canvas 0.29.1__tar.gz → 0.31.0__tar.gz

{canvas-0.29.1 → canvas-0.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: canvas
-Version: 0.29.1
+Version: 0.31.0
 Summary: SDK to customize event-driven actions in your Canvas instance
 Author-email: Canvas Team <engineering@canvasmedical.com>
 License-Expression: MIT

{canvas-0.29.1 → canvas-0.31.0}/canvas_cli/utils/validators/manifest_schema.py

@@ -81,6 +81,7 @@ manifest_schema = {
                                 "SCRIPTS",
                                 "ALLOW_SAME_ORIGIN",
                                 "MICROPHONE",
+                                "CAMERA",
                             ],
                         },
                     },

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/effects/protocol_card/protocol_card.py

@@ -39,6 +39,9 @@ class ProtocolCard(_BaseEffect):
     class Status(Enum):
         DUE = "due"
         SATISFIED = "satisfied"
+        NOT_APPLICABLE = "not_applicable"
+        PENDING = "pending"
+        NOT_RELEVANT = "not_relevant"
 
     class Meta:
         effect_type = EffectType.ADD_OR_UPDATE_PROTOCOL_CARD

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/handlers/base.py

@@ -13,6 +13,7 @@ version = importlib.metadata.version("canvas")
 class BaseHandler(ABC):
     """The class that all handlers inherit from."""
 
+    environment: dict[str, Any]
     secrets: dict[str, Any]
     event: Event
 
@@ -20,9 +21,11 @@ class BaseHandler(ABC):
         self,
         event: Event,
         secrets: dict[str, Any] | None = None,
+        environment: dict[str, Any] | None = None,
     ) -> None:
         self.event = event
         self.secrets = secrets or {}
+        self.environment = environment or {}
 
     @property
     @deprecation.deprecated(

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/handlers/simple_api/__init__.py

@@ -7,6 +7,9 @@ from .security import (
     BasicCredentials,
     BearerCredentials,
     Credentials,
+    PatientSessionAuthMixin,
+    SessionCredentials,
+    StaffSessionAuthMixin,
 )
 
 __all__ = [
@@ -17,6 +20,9 @@ __all__ = [
     "BasicCredentials",
     "BearerCredentials",
     "Credentials",
+    "PatientSessionAuthMixin",
+    "SessionCredentials",
     "SimpleAPI",
     "SimpleAPIRoute",
+    "StaffSessionAuthMixin",
 ]

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/handlers/simple_api/security.py

@@ -114,6 +114,39 @@ class APIKeyCredentials(Credentials):
         self.key = key
 
 
+class SessionCredentials(Credentials):
+    """
+    Session credentials class.
+
+    Looks for headers set by Canvas with information about the logged in user based on browser
+    cookies and session information in the Canvas database. These headers are removed if received by
+    the client and intentionally set by Canvas only if there is a valid session from an active user.
+
+    One must look at the type of user in order to understand what the id refers to – a patient or a
+    staff member.
+
+    If a SimpleAPI handler is protected by SessionCredentials, the non-presence of these headers
+    results in an unauthorized response. Users of SessionCredentials will likely wish to further
+    restrict access based on the type of user (patient or staff) and perhaps based on the roles
+    associated with the user. This logic is the concern of the implementer of the handler's
+    authenticate method.
+    """
+
+    def __init__(self, request: "Request") -> None:
+        super().__init__(request)
+
+        if (
+            "canvas-logged-in-user-type" not in request.headers
+            or "canvas-logged-in-user-id" not in request.headers
+        ):
+            raise InvalidCredentialsError
+
+        self.logged_in_user = {
+            "id": request.headers.get("canvas-logged-in-user-id"),
+            "type": request.headers.get("canvas-logged-in-user-type"),
+        }
+
+
 class AuthSchemeMixin(Protocol):
     """Protocol for authentication scheme mixins."""
 
@@ -182,3 +215,35 @@ class APIKeyAuthMixin(AuthSchemeMixin):
             raise InvalidCredentialsError
 
         return True
+
+
+class StaffSessionAuthMixin(AuthSchemeMixin):
+    """
+    Staff Session authentication scheme mixin.
+
+    Provides an implementation of the authenticate method that ensures only logged in staff members
+    can access the urls provided by this handler. It only cares that they are a staff, with no
+    regard to roles or any other permissioning schemes.
+    """
+
+    def authenticate(self, credentials: SessionCredentials) -> bool:  # type: ignore[override]
+        """Authenticate the request."""
+        if credentials.logged_in_user["type"] != "Staff":
+            raise InvalidCredentialsError
+        return True
+
+
+class PatientSessionAuthMixin(AuthSchemeMixin):
+    """
+    Patient Session authentication scheme mixin.
+
+    Provides an implementation of the authenticate method that ensures only logged in patients can
+    access the urls provided by this handler. It only cares that they are a patient, with no regard
+    any other information.
+    """
+
+    def authenticate(self, credentials: SessionCredentials) -> bool:  # type: ignore[override]
+        """Authenticate the request."""
+        if credentials.logged_in_user["type"] != "Patient":
+            raise InvalidCredentialsError
+        return True

