databricks-tellr-app 0.3.13.dev2__tar.gz → 0.3.13.dev3__tar.gz

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev2
+Version: 0.3.13.dev3
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev2
+Version: 0.3.13.dev3
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -11,9 +11,7 @@ setup.py
 ./src/api/mcp_server.py
 ./src/api/fixtures/tour_demo_deck.json
 ./src/api/middleware/__init__.py
-./src/api/middleware/csrf.py
 ./src/api/middleware/request_logging.py
-./src/api/middleware/security_headers.py
 ./src/api/routes/__init__.py
 ./src/api/routes/admin.py
 ./src/api/routes/admin_usage.py
@@ -117,6 +115,13 @@ setup.py
 ./src/services/profile_service.py
 ./src/services/streaming_callback.py
 ./src/services/validator.py
+./src/services/converter_jail/__init__.py
+./src/services/converter_jail/ast_guard.py
+./src/services/converter_jail/codeprep.py
+./src/services/converter_jail/gslides_runner.py
+./src/services/converter_jail/jail.py
+./src/services/converter_jail/pptx_runner.py
+./src/services/converter_jail/protocol.py
 ./src/services/evaluation/__init__.py
 ./src/services/evaluation/llm_judge.py
 ./src/services/identity_providers/__init__.py
@@ -156,9 +161,7 @@ src/api/mcp_auth.py
 src/api/mcp_server.py
 src/api/fixtures/tour_demo_deck.json
 src/api/middleware/__init__.py
-src/api/middleware/csrf.py
 src/api/middleware/request_logging.py
-src/api/middleware/security_headers.py
 src/api/routes/__init__.py
 src/api/routes/admin.py
 src/api/routes/admin_usage.py
@@ -262,6 +265,13 @@ src/services/pptx_prompts_defaults.py
 src/services/profile_service.py
 src/services/streaming_callback.py
 src/services/validator.py
+src/services/converter_jail/__init__.py
+src/services/converter_jail/ast_guard.py
+src/services/converter_jail/codeprep.py
+src/services/converter_jail/gslides_runner.py
+src/services/converter_jail/jail.py
+src/services/converter_jail/pptx_runner.py
+src/services/converter_jail/protocol.py
 src/services/evaluation/__init__.py
 src/services/evaluation/llm_judge.py
 src/services/identity_providers/__init__.py

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.3.13.dev2"
+version = "0.3.13.dev3"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/src/api/main.py

@@ -417,24 +417,6 @@ from src.api.middleware.request_logging import RequestLoggingMiddleware
 
 app.add_middleware(RequestLoggingMiddleware)
 
-# === SDR-4437 Track A security middleware (PR-1a/PR-1b) ==================
-# Keep ALL security-middleware registration inside this delimited block
-# (PR-2 adds an exception handler below the middleware block — do not edit
-# outside these markers). Starlette wraps later-added middleware outermost;
-# ordering here is deliberate:
-#   SecurityHeaders (outermost, added last) -> CSRF -> RequestLogging ->
-#   user_auth -> CORS(dev) -> normalize_mcp_path -> routes
-# Headers must stamp EVERY response (including CSRF 403s); CSRF must reject
-# forged cross-site requests before OBO auth work and before request_logs
-# DB writes. CSRF runs outside normalize_mcp_path, so it sees the raw
-# un-rewritten /mcp path (its exemption handles both /mcp and /mcp/).
-from src.api.middleware.csrf import CSRFProtectionMiddleware  # noqa: E402
-from src.api.middleware.security_headers import SecurityHeadersMiddleware  # noqa: E402
-
-app.add_middleware(CSRFProtectionMiddleware)
-app.add_middleware(SecurityHeadersMiddleware)
-# === end SDR-4437 Track A security middleware =============================
-
 # Include API routers
 app.include_router(admin.router)
 app.include_router(admin_usage.router)

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev3}/src/api/services/export_job_queue.py

@@ -307,9 +307,6 @@ async def convert_slides_with_progress(
         output_path: Path to save PPTX
         chart_images_per_slide: Chart images per slide
     """
-    from pptx import Presentation
-    from pptx.util import Inches
-
     total_slides = len(slides_html)
 
