None and selected not in {role.id for role in roles}:
-            return HTMLResponse("", status_code=404)
-        shares = await self._storage.list_role_shares(kind, target_id)
-        return self._render.fragment(
-            request,
-            "shares.html",
-            kind=kind,
-            roles=roles,
-            selected=selected,
-            points=points,
-            grants={share.role_id: share.permissions for share in shares},
-            url=request.url.path,
-            error=error,
-            saved=saved,
-        )

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc9}/src/bazaar_compute_server/permissions.py

@@ -74,16 +74,16 @@ POLL_HANDLERS = MappingProxyType(
 
 SHARE_POINTS = MappingProxyType(
     {
-        "computer": tuple(
-            point
-            for point in Permission
-            if point.module in ("computers", "agents")
-            and point != Permission.COMPUTERS_CREATE
+        "computer": (
+            Permission.COMPUTERS_VIEW,
+            Permission.AGENTS_CREATE,
+            Permission.COMPUTERS_DELETE,
         ),
-        "agent": tuple(
-            point
-            for point in Permission
-            if point.module == "agents" and point != Permission.AGENTS_CREATE
+        "agent": (
+            Permission.AGENTS_VIEW,
+            Permission.AGENTS_UPDATE,
+            Permission.AGENTS_DELETE,
+            Permission.AGENTS_APPROVE,
         ),
     }
 )