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/tests/handlers/test_simple_api.py

@@ -37,6 +37,9 @@ from canvas_sdk.handlers.simple_api.security import (
     BasicCredentials,
     BearerCredentials,
     Credentials,
+    PatientSessionAuthMixin,
+    SessionCredentials,
+    StaffSessionAuthMixin,
 )
 from canvas_sdk.handlers.simple_api.tools import (
     CaseInsensitiveMultiDict,
@@ -890,6 +893,13 @@ def custom_headers(api_key: str, app_key: str) -> dict[str, str]:
     return {"API-Key": api_key, "App-Key": app_key}
 
 
+def session_headers(id: str, type: str) -> dict[str, str]:
+    """
+    Given an id and a type, return headers that include the expected session based auth headers.
+    """
+    return {"canvas-logged-in-user-type": type, "canvas-logged-in-user-id": id}
+
+
 USERNAME = uuid4().hex
 PASSWORD = uuid4().hex
 TOKEN = uuid4().hex
@@ -915,6 +925,11 @@ APP_KEY = uuid4().hex
             lambda _, credentials: credentials.key == API_KEY,
             api_key_headers(API_KEY),
         ),
+        (
+            SessionCredentials,
+            lambda _, credentials: credentials.logged_in_user["type"] == "Staff",
+            session_headers("abc123", "Staff"),
+        ),
         (
             Credentials,
             lambda request, _: request.headers.get("API-Key") == API_KEY
@@ -922,7 +937,7 @@ APP_KEY = uuid4().hex
             custom_headers(API_KEY, APP_KEY),
         ),
     ],
-    ids=["basic", "bearer", "API key", "custom"],
+    ids=["basic", "bearer", "API key", "custom", "session"],
 )
 def authenticated_route(request: SubRequest) -> SimpleNamespace:
     """
@@ -998,8 +1013,9 @@ def test_authentication_failure(
         (BearerCredentials, bearer_headers(TOKEN)),
         (APIKeyCredentials, api_key_headers(API_KEY)),
         (Credentials, custom_headers(API_KEY, APP_KEY)),
+        (SessionCredentials, session_headers("abc123", "Patient")),
     ],
-    ids=["basic", "bearer", "API key", "custom"],
+    ids=["basic", "bearer", "API key", "custom", "session"],
 )
 def test_authentication_exception(
     credentials_cls: type[Credentials], headers: Mapping[str, str]
@@ -1079,6 +1095,40 @@ def test_authentication_exception(
                 ).apply()
             ],
         ),
+        (
+            StaffSessionAuthMixin,
+            {},
+            session_headers("abc123", "Staff"),
+            [Effect(type=EffectType.CREATE_TASK, payload="create task")],
+        ),
+        (
+            StaffSessionAuthMixin,
+            {},
+            session_headers("abc123", "Patient"),
+            [
+                JSONResponse(
+                    content={"error": "Provided credentials are invalid"},
+                    status_code=HTTPStatus.UNAUTHORIZED,
+                ).apply()
+            ],
+        ),
+        (
+            PatientSessionAuthMixin,
+            {},
+            session_headers("abc123", "Patient"),
+            [Effect(type=EffectType.CREATE_TASK, payload="create task")],
+        ),
+        (
+            PatientSessionAuthMixin,
+            {},
+            session_headers("abc123", "Staff"),
+            [
+                JSONResponse(
+                    content={"error": "Provided credentials are invalid"},
+                    status_code=HTTPStatus.UNAUTHORIZED,
+                ).apply()
+            ],
+        ),
     ],
     ids=[
         "basic valid",
@@ -1087,6 +1137,10 @@ def test_authentication_exception(
         "API key valid",
         "API key invalid",
         "API key missing secret",
+        "Staff session valid",
+        "Staff session invalid",
+        "Patient session valid",
+        "Patient session invalid",
     ],
 )
 def test_authentication_mixins(

{canvas-0.29.1 → canvas-0.31.0}/canvas_sdk/v1/data/user.py

@@ -9,3 +9,4 @@ class CanvasUser(models.Model):
         db_table = "canvas_sdk_data_api_auth_user_001"
 
     dbid = models.BigIntegerField(db_column="dbid", primary_key=True)
+    email = models.CharField()

{canvas-0.29.1 → canvas-0.31.0}/logger/logger.py

@@ -2,6 +2,8 @@ import logging
 import os
 from typing import Any
 
+import redis
+
 from pubsub.pubsub import Publisher
 
 
@@ -15,7 +17,11 @@ class PubSubLogHandler(logging.Handler):
     def emit(self, record: Any) -> None:
         """Publishes the log message to the pub/sub channel."""
         message = self.format(record)
-        self.publisher.publish(message)
+
+        try:
+            self.publisher.publish(message)
+        except redis.ConnectionError as e:
+            print(f"PubSubLogHandler: failed to log message due to redis error: {e}")
 
 
 class PluginLogger:

{canvas-0.29.1 → canvas-0.31.0}/plugin_runner/plugin_runner.py

@@ -34,6 +34,7 @@ from plugin_runner.installation import install_plugins
 from plugin_runner.sandbox import Sandbox
 from settings import (
     CHANNEL_NAME,
+    CUSTOMER_IDENTIFIER,
     IS_TESTING,
     MANIFEST_FILE_NAME,
     PLUGIN_DIRECTORY,
@@ -49,6 +50,11 @@ sys.path.append(PLUGIN_DIRECTORY)
 # TODO: create typings here for the subkeys
 LOADED_PLUGINS: dict = {}
 
+# a global dictionary of values made available to all plugins
+ENVIRONMENT: dict = {
+    "CUSTOMER_IDENTIFIER": CUSTOMER_IDENTIFIER,
+}
+
 # a global dictionary of events to handler class names
 EVENT_HANDLER_MAP: dict[str, list] = defaultdict(list)
 
@@ -174,7 +180,7 @@ class PluginRunner(PluginRunnerServicer):
             )
 
             try:
-                handler = handler_class(event, secrets)
+                handler = handler_class(event, secrets, ENVIRONMENT)
 
                 if not handler.accept_event():
                     continue
@@ -267,38 +273,48 @@ async def synchronize_plugins(run_once: bool = False) -> None:
     log.info(f'synchronize_plugins: listening for messages on pubsub channel "{CHANNEL_NAME}"')
 
     _, pubsub = get_client()
+
     await pubsub.psubscribe(CHANNEL_NAME)
 
     while True:
-        message = await pubsub.get_message(ignore_subscribe_messages=True, timeout=None)
+        message = await pubsub.get_message(ignore_subscribe_messages=True, timeout=5.0)
 
-        if message is not None:
-            log.info(f'synchronize_plugins: received message from pubsub channel "{CHANNEL_NAME}"')
+        if message is None:
+            continue
 
-            message_type = message.get("type", "")
+        log.info(f'synchronize_plugins: received message from pubsub channel "{CHANNEL_NAME}"')
 
-            if message_type != "pmessage":
-                continue
+        message_type = message.get("type", "")
 
-            data = pickle.loads(message.get("data", pickle.dumps({})))
+        if message_type != "pmessage":
+            continue
 
-            if "action" not in data:
-                continue
+        data = pickle.loads(message.get("data", pickle.dumps({})))
+
+        if "action" not in data:
+            continue
+
+        if data["action"] == "reload":
+            log.info("synchronize_plugins: installing and reloading plugins for action=reload")
+
+            try:
+                install_plugins()
+            except Exception as e:
+                # TODO capture_exception when Sentry is installed
+                log.error(f"synchronize_plugins: install_plugins failed: {e}")
+
+            try:
+                load_plugins()
+            except Exception as e:
+                # TODO capture_exception when Sentry is installed
+                log.error(f"synchronize_plugins: load_plugins failed: {e}")
 
-            if data["action"] == "reload":
-                log.info("synchronize_plugins: installing and reloading plugins for action=reload")
+        await pubsub.check_health()
 
-                try:
-                    install_plugins()
-                except Exception as e:
-                    # TODO capture_exception when Sentry is installed
-                    log.error(f"synchronize_plugins: install_plugins failed: {e}")
+        if not pubsub.connection.is_connected:  # type: ignore
+            log.info("synchronize_plugins: reconnecting to Redis")
+            await pubsub.connection.connect()  # type: ignore
 
-                try:
-                    load_plugins()
-                except Exception as e:
-                    # TODO capture_exception when Sentry is installed
-                    log.error(f"synchronize_plugins: load_plugins failed: {e}")
         if run_once:
             break
 
@@ -307,13 +323,13 @@ async def synchronize_plugins_and_report_errors() -> None:
     """
     Run synchronize_plugins() in perpetuity and report any encountered errors.
     """
-    log.info("Starting synchronize_plugins loop...")
+    log.info("synchronize_plugins: starting loop...")
 
     while True:
         try:
             await synchronize_plugins()
         except Exception as e:
-            log.error(f"synchronize_plugins error: {e}")
+            log.error(f"synchronize_plugins: error: {e}")
 
         # don't crush redis if we're retrying in a tight loop
         await asyncio.sleep(0.5)
@@ -580,13 +596,13 @@ def run_server(specified_plugin_paths: list[str] | None = None) -> None:
     asyncio.set_event_loop(loop)
 
     try:
-        coros = [serve(specified_plugin_paths)]
+        coroutines = [serve(specified_plugin_paths)]
 
         # Only start the synchronizer if the plugin runner was not started from the CLI
         if specified_plugin_paths is None:
-            coros.append(synchronize_plugins_and_report_errors())
+            coroutines.append(synchronize_plugins_and_report_errors())
 
-        loop.run_until_complete(asyncio.gather(*coros))
+        loop.run_until_complete(asyncio.gather(*coroutines))
     except KeyboardInterrupt:
         pass
     finally:

{canvas-0.29.1 → canvas-0.31.0}/pyproject.toml

@@ -50,7 +50,7 @@ license = "MIT"
 name = "canvas"
 readme = "README.md"
 requires-python = ">=3.11,<3.13"
-version = "0.29.1"
+version = "0.31.0"
 
 [project.scripts]
 canvas = "canvas_cli.main:app"