databricks-tellr-app 0.3.13.dev1__tar.gz → 0.3.13.dev2__tar.gz

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev1
+Version: 0.3.13.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev1
+Version: 0.3.13.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -11,7 +11,9 @@ setup.py
 ./src/api/mcp_server.py
 ./src/api/fixtures/tour_demo_deck.json
 ./src/api/middleware/__init__.py
+./src/api/middleware/csrf.py
 ./src/api/middleware/request_logging.py
+./src/api/middleware/security_headers.py
 ./src/api/routes/__init__.py
 ./src/api/routes/admin.py
 ./src/api/routes/admin_usage.py
@@ -154,7 +156,9 @@ src/api/mcp_auth.py
 src/api/mcp_server.py
 src/api/fixtures/tour_demo_deck.json
 src/api/middleware/__init__.py
+src/api/middleware/csrf.py
 src/api/middleware/request_logging.py
+src/api/middleware/security_headers.py
 src/api/routes/__init__.py
 src/api/routes/admin.py
 src/api/routes/admin_usage.py

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.3.13.dev1"
+version = "0.3.13.dev2"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/src/api/main.py

@@ -417,6 +417,24 @@ from src.api.middleware.request_logging import RequestLoggingMiddleware
 
 app.add_middleware(RequestLoggingMiddleware)
 
+# === SDR-4437 Track A security middleware (PR-1a/PR-1b) ==================
+# Keep ALL security-middleware registration inside this delimited block
+# (PR-2 adds an exception handler below the middleware block — do not edit
+# outside these markers). Starlette wraps later-added middleware outermost;
+# ordering here is deliberate:
+#   SecurityHeaders (outermost, added last) -> CSRF -> RequestLogging ->
+#   user_auth -> CORS(dev) -> normalize_mcp_path -> routes
+# Headers must stamp EVERY response (including CSRF 403s); CSRF must reject
+# forged cross-site requests before OBO auth work and before request_logs
+# DB writes. CSRF runs outside normalize_mcp_path, so it sees the raw
+# un-rewritten /mcp path (its exemption handles both /mcp and /mcp/).
+from src.api.middleware.csrf import CSRFProtectionMiddleware  # noqa: E402
+from src.api.middleware.security_headers import SecurityHeadersMiddleware  # noqa: E402
+
+app.add_middleware(CSRFProtectionMiddleware)
+app.add_middleware(SecurityHeadersMiddleware)
+# === end SDR-4437 Track A security middleware =============================
+
 # Include API routers
 app.include_router(admin.router)
 app.include_router(admin_usage.router)

