databricks-tellr-app 0.3.10.dev3__tar.gz → 0.3.10.dev4__tar.gz

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.10.dev3
+Version: 0.3.10.dev4
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.10.dev3
+Version: 0.3.10.dev4
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.3.10.dev3"
+version = "0.3.10.dev4"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/setup.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 import shutil
 import subprocess
 from pathlib import Path
@@ -62,6 +63,7 @@ class BuildWithFrontend(build_py):
                 shutil.copytree(src_dir, src_target)
 
             sidecars_root.mkdir(parents=True, exist_ok=True)
+            # pptx-emit (~1MB) is required for editable PPTX export in deployed apps.
             if records_sidecar_src.exists():
                 if records_sidecar_target.exists():
                     shutil.rmtree(records_sidecar_target)
@@ -70,7 +72,14 @@ class BuildWithFrontend(build_py):
                     records_sidecar_target,
                     ignore=_SIDECAR_IGNORE,
                 )
-            if huashu_sidecar_src.exists():
+            # huashu sidecar tarballs (~30MB) exceed Databricks Apps workspace
+            # file limits for deploy_local; include for PyPI/CI via TELLR_INCLUDE_HUASHU_SIDECAR=1.
+            include_huashu = os.environ.get("TELLR_INCLUDE_HUASHU_SIDECAR", "").lower() in (
+                "1",
+                "true",
+                "yes",
+            )
+            if include_huashu and huashu_sidecar_src.exists():
                 if huashu_sidecar_target.exists():
                     shutil.rmtree(huashu_sidecar_target)
                 shutil.copytree(

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/api/mcp_server.py

@@ -73,12 +73,6 @@ class _PermissionServiceFacade:
             )
             if session is None:
                 return False
-            # Creator always has view access (mirrors PermissionService's
-            # get_deck_permission creator check, done here on the string-id
-            # fast path so a brand-new session the caller just created is
-            # viewable even before any DeckContributor row exists).
-            if session.created_by and session.created_by == ctx.user_name:
-                return True
             return svc.can_view_deck(
                 db,
                 session.id,
@@ -113,8 +107,6 @@ class _PermissionServiceFacade:
             )
             if session is None:
                 return False
-            if session.created_by and session.created_by == ctx.user_name:
-                return True
             return svc.can_edit_deck(
                 db,
                 session.id,

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/api/routes/deck_contributors.py

@@ -64,6 +64,7 @@ class DeckContributorResponse(BaseModel):
 class DeckContributorListResponse(BaseModel):
     contributors: list[DeckContributorResponse]
     total: int
+    global_permission: Optional[str] = None
 
 
 # ---------------------------------------------------------------------------
@@ -153,7 +154,11 @@ def list_deck_contributors(
         )
         for c in contributors
     ]
-    return DeckContributorListResponse(contributors=items, total=len(items))
+    return DeckContributorListResponse(
+        contributors=items,
+        total=len(items),
+        global_permission=session.global_permission,
+    )
 
 
 @router.post("", response_model=DeckContributorResponse, status_code=status.HTTP_201_CREATED)

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/api/routes/sessions.py

@@ -29,7 +29,11 @@ from src.core.database import get_db, get_db_session
 from src.core.permission_context import get_permission_context
 from src.core.user_context import get_current_user
 from src.database.models.profile_contributor import PermissionLevel
-from src.services.permission_service import get_permission_service
+from src.database.models.session import UserSession
+from src.services.permission_service import (
+    VALID_DECK_GLOBAL_PERMISSIONS,
+    get_permission_service,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -235,7 +239,7 @@ async def list_shared_presentations(
     limit: int = Query(50, ge=1, le=100, description="Maximum presentations to return"),
     db: Session = Depends(get_db),
 ):
-    """List presentations (slide decks) shared with the current user via deck_contributors.
+    """List presentations shared with the current user via deck_contributors or workspace global_permission.
 
     Returns presentation-only data from decks where the user has CAN_VIEW, CAN_EDIT,
     or CAN_MANAGE permission. Conversations (chat messages) are never exposed —
@@ -290,6 +294,8 @@ async def list_shared_presentations(
                 user_name=ctx.user_name,
                 group_ids=ctx.group_ids,
             )
+            if permission is None:
+                continue
 
             presentations.append({
                 "session_id": s.session_id,
@@ -301,7 +307,7 @@ async def list_shared_presentations(
                 "slide_count": deck.slide_count if deck else 0,
                 "modified_by": getattr(deck, "modified_by", None) or s.created_by,
                 "modified_at": deck.updated_at.isoformat() if deck and deck.updated_at else None,
-                "my_permission": permission.value if permission else "CAN_VIEW",
+                "my_permission": permission.value,
             })
 
         return {"presentations": presentations, "count": len(presentations)}
@@ -314,6 +320,62 @@ async def list_shared_presentations(
         ) from e
 
 
+class DeckGlobalPermissionResponse(BaseModel):
+    session_id: str
+    global_permission: Optional[str] = None
+
+
+@router.patch("/{session_id}/global", response_model=DeckGlobalPermissionResponse)
+async def set_deck_global_permission(
+    session_id: str,
+    permission: Optional[str] = Query(
+        None,
+        description="CAN_VIEW, CAN_EDIT, or omit/null to clear workspace sharing",
+    ),
+    db: Session = Depends(get_db),
+):
+    """Set or clear workspace-wide sharing for a deck. Requires CAN_MANAGE."""
+    from src.api.routes.deck_contributors import _get_root_session_or_400, _require_manage
+
+    session = _get_root_session_or_400(db, session_id)
+    perm_service = get_permission_service()
+    _require_manage(perm_service, db, session)
+
+    if permission is not None:
+        try:
+            level = PermissionLevel(permission)
+        except ValueError as exc:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Invalid permission level: {permission}",
+            ) from exc
+        if level not in VALID_DECK_GLOBAL_PERMISSIONS:
+            raise HTTPException(
+                status_code=400,
+                detail=(
+                    "Workspace sharing supports CAN_VIEW or CAN_EDIT only. "
+                    "Use individual contributors for CAN_MANAGE."
+                ),
+            )
+        session.global_permission = level.value
+    else:
+        session.global_permission = None
+
+    db.commit()
+    db.refresh(session)
+
+    logger.info(
+        "Updated workspace sharing for session %s: global_permission=%s",
+        session_id,
+        session.global_permission,
+    )
+
+    return DeckGlobalPermissionResponse(
+        session_id=session.session_id,
+        global_permission=session.global_permission,
+    )
+
+
 @router.post("/{session_id}/contribute")
 async def get_or_create_contributor_session(
     session_id: str,

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/api/services/session_manager.py

@@ -169,6 +169,7 @@ class SessionManager:
                 "is_contributor_session": session.is_contributor_session,
                 "parent_session_id": parent_session_id_str,
                 "parent_session_internal_id": session.parent_session_id,
+                "global_permission": deck_owner.global_permission,
             }
 
     def get_or_create_contributor_session(
@@ -313,6 +314,7 @@ class SessionManager:
                     "message_count": len(s.messages),
                     "has_slide_deck": s.slide_deck is not None,
                     "slide_count": s.slide_deck.slide_count if s.slide_deck is not None else 0,
+                    "global_permission": s.global_permission,
                 }
                 for s in sessions
             ]

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/core/database.py

@@ -518,22 +518,12 @@ def _run_migrations(engine, schema: str | None = None):
         # --- deck-centric permissions: drop profile_id, migrate CAN_VIEW → CAN_USE ---
         _migrate_deck_permissions_model(conn, inspector, schema, _qual, is_sqlite)
 
+        # --- deck workspace sharing: global_permission on user_sessions ---
+        _migrate_deck_workspace_sharing(conn, inspector, schema, _qual)
+
         # --- image_assets.tags: json → jsonb (PostgreSQL) for native @> queries ---
         _migrate_image_assets_tags_json_to_jsonb(conn, schema, _qual, is_sqlite)
 
-        # --- THROWAWAY devloop ownership probe (NOT FOR MERGE) ---
-        # Exercises the shared-owner unblock on a fork: ALTER an *inherited*
-        # app_data_prod table (the case that used to fail "must be owner of
-        # table") + CREATE a new table (which the reassign step below re-homes).
-        if not is_sqlite:
-            logger.info("PROBE: ALTER inherited config_profiles + CREATE _probe_tbl")
-            conn.execute(text(
-                f"ALTER TABLE {_qual('config_profiles')} ADD COLUMN IF NOT EXISTS _probe text"
-            ))
-            conn.execute(text(
-                f"CREATE TABLE IF NOT EXISTS {_qual('_probe_tbl')} (col1 text)"
-            ))
-
         # --- keep newly created objects owned by the shared role (prod forks) ---
         _reassign_new_objects_to_shared_owner(conn, is_sqlite)
 
@@ -943,6 +933,29 @@ def _migrate_permissions_columns(conn, inspector, schema, _qual, is_sqlite):
     logger.info("Migration: permissions columns migration complete")
 
 
+def _migrate_deck_workspace_sharing(conn, inspector, schema, _qual) -> None:
+    """Add global_permission to user_sessions for workspace-wide deck sharing.
+
+    NULL = private deck. CAN_VIEW or CAN_EDIT when shared with all workspace users.
+    Idempotent.
+    """
+    from sqlalchemy import text
+
+    try:
+        sessions_cols = {c["name"] for c in inspector.get_columns("user_sessions", schema=schema)}
+    except Exception:
+        sessions_cols = set()
+
+    if sessions_cols and "global_permission" not in sessions_cols:
+        qualified = _qual("user_sessions")
+        logger.info("Migration: adding global_permission column to user_sessions")
+        conn.execute(text(
+            f"ALTER TABLE {qualified} ADD COLUMN global_permission VARCHAR(20) NULL"
+        ))
+
+    logger.info("Migration: deck workspace sharing columns complete")
+
+
 def _migrate_deck_permissions_model(conn, inspector, schema, _qual, is_sqlite):
     """Decouple deck sharing from profiles.
 

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/database/models/session.py

@@ -101,6 +101,10 @@ class UserSession(Base):
     user_id = Column(String(255), nullable=True, index=True)  # Legacy — kept for backward compat
     created_by = Column(String(255), nullable=True, index=True)  # Username of session creator
 
+    # Workspace-wide deck sharing (root sessions only). NULL = private.
+    # CAN_VIEW or CAN_EDIT — CAN_MANAGE is not valid for workspace share.
+    global_permission = Column(String(20), nullable=True)
+
     # Contributor session support: links to the owner's session whose slide
     # deck this contributor reads/writes. NULL = owner (root) session.
     parent_session_id = Column(

{databricks_tellr_app-0.3.10.dev3 → databricks_tellr_app-0.3.10.dev4}/src/services/permission_service.py

@@ -11,7 +11,8 @@ Users can have permissions through:
 1. Direct USER-type contributor entry (by identity_id)
 2. Fallback USER-type contributor entry (by identity_name)
 3. GROUP-type contributor entry (if user is member of that group)
-4. Being the creator (implicit CAN_MANAGE)
+4. Workspace-wide global_permission on the root user_sessions row (CAN_VIEW/CAN_EDIT)
+5. Being the creator (implicit CAN_MANAGE)
 """
 
 import logging
@@ -38,6 +39,12 @@ PERMISSION_PRIORITY = {
     PermissionLevel.CAN_MANAGE: 3,
 }
 
+# Workspace-wide deck sharing — CAN_MANAGE is not valid for global_permission
+VALID_DECK_GLOBAL_PERMISSIONS = frozenset({
+    PermissionLevel.CAN_VIEW,
+    PermissionLevel.CAN_EDIT,
+})
+
 
 class PermissionService:
     """Stateless service for checking user permissions on profiles and decks."""
@@ -206,6 +213,23 @@ class PermissionService:
     # Deck permission methods (new)
     # ------------------------------------------------------------------
 
+    @staticmethod
+    def _resolve_root_session(db: Session, session: UserSession) -> UserSession:
+        """Return the deck-owning root session (walk parent_session_id chain)."""
+        current = session
+        seen = {current.id}
+        while current.parent_session_id is not None:
+            parent = (
+                db.query(UserSession)
+                .filter(UserSession.id == current.parent_session_id)
+                .first()
+            )
+            if parent is None or parent.id in seen:
+                break
+            seen.add(parent.id)
+            current = parent
+        return current
+
     def get_deck_permission(
         self,
         db: Session,
@@ -217,16 +241,21 @@ class PermissionService:
         """
         Get the user's permission level on a deck (UserSession).
 
-        Resolution order:
-        1. Creator check — session.created_by == user_name → CAN_MANAGE
-        2. Direct user by identity_id
-        3. Fallback by identity_name
-        4. Group matches (highest wins)
-        5. None
+        Always resolves contributor (child) sessions to the root deck session
+        before evaluating grants. Contributor session creators must not inherit
+        CAN_MANAGE on the shared deck.
+
+        Resolution order (highest level wins):
+        1. Creator check — root.created_by == user_name → CAN_MANAGE
+        2. Direct user by identity_id (on root deck)
+        3. Fallback by identity_name (on root deck)
+        4. Group matches (on root deck)
+        5. Workspace global_permission on root session (CAN_VIEW/CAN_EDIT only)
+        6. None if no grants match
 