     # -- Phase 1: Prepare assets + parallel LLM code generation ---------------
@@ -336,27 +333,17 @@ async def convert_slides_with_progress(
         slide_inputs, on_codegen_progress=_on_codegen_progress,
     )
 
-    # -- Phase 2: Sequential execution ----------------------------------------
-    prs = Presentation()
-    prs.slide_width = Inches(10)
-    prs.slide_height = Inches(7.5)
-
-    for i, (code, (html_str, _chart_files, _content_files, assets_dir)) in enumerate(
-        zip(codes, slide_inputs), 1,
-    ):
-        update_export_progress(
-            job_id, i, total_slides,
-            status_message=f"Building slide {i}/{total_slides}…",
-        )
-
-        converter._execute_slide(code, prs, html_str, assets_dir, i)
-
-        logger.debug(
-            f"Processed slide {i}/{total_slides}",
-            extra={"job_id": job_id, "slide": i, "total": total_slides},
-        )
+    # -- Phase 2: Sequential execution INSIDE the subprocess jail -------------
+    def _relay(current: int, total: int, message: str) -> None:
+        update_export_progress(job_id, current, total, status_message=message)
 
-    prs.save(output_path)
+    # to_thread: keep the long blocking jail wait off the event loop (this
+    # coroutine runs on the loop; _relay is fired from the jail's stdout
+    # reader thread and update_export_progress opens its own session per call).
+    await asyncio.to_thread(
+        converter._run_pptx_conversion,
+        codes, slide_inputs, output_path, progress_cb=_relay,
+    )
 
 
 async def export_worker() -> None:

databricks_tellr_app-0.3.13.dev3/src/services/converter_jail/__init__.py

@@ -0,0 +1,10 @@
+# src/services/converter_jail/__init__.py
+"""Subprocess jail for LLM-generated converter code (SDR-4437 HIGH-5)."""
+
+from src.services.converter_jail.jail import (  # noqa: F401
+    JailError,
+    JailResult,
+    ResourceLimits,
+    run_gslides_jail,
+    run_pptx_jail,
+)

databricks_tellr_app-0.3.13.dev3/src/services/converter_jail/ast_guard.py

@@ -0,0 +1,58 @@
+# src/services/converter_jail/ast_guard.py
+"""Best-effort AST import allowlist for generated converter code.
+
+Defense-in-depth ONLY — bypassable by construction (e.g. __import__,
+importlib). The security boundary is the subprocess jail, not this check.
+Runs on the trusted host before launch so obviously-hostile code never
+reaches the child.
+"""
+
+import ast
+
+
+class DisallowedImport(Exception):
+    """Raised when generated code imports a module outside the allowlist."""
+
+
+# Top-level module names generated converters legitimately need.
+# Keep this GENEROUS for harmless stdlib: a snippet failing this check is
+# downgraded to a blank placeholder slide (has_code=False in the job-dir
+# builders, Tasks 4/6), so a too-narrow list silently blanks legitimate
+# slides. The prompts only show example imports — they do not restrict the
+# LLM to a fixed set — and the jail, not this list, is the security boundary.
+DEFAULT_ALLOWED = frozenset({
+    # PPTX path
+    "pptx", "os", "re", "math", "json", "uuid", "base64", "io",
+    "datetime", "collections", "itertools", "string", "textwrap",
+    # harmless stdlib the LLM commonly emits unprompted
+    "sys", "time", "typing", "functools", "random", "copy",
+    "html", "unicodedata", "decimal",
+    # image handling
+    "PIL", "lxml",
+    # Google Slides path emits data only; googleapiclient is host-side now,
+    # but allow the http helper import in case a snippet still references it
+    # (host strips its effect; import alone is harmless).
+    "googleapiclient",
+    "xml",
+})
+
+
+def _root(name: str) -> str:
+    return name.split(".", 1)[0]
+
+
+def check_imports(code: str, allowed: frozenset = DEFAULT_ALLOWED) -> None:
+    """Raise DisallowedImport if *code* imports a non-allowlisted top-level
+    module. Raises SyntaxError if *code* does not parse."""
+    tree = ast.parse(code)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                if _root(alias.name) not in allowed:
+                    raise DisallowedImport(_root(alias.name))
+        elif isinstance(node, ast.ImportFrom):
+            # Relative imports (node.level > 0) have no module root to check;
+            # they cannot reach outside the (nonexistent) package, so allow.
+            if node.level == 0 and node.module is not None:
+                if _root(node.module) not in allowed:
+                    raise DisallowedImport(_root(node.module))

databricks_tellr_app-0.3.13.dev3/src/services/converter_jail/codeprep.py

@@ -0,0 +1,220 @@
+# src/services/converter_jail/codeprep.py
+"""Dependency-light code-prep helpers shared by the jail runners (SDR-4437 PR-5).
+
+STDLIB-ONLY BY DESIGN. This module is imported inside the sandboxed child
+(`python -I`), so it must never pull in `databricks`, `google*`, `bs4`,
+`pptx`, or any `src.services.*` converter module — those graphs drag the
+credential-capable SDK into the jail just to call string transformers.
+
+Contents:
+- ``sanitize_code``       — moved verbatim from ``HtmlToPptxConverterV3._sanitize_code``.
+- ``_fix_apostrophe_strings`` / ``_convert_single_to_double_quoted`` — moved
+  verbatim from ``html_to_google_slides``.
+- ``prepare_requests_code`` — preps generated Google Slides data-out code
+  (wraps bare code into ``build_slide_requests``; request-shape fixes).
+"""
+
+import ast
+import re
+
+
+def sanitize_code(code: str) -> str:
+    """Fix common LLM-generated code issues before execution.
+
+    Handles smart quotes, em-dashes, and apostrophes inside string literals
+    that cause SyntaxError (e.g. ``Anthony's`` inside a single-quoted string).
+    """
+    # Smart/curly quotes → straight quotes
+    for smart, straight in {
+        "‘": "'", "’": "'",   # single curly quotes
+        "“": '"', "”": '"',   # double curly quotes
+    }.items():
+        code = code.replace(smart, straight)
+
+    # Em-dash / en-dash → regular hyphen (prevents SyntaxError when
+    # they appear outside strings due to broken quoting)
+    code = code.replace("—", "-")   # em-dash
+    code = code.replace("–", "-")   # en-dash
+
+    # Fix apostrophes inside single-quoted strings (e.g. 'Anthony's workflow')
+    # by converting affected lines to use double-quoted strings.
+    for _ in range(20):
+        try:
+            ast.parse(code)
+            break
+        except SyntaxError as exc:
+            if exc.lineno is None:
+                break
+            lines = code.splitlines()
+            idx = exc.lineno - 1
+            if idx < 0 or idx >= len(lines):
+                break
+            original = lines[idx]
+            # Re-quote single-quoted strings that contain apostrophes
+            fixed = re.sub(
+                r"'([^']*\w'\w[^']*)'",
+                lambda m: '"' + m.group(1) + '"',
+                original,
+            )
+            if fixed == original:
+                break
+            lines[idx] = fixed
+            code = "\n".join(lines)
+    return code
+
+
+# ---------------------------------------------------------------------------
+# Apostrophe-in-string syntax fixer
+# ---------------------------------------------------------------------------
+
+def _convert_single_to_double_quoted(line: str) -> str:
+    """Re-quote single-quoted strings that contain apostrophes as double-quoted.
+
+    Scans each single-quote-delimited token on *line*.  When an apostrophe is
+    surrounded by word characters (``\\w'\\w``) it is treated as part of the
+    content (not a closing delimiter), so the scanner continues until it finds a
+    genuine closing quote.  Those strings are then re-emitted with double-quote
+    delimiters so Python can parse them correctly.
+
+    Example::
+
+        'We didn't do it'  →  "We didn't do it"
+    """
+    result: list = []
+    i = 0
+    n = len(line)
+
+    while i < n:
+        if line[i] != "'":
+            result.append(line[i])
+            i += 1
+            continue
+
+        # Scan for the "real" closing quote, treating word-apostrophe-word as content.
+        j = i + 1
+        while j < n:
+            if line[j] == "'":
+                before_word = j > 0 and line[j - 1].isalnum()
+                after_word = (j + 1) < n and line[j + 1].isalnum()
+                if before_word and after_word:
+                    j += 1  # it's a contraction apostrophe — keep scanning
+                    continue
+                break  # genuine closing quote
+            j += 1
+
+        if j >= n:
+            # Never found a real closing quote — rest of line is broken content.
+            content = line[i + 1:]
+            result.append('"' + content.replace('"', '\\"') + '"')
+            break
+
+        content = line[i + 1: j]
+        if re.search(r"\w'\w", content):
+            # Content has an apostrophe → rewrite as double-quoted string.
+            result.append('"' + content.replace('"', '\\"') + '"')
+        else:
+            result.append(line[i: j + 1])
+
+        i = j + 1
+
+    return "".join(result)
+
+
+def _fix_apostrophe_strings(code: str) -> str:
+    """Fix single-quoted literals whose content contains apostrophes (contractions).
+
+    The LLM often emits ``'text': 'We don't ...'``.  The ``'`` in *don't* ends the
+    literal early; the parser may report ``unterminated string``, ``eol while
+    scanning``, or ``invalid character`` (e.g. em-dash) on the remainder.
+
+    Repeatedly ``ast.parse`` and rewrite the error line with
+    :func:`_convert_single_to_double_quoted` whenever that changes the line.
+    """
+    for _ in range(20):  # guard against infinite loops
+        try:
+            ast.parse(code)
+            return code
+        except SyntaxError as exc:
+            if exc.lineno is None:
+                return code
+
+            lines = code.splitlines()
+            line_idx = exc.lineno - 1
+            if line_idx >= len(lines):
+                return code
+
+            original = lines[line_idx]
+            fixed = _convert_single_to_double_quoted(original)
+            if fixed == original:
+                return code  # heuristic cannot improve this error
+
+            lines[line_idx] = fixed
+            code = "\n".join(lines)
+
+    return code
+
+
+# ---------------------------------------------------------------------------
+# Google Slides data-out contract prep
+# ---------------------------------------------------------------------------
+
+_ALPHA_PAT = re.compile(r"""[,\s]*['"]alpha['"]\s*:\s*[\d.]+""")
+
+
+def prepare_requests_code(code: str) -> str:
+    """Prep generated code that defines build_slide_requests(...).
+
+    Reuses the request-shape fixers from the legacy ``_prepare_code`` but wraps
+    bare code into ``build_slide_requests`` (not ``add_slide_to_presentation``)
+    and never references services."""
+    if "def build_slide_requests" not in code:
+        lines = code.split("\n")
+        imports, body, helpers = [], [], []
+        in_helper = False
+        for line in lines:
+            stripped = line.strip()
+            if stripped.startswith(("import ", "from ")) and not body:
+                imports.append(line)
+            elif stripped.startswith(("def emu(", "def hex_to_rgb(")):
+                in_helper = True
+                helpers.append(line)
+            elif in_helper:
+                if stripped == "" or (line and line[0] == " "):
+                    helpers.append(line)
+                    if stripped == "":
+                        in_helper = False
+                else:
+                    in_helper = False
+                    body.append(line)
+            else:
+                body.append(line)
+        indented = [("    " + l if l.strip() else "") for l in body]
+        parts = []
+        if imports:
+            parts.append("\n".join(imports) + "\n")
+        if helpers:
+            parts.append("\n".join(helpers) + "\n")
+        parts.append("def build_slide_requests(html_str, assets_dir, page_id):")
+        parts.extend(indented)
+        parts.append("    return requests")
+        code = "\n".join(parts)
+
+    if "import os" not in code:
+        code = "import os\nimport json\nimport uuid\n\n" + code
+
+    for smart, straight in {"‘": "'", "’": "'", "“": '"', "”": '"'}.items():
+        code = code.replace(smart, straight)
+
+    if "alpha" in code:
+        code = _ALPHA_PAT.sub("", code)
+    if "'paragraphStyle'" in code:
+        code = code.replace("'paragraphStyle'", "'style'")
+    if '"paragraphStyle"' in code:
+        code = code.replace('"paragraphStyle"', '"style"')
+    if "'textStyle'" in code:
+        code = code.replace("'textStyle'", "'style'")
+    if '"textStyle"' in code:
+        code = code.replace('"textStyle"', '"style"')
+
+    code = _fix_apostrophe_strings(code)
+    return code

databricks_tellr_app-0.3.13.dev3/src/services/converter_jail/gslides_runner.py

@@ -0,0 +1,78 @@
+# src/services/converter_jail/gslides_runner.py
+"""In-jail trusted runner for Google Slides conversion (SDR-4437 HIGH-5).
+
+Runs each generated build_slide_requests(html_str, assets_dir, page_id)
+snippet and collects the returned request lists into a JSON file. NO network,
+NO credentials. The host validates, uploads assets, substitutes placeholder
+URLs, and executes the requests.
+
+CLI: python -I gslides_runner.py <src_parent> <job_dir> <requests_out_path>
+(<src_parent> is part of the launcher's CLI contract; this runner does NOT
+put it on sys.path — importing anything via `src.services` would execute that
+package's heavy __init__ and drag the credential-capable SDK graph into the
+jail child. Siblings are imported as top-level modules instead.)
+"""
+
+import importlib.util
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+_HERE = Path(__file__).resolve().parent
+
+if __package__ in (None, ""):
+    # Script mode (inside the jail child): import siblings as top-level
+    # modules so src/services/__init__.py (SDK/agent graph) never executes.
+    sys.path.insert(0, str(_HERE))
+    import protocol
+    from codeprep import prepare_requests_code
+else:
+    # Imported on the trusted host (unit tests): normal package imports.
+    from src.services.converter_jail import protocol
+    from src.services.converter_jail.codeprep import prepare_requests_code
+
+
+def _exec_snippet(code: str, html_str: str, assets_dir: str, page_id: str):
+    """Run one snippet; return (requests_list_or_None, error_or_None)."""
+    code = prepare_requests_code(code)
+    tmp = Path(tempfile.mktemp(suffix=".py", prefix="jail_gslide_"))
+    tmp.write_text(code, encoding="utf-8")
+    try:
+        spec = importlib.util.spec_from_file_location("jail_gslide", str(tmp))
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        requests = module.build_slide_requests(html_str, assets_dir, page_id)
+        if not isinstance(requests, list):
+            return None, f"build_slide_requests returned {type(requests).__name__}"
+        return requests, None
+    except Exception as exc:
+        return None, repr(exc)
+    finally:
+        if tmp.exists():
+            tmp.unlink()
+
+
+def run(job_dir: str, requests_out_path: str) -> None:
+    manifest = json.loads((Path(job_dir) / protocol.MANIFEST_NAME).read_text())
+    out = []
+    for entry in manifest["slides"]:
+        i = entry["index"]
+        page_id = entry["page_id"]
+        sdir = Path(job_dir) / entry["dir"]
+        assets_dir = str(sdir / protocol.ASSETS_DIR)
+        if not entry.get("has_code"):
+            out.append({"index": i, "page_id": page_id, "requests": None,
+                        "error": "no_code"})
+            continue
+        html_str = (sdir / protocol.HTML_NAME).read_text(encoding="utf-8")
+        code = (sdir / protocol.CODE_NAME).read_text(encoding="utf-8")
+        requests, error = _exec_snippet(code, html_str, assets_dir, page_id)
+        out.append({"index": i, "page_id": page_id,
+                    "requests": requests, "error": error})
+    Path(requests_out_path).write_text(json.dumps(out))
+
+
+if __name__ == "__main__":
+    # argv: [runner, src_parent, job_dir, requests_out_path]
+    run(sys.argv[2], sys.argv[3])