databricks_tellr_app-0.3.13.dev2/src/api/middleware/csrf.py

@@ -0,0 +1,109 @@
+"""Origin-validation CSRF protection (SDR-4437 CRITICAL-2, PR-1b).
+
+Threat model: the app sets no cookies of its own — auth arrives via
+proxy-attested ``x-forwarded-*`` headers. The CSRF-relevant ambient
+credential is the platform SSO cookie at the Databricks Apps proxy: a
+cross-site browser request to the app URL rides that cookie, the proxy
+authenticates it and forwards it carrying the victim's identity.
+Validating the browser-attested ``Origin`` (falling back to ``Referer``)
+against the app's own origin closes this at the app layer.
+
+Deliberate choices (documented for security review):
+
+- **Neither header present -> allow.** Cross-origin browser POSTs always
+  send ``Origin``, so the realistic attack always presents a mismatch;
+  header-less mutating requests are non-browser clients (scripts/curl via
+  the proxy), which rejecting would break for no security gain. A strict
+  mode can be revisited if security review requires it.
+- **/mcp is exempt.** It authenticates with bearer tokens, not cookies, so
+  it is not a CSRF target. The mounted sub-app IS wrapped by the parent
+  app's middleware (that is how ``normalize_mcp_path`` works), so the
+  exemption must be this explicit path check, not an assumption that
+  mounts bypass middleware. This middleware runs OUTSIDE
+  ``normalize_mcp_path``, so it sees the raw ``/mcp`` (un-rewritten) path
+  — both ``/mcp`` and ``/mcp/...`` are matched; ``/mcp-anything`` is not.
+- **Expected origin:** ``DATABRICKS_APP_URL`` (platform-injected on
+  Databricks Apps deploys — same assumption as
+  ``src/api/mcp_server.py::_public_app_url``). If unset, fall back to the
+  origin reconstructed from ``x-forwarded-proto``/``x-forwarded-host``
+  (the proxy always sends these; same pattern as
+  ``google_slides.py::_build_redirect_uri``), so a missing var degrades to
+  a self-referential check instead of blocking all writes.
+- **Inactive outside production** — consistent with the dev-only CORS gate
+  in ``main.py`` (dev auth is ``DEV_USER_ID`` with no proxy in front).
+"""
+
+import logging
+import os
+from urllib.parse import urlsplit
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse, Response
+
+logger = logging.getLogger(__name__)
+
+_UNSAFE_METHODS = frozenset({"POST", "PUT", "PATCH", "DELETE"})
+
+
+def _origin_of(url: str) -> str:
+    """Normalize a URL (or Origin header value) to ``scheme://host[:port]``.
+
+    Returns "" for values with no parseable scheme+host (e.g. ``null``).
+    """
+    parts = urlsplit(url.strip())
+    if not parts.scheme or not parts.netloc:
+        return ""
+    return f"{parts.scheme.lower()}://{parts.netloc.lower()}"
+
+
+class CSRFProtectionMiddleware(BaseHTTPMiddleware):
+    """Reject state-changing requests whose Origin/Referer is cross-site."""
+
+    def __init__(self, app, enabled: bool | None = None):
+        super().__init__(app)
+        self.enabled = (
+            enabled
+            if enabled is not None
+            else os.getenv("ENVIRONMENT", "development") == "production"
+        )
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        if not self.enabled or request.method not in _UNSAFE_METHODS:
+            return await call_next(request)
+
+        path = request.url.path
+        if path == "/mcp" or path.startswith("/mcp/"):
+            return await call_next(request)
+
+        claimed = request.headers.get("origin") or request.headers.get("referer")
+        if not claimed:
+            return await call_next(request)
+
+        claimed_origin = _origin_of(claimed)
+        expected_origin = self._expected_origin(request)
+        if claimed_origin and expected_origin and claimed_origin == expected_origin:
+            return await call_next(request)
+
+        logger.warning(
+            "CSRF: rejected cross-origin %s %s (claimed=%r, expected=%r)",
+            request.method,
+            path,
+            claimed_origin,
+            expected_origin,
+        )
+        return JSONResponse(
+            status_code=403,
+            content={"detail": "Cross-origin request rejected"},
+        )
+
+    @staticmethod
+    def _expected_origin(request: Request) -> str:
+        app_url = os.getenv("DATABRICKS_APP_URL", "")
+        if app_url:
+            return _origin_of(app_url)
+        host = request.headers.get("x-forwarded-host", "")
+        proto = request.headers.get("x-forwarded-proto", "https")
+        if host:
+            return f"{proto.strip().lower()}://{host.split(',')[0].strip().lower()}"
+        return ""

databricks_tellr_app-0.3.13.dev2/src/api/middleware/security_headers.py

@@ -0,0 +1,97 @@
+"""App-origin security headers (SDR-4437 CRITICAL-1, PR-1a).
+
+Sets browser hardening headers on every response that flows back through
+the middleware stack (known limit: raw 500s from genuinely unhandled
+exceptions are synthesized by Starlette's ``ServerErrorMiddleware``
+outside all user middleware and are NOT stamped; those bodies are
+``text/plain`` and non-executable), plus a
+Content-Security-Policy differentiated by response type:
+
+- HTML documents (the SPA index/catch-all AND the Google OAuth callback
+  popup, which carries inline <script>) get ``DOCUMENT_CSP``. Two
+  constraints rule out a strict policy here:
+
+  1. srcdoc inheritance: slides render in ``srcdoc`` iframes, and srcdoc
+     documents inherit the embedding document's CSP in addition to their
+     own SLIDE_CSP meta tag (both policies enforce; most restrictive
+     wins). A ``default-src 'self'`` header on the SPA would block every
+     slide's inline <script>, Chart.js/Tailwind CDN loads, and Google
+     Fonts — breaking slide rendering app-wide. The document policy must
+     therefore be a superset of SLIDE_CSP's allowances
+     (``src/utils/html_safety.py``; sync-tested in
+     ``tests/unit/test_export_csp.py``).
+  2. Inline styles: the React app uses ``style={{...}}`` attributes and
+     Radix UI injects inline styles at runtime; CSP hashes apply to
+     <style>/<script> *elements*, not style *attributes*, so
+     ``style-src`` needs 'unsafe-inline'.
+
+  ``script-src 'unsafe-inline'`` + CDNs is a deliberate, documented
+  trade-off forced by srcdoc inheritance: slides remain confined by the
+  stricter SLIDE_CSP meta policy (connect-src 'none', form-action
+  'none', no eval) plus the html_safety.py scanner, and any header at
+  all is a strict improvement over the previous no-CSP state.
+
+- Everything else (JSON APIs, assets, SSE) gets the deny-all
+  ``API_CSP`` — nothing executes in a JSON response.
+
+``frame-ancestors 'none'`` / ``X-Frame-Options: DENY`` is safe: all
+in-app slide iframes use ``srcdoc`` (never a backend-served ``src``), and
+the only other HTML endpoint, the Google OAuth callback, opens as a
+popup, not an iframe.
+
+``frame-src 'self'`` does not affect the srcdoc slide iframes: a srcdoc
+document loads no URL (its address is the local scheme ``about:srcdoc``,
+no fetch occurs), and per CSP3 local-scheme handling plus current
+Chrome/Firefox/Safari behavior it is NOT subject to frame-src source
+matching — even ``frame-src 'none'`` pages can create srcdoc iframes.
+Instead it inherits this document policy, which is exactly the
+srcdoc-inheritance constraint handled above. Pre-decided fallback if a
+browser ever refuses the slide iframe with a frame-src violation
+("Refused to frame ..."): ``frame-src 'self' about:`` — the ``about:``
+scheme-source matches ``about:srcdoc`` (the historical workaround for
+old-Chrome behavior that did URL-match about: frames).
+"""
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+# CSP for HTML document responses: union of SPA needs and SLIDE_CSP
+# allowances (kept a superset of SLIDE_CSP by test_export_csp.py).
+DOCUMENT_CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdn.tailwindcss.com; "
+    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+    "img-src 'self' data:; "
+    "font-src 'self' data: https://cdn.jsdelivr.net https://fonts.gstatic.com; "
+    "connect-src 'self'; "
+    "frame-src 'self'; "
+    "frame-ancestors 'none'; "
+    "object-src 'none'; "
+    "base-uri 'none'"
+)
+
+# CSP for everything else.
+API_CSP = "default-src 'none'; frame-ancestors 'none'"
+
+_STATIC_HEADERS = {
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "same-origin",
+    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+}
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Stamp security headers on every response (registered outermost)."""
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        response = await call_next(request)
+        for name, value in _STATIC_HEADERS.items():
+            response.headers[name] = value
+        content_type = response.headers.get("content-type", "")
+        if content_type.startswith("text/html"):
+            response.headers["Content-Security-Policy"] = DOCUMENT_CSP
+        else:
+            response.headers["Content-Security-Policy"] = API_CSP
+        return response