         Args:
             db: Database session
-            session_id: UserSession.id (integer PK)
+            session_id: UserSession.id (integer PK), root or contributor
             user_id: Databricks user ID
             user_name: Username/email
             group_ids: List of group IDs the user belongs to
@@ -238,49 +267,73 @@ class PermissionService:
         if not session:
             return None
 
+        root = self._resolve_root_session(db, session)
+        deck_id = root.id
+
         permissions_found: List[PermissionLevel] = []
 
-        # Check 1: Is user the session creator? (implicit CAN_MANAGE)
-        if user_name and session.created_by == user_name:
-            logger.debug(f"User {user_name} is creator of session {session_id}")
+        # Check 1: Is user the deck owner? (implicit CAN_MANAGE on root only)
+        if user_name and root.created_by == user_name:
+            logger.debug(f"User {user_name} is creator of deck session {deck_id}")
             permissions_found.append(PermissionLevel.CAN_MANAGE)
 
         # Check 2: Direct user permission (by identity_id)
         if user_id:
             direct_match = db.query(DeckContributor).filter(
-                DeckContributor.user_session_id == session_id,
+                DeckContributor.user_session_id == deck_id,
                 DeckContributor.identity_type == "USER",
                 DeckContributor.identity_id == user_id,
             ).first()
 
             if direct_match:
-                logger.debug(f"Found direct deck permission for user {user_id} on session {session_id}: {direct_match.permission_level}")
+                logger.debug(
+                    f"Found direct deck permission for user {user_id} on deck {deck_id}: "
+                    f"{direct_match.permission_level}"
+                )
                 permissions_found.append(PermissionLevel(direct_match.permission_level))
 
         # Check 3: Fallback - Direct user permission (by identity_name)
-        if user_name and not permissions_found:
+        if user_name:
             name_match = db.query(DeckContributor).filter(
-                DeckContributor.user_session_id == session_id,
+                DeckContributor.user_session_id == deck_id,
                 DeckContributor.identity_type == "USER",
                 DeckContributor.identity_name == user_name,
             ).first()
 
             if name_match:
-                logger.debug(f"Found deck permission by name for {user_name} on session {session_id}: {name_match.permission_level}")
+                logger.debug(
+                    f"Found deck permission by name for {user_name} on deck {deck_id}: "
+                    f"{name_match.permission_level}"
+                )
                 permissions_found.append(PermissionLevel(name_match.permission_level))
 
         # Check 4: Group-based permission
         if group_ids:
             group_matches = db.query(DeckContributor).filter(
-                DeckContributor.user_session_id == session_id,
+                DeckContributor.user_session_id == deck_id,
                 DeckContributor.identity_type == "GROUP",
                 DeckContributor.identity_id.in_(group_ids),
             ).all()
 
             for match in group_matches:
-                logger.debug(f"Found group deck permission on session {session_id}: {match.identity_name} -> {match.permission_level}")
+                logger.debug(
+                    f"Found group deck permission on deck {deck_id}: "
+                    f"{match.identity_name} -> {match.permission_level}"
+                )
                 permissions_found.append(PermissionLevel(match.permission_level))
 
+        # Check 5: Workspace-wide sharing (root sessions only)
+        if root.global_permission:
+            try:
+                global_perm = PermissionLevel(root.global_permission)
+            except ValueError:
+                global_perm = None
+            if global_perm in VALID_DECK_GLOBAL_PERMISSIONS:
+                logger.debug(
+                    f"Found workspace global permission on deck {deck_id}: {global_perm}"
+                )
+                permissions_found.append(global_perm)
+
         if not permissions_found:
             return None
 
@@ -366,8 +419,8 @@ class PermissionService:
         group_ids: Optional[List[str]] = None,
     ) -> Set[int]:
         """
-        Return set of UserSession.id values shared with this user via deck_contributors,
-        excluding sessions where the user is the creator.
+        Return set of UserSession.id values shared with this user via deck_contributors
+        or workspace global_permission, excluding sessions where the user is the creator.
 
         Args:
             db: Database session
@@ -404,6 +457,14 @@ class PermissionService:
             ).all()
             shared_session_ids.update(r.user_session_id for r in rows)
 
+        # Workspace-wide shared root sessions (valid levels only)
+        valid_global = [p.value for p in VALID_DECK_GLOBAL_PERMISSIONS]
+        global_rows = db.query(UserSession.id).filter(
+            UserSession.parent_session_id.is_(None),
+            UserSession.global_permission.in_(valid_global),
+        ).all()
+        shared_session_ids.update(r.id for r in global_rows)
+
         if not shared_session_ids:
             return set()