{databricks_tellr_app-0.3.13.dev1 → databricks_tellr_app-0.3.13.dev2}/src/api/services/chat_service.py

@@ -80,11 +80,6 @@ class ChatService:
         # This avoids re-parsing HTML on every request
         self._deck_cache: Dict[str, SlideDeck] = {}
 
-        # DB version each cached deck corresponds to. The cache is per-process
-        # while prod runs multiple uvicorn workers sharing one database, so a
-        # cache hit is only valid if the DB version hasn't moved on.
-        self._deck_cache_versions: Dict[str, int] = {}
-
         logger.info("ChatService initialized successfully")
 
     def _substitute_images_for_response(self, deck_dict, raw_html=None):
@@ -605,7 +600,7 @@ class ChatService:
                     slide_deck_dict = current_deck.to_dict()
 
                 try:
-                    save_result = session_manager.save_slide_deck(
+                    session_manager.save_slide_deck(
                         session_id=session_id,
                         title=current_deck.title,
                         html_content=current_deck.knit(),
@@ -615,7 +610,6 @@ class ChatService:
                         modified_by=_user,
                         expected_version=_deck_version_before_llm,
                     )
-                    self._record_deck_version(session_id, save_result)
                 except VersionConflictError:
                     logger.warning(
                         "Chat save rejected: deck was edited during LLM call, reloading",
@@ -1391,7 +1385,7 @@ class ChatService:
                 slide_deck_dict = current_deck.to_dict()
 
             try:
-                save_result = session_manager.save_slide_deck(
+                session_manager.save_slide_deck(
                     session_id=session_id,
                     title=current_deck.title,
                     html_content=current_deck.knit(),
@@ -1401,7 +1395,6 @@ class ChatService:
                     modified_by=_user,
                     expected_version=_deck_version_before_llm,
                 )
-                self._record_deck_version(session_id, save_result)
             except VersionConflictError:
                 logger.warning(
                     "Chat save rejected: deck was edited during LLM call, reloading",
@@ -1928,63 +1921,18 @@ class ChatService:
         context = "\n\n[Attached images]\n" + "\n".join(image_descriptions)
         return message + context
 
-    def _deck_versions(self) -> Dict[str, int]:
-        """Return the cached-deck version map, creating it if needed.
-
-        Lazy creation keeps instances built without __init__ (test harnesses
-        use ChatService.__new__) working. Callers must hold _cache_lock.
-        """
-        try:
-            return self._deck_cache_versions
-        except AttributeError:
-            self._deck_cache_versions = {}
-            return self._deck_cache_versions
-
-    def _record_deck_version(self, session_id: str, save_result: Optional[Dict[str, Any]]) -> None:
-        """Remember which DB version the cached deck now corresponds to.
-
-        Call after save_slide_deck so the next _get_or_load_deck cache hit
-        validates cleanly instead of reloading from the database.
-        """
-        version = (save_result or {}).get("version")
-        with self._cache_lock:
-            if version is not None:
-                self._deck_versions()[session_id] = version
-            else:
-                self._deck_versions().pop(session_id, None)
-
     def _get_or_load_deck(self, session_id: str) -> Optional[SlideDeck]:
         """Get deck from cache or load from database.
 
         Thread-safe access to deck cache using _cache_lock.
-
-        The cache is per-process while prod runs multiple uvicorn workers
-        sharing one database, so a cached deck is only served if its recorded
-        version matches the current DB version; otherwise it is reloaded.
-
+        
         Uses deck_dict (slides array with individual scripts) when available,
         falling back to from_html_string for legacy data.
         """
         # Check cache first (with lock)
         with self._cache_lock:
-            cached_deck = self._deck_cache.get(session_id)
-            cached_version = self._deck_versions().get(session_id)
-
-        if cached_deck is not None:
-            db_version = self._get_deck_version(session_id)
-            if db_version is None or cached_version == db_version:
-                return cached_deck
-            logger.info(
-                "Deck cache stale, reloading from database",
-                extra={
-                    "session_id": session_id,
-                    "cached_version": cached_version,
-                    "db_version": db_version,
-                },
-            )
-            with self._cache_lock:
-                self._deck_cache.pop(session_id, None)
-                self._deck_versions().pop(session_id, None)
+            if session_id in self._deck_cache:
+                return self._deck_cache[session_id]
 
         # Try to load from database (outside lock to avoid blocking)
         session_manager = get_session_manager()
@@ -2018,10 +1966,6 @@ class ChatService:
             # Store in cache (with lock)
             with self._cache_lock:
                 self._deck_cache[session_id] = deck
-                if deck_data.get("version") is not None:
-                    self._deck_versions()[session_id] = deck_data["version"]
-                else:
-                    self._deck_versions().pop(session_id, None)
             return deck
         except Exception as e:
             logger.warning(f"Failed to load deck from database: {e}")
@@ -2064,7 +2008,6 @@ class ChatService:
         """Remove the cached deck for a session so the next read hits the DB."""
         with self._cache_lock:
             self._deck_cache.pop(session_id, None)
-            self._deck_versions().pop(session_id, None)
 
     def _replace_slide_htmls_from_cache(self, session_id: str, slide_context: Dict[str, Any]) -> Dict[str, Any]:
         """Replace frontend-supplied slide_htmls with backend cache versions.
@@ -2597,7 +2540,7 @@ class ChatService:
         # Persist to database
         deck_dict = current_deck.to_dict()
         session_manager = get_session_manager()
-        save_result = session_manager.save_slide_deck(
+        session_manager.save_slide_deck(
             session_id=session_id,
             title=current_deck.title,
             html_content=current_deck.knit(),
@@ -2606,7 +2549,6 @@ class ChatService:
             deck_dict=deck_dict,
             expected_version=expected_version,
         )
-        self._record_deck_version(session_id, save_result)
 
         # Create save point
         try:
@@ -2674,7 +2616,7 @@ class ChatService:
         # Persist to database
         deck_dict = current_deck.to_dict()
         session_manager = get_session_manager()
-        save_result = session_manager.save_slide_deck(
+        session_manager.save_slide_deck(
             session_id=session_id,
             title=current_deck.title,
             html_content=current_deck.knit(),
@@ -2683,7 +2625,6 @@ class ChatService:
             deck_dict=deck_dict,
             expected_version=expected_version,
         )
-        self._record_deck_version(session_id, save_result)
 
         # Create save point immediately after persisting
         try:
@@ -2740,7 +2681,7 @@ class ChatService:
         # Persist to database
         deck_dict = current_deck.to_dict()
         session_manager = get_session_manager()
-        save_result = session_manager.save_slide_deck(
+        session_manager.save_slide_deck(
             session_id=session_id,
             title=current_deck.title,
             html_content=current_deck.knit(),
@@ -2749,7 +2690,6 @@ class ChatService:
             deck_dict=deck_dict,
             expected_version=expected_version,
         )
-        self._record_deck_version(session_id, save_result)
 
         # Create save point
         try:
@@ -2804,7 +2744,7 @@ class ChatService:
         # Persist to database
         deck_dict = current_deck.to_dict()
         session_manager = get_session_manager()
-        save_result = session_manager.save_slide_deck(
+        session_manager.save_slide_deck(
             session_id=session_id,
             title=current_deck.title,
             html_content=current_deck.knit(),
@@ -2813,7 +2753,6 @@ class ChatService:
             deck_dict=deck_dict,
             expected_version=expected_version,
         )
-        self._record_deck_version(session_id, save_result)
 
         # Create save point
         try: