databricks-tellr-app 0.3.13.dev2__tar.gz → 0.3.13.dev4__tar.gz

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev2
+Version: 0.3.13.dev4
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -24,7 +24,7 @@ Requires-Dist: tinycss2==1.3.0
 Requires-Dist: esprima==4.0.1
 Requires-Dist: sqlalchemy==2.0.36
 Requires-Dist: psycopg2-binary==2.9.10
-Requires-Dist: databricks-sql-connector>=3.0.0
+Requires-Dist: databricks-sql-connector==3.0.1
 Requires-Dist: httpx==0.28.1
 Requires-Dist: jinja2==3.1.2
 Requires-Dist: python-dotenv==1.2.1
@@ -32,12 +32,12 @@ Requires-Dist: pyyaml==6.0.1
 Requires-Dist: pandas==2.3.3
 Requires-Dist: python-pptx==0.6.23
 Requires-Dist: playwright==1.48.0
-Requires-Dist: Pillow>=10.0.0
-Requires-Dist: google-api-python-client>=2.100.0
-Requires-Dist: google-auth-oauthlib>=1.2.0
-Requires-Dist: google-auth-httplib2>=0.2.0
-Requires-Dist: cryptography>=42.0.0
-Requires-Dist: sse-starlette>=3.0.0
+Requires-Dist: Pillow==11.3.0
+Requires-Dist: google-api-python-client==2.190.0
+Requires-Dist: google-auth-oauthlib==1.2.4
+Requires-Dist: google-auth-httplib2==0.3.0
+Requires-Dist: cryptography==46.0.3
+Requires-Dist: sse-starlette==3.0.3
 Requires-Dist: databricks-sdk==0.120.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/databricks_tellr_app/run.py

@@ -62,6 +62,18 @@ def init_database(seed_databricks_defaults: bool = False) -> None:
         logger.error(f"Failed to seed defaults: {e}\n{tb}")
         raise SystemExit(1) from e
 
+    # Seed/load the Fernet master key pre-fork (SDR-4437 CRITICAL-3) so all
+    # uvicorn workers find the encryption_keys row already present.
+    logger.info("Ensuring encryption key...")
+    try:
+        from src.core.encryption import ensure_encryption_key
+        ensure_encryption_key()
+        logger.info("Encryption key ready")
+    except Exception as e:
+        tb = traceback.format_exc()
+        logger.error(f"Failed to ensure encryption key: {e}\n{tb}")
+        raise SystemExit(1) from e
+
 
 def main() -> None:
     """Start the uvicorn server."""

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev2
+Version: 0.3.13.dev4
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -24,7 +24,7 @@ Requires-Dist: tinycss2==1.3.0
 Requires-Dist: esprima==4.0.1
 Requires-Dist: sqlalchemy==2.0.36
 Requires-Dist: psycopg2-binary==2.9.10
-Requires-Dist: databricks-sql-connector>=3.0.0
+Requires-Dist: databricks-sql-connector==3.0.1
 Requires-Dist: httpx==0.28.1
 Requires-Dist: jinja2==3.1.2
 Requires-Dist: python-dotenv==1.2.1
@@ -32,12 +32,12 @@ Requires-Dist: pyyaml==6.0.1
 Requires-Dist: pandas==2.3.3
 Requires-Dist: python-pptx==0.6.23
 Requires-Dist: playwright==1.48.0
-Requires-Dist: Pillow>=10.0.0
-Requires-Dist: google-api-python-client>=2.100.0
-Requires-Dist: google-auth-oauthlib>=1.2.0
-Requires-Dist: google-auth-httplib2>=0.2.0
-Requires-Dist: cryptography>=42.0.0
-Requires-Dist: sse-starlette>=3.0.0
+Requires-Dist: Pillow==11.3.0
+Requires-Dist: google-api-python-client==2.190.0
+Requires-Dist: google-auth-oauthlib==1.2.4
+Requires-Dist: google-auth-httplib2==0.3.0
+Requires-Dist: cryptography==46.0.3
+Requires-Dist: sse-starlette==3.0.3
 Requires-Dist: databricks-sdk==0.120.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -11,9 +11,7 @@ setup.py
 ./src/api/mcp_server.py
 ./src/api/fixtures/tour_demo_deck.json
 ./src/api/middleware/__init__.py
-./src/api/middleware/csrf.py
 ./src/api/middleware/request_logging.py
-./src/api/middleware/security_headers.py
 ./src/api/routes/__init__.py
 ./src/api/routes/admin.py
 ./src/api/routes/admin_usage.py
@@ -78,6 +76,7 @@ setup.py
 ./src/database/__init__.py
 ./src/database/models/__init__.py
 ./src/database/models/deck_contributor.py
+./src/database/models/encryption_key.py
 ./src/database/models/feedback.py
 ./src/database/models/genie_space.py
 ./src/database/models/google_global_credentials.py
@@ -156,9 +155,7 @@ src/api/mcp_auth.py
 src/api/mcp_server.py
 src/api/fixtures/tour_demo_deck.json
 src/api/middleware/__init__.py
-src/api/middleware/csrf.py
 src/api/middleware/request_logging.py
-src/api/middleware/security_headers.py
 src/api/routes/__init__.py
 src/api/routes/admin.py
 src/api/routes/admin_usage.py
@@ -223,6 +220,7 @@ src/core/user_context.py
 src/database/__init__.py
 src/database/models/__init__.py
 src/database/models/deck_contributor.py
+src/database/models/encryption_key.py
 src/database/models/feedback.py
 src/database/models/genie_space.py
 src/database/models/google_global_credentials.py

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/databricks_tellr_app.egg-info/requires.txt

@@ -18,7 +18,7 @@ tinycss2==1.3.0
 esprima==4.0.1
 sqlalchemy==2.0.36
 psycopg2-binary==2.9.10
-databricks-sql-connector>=3.0.0
+databricks-sql-connector==3.0.1
 httpx==0.28.1
 jinja2==3.1.2
 python-dotenv==1.2.1
@@ -26,12 +26,12 @@ pyyaml==6.0.1
 pandas==2.3.3
 python-pptx==0.6.23
 playwright==1.48.0
-Pillow>=10.0.0
-google-api-python-client>=2.100.0
-google-auth-oauthlib>=1.2.0
-google-auth-httplib2>=0.2.0
-cryptography>=42.0.0
-sse-starlette>=3.0.0
+Pillow==11.3.0
+google-api-python-client==2.190.0
+google-auth-oauthlib==1.2.4
+google-auth-httplib2==0.3.0
+cryptography==46.0.3
+sse-starlette==3.0.3
 databricks-sdk==0.120.0
 mlflow[databricks]==3.14.0
 mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.3.13.dev2"
+version = "0.3.13.dev4"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -29,7 +29,7 @@ dependencies = [
     "esprima==4.0.1",
     "sqlalchemy==2.0.36",
     "psycopg2-binary==2.9.10",
-    "databricks-sql-connector>=3.0.0",
+    "databricks-sql-connector==3.0.1",
     "httpx==0.28.1",
     "jinja2==3.1.2",
     "python-dotenv==1.2.1",
@@ -37,12 +37,12 @@ dependencies = [
     "pandas==2.3.3",
     "python-pptx==0.6.23",
     "playwright==1.48.0",
-    "Pillow>=10.0.0",
-    "google-api-python-client>=2.100.0",
-    "google-auth-oauthlib>=1.2.0",
-    "google-auth-httplib2>=0.2.0",
-    "cryptography>=42.0.0",
-    "sse-starlette>=3.0.0",
+    "Pillow==11.3.0",
+    "google-api-python-client==2.190.0",
+    "google-auth-oauthlib==1.2.4",
+    "google-auth-httplib2==0.3.0",
+    "cryptography==46.0.3",
+    "sse-starlette==3.0.3",
     # --- Resolver-speedup pins: the backtracking-driver cluster ---
     # Databricks Apps installs this wheel in a platform-managed BUILD phase with a
     # ~10-minute budget. Left ranged, the databricks-langchain ->
@@ -58,6 +58,8 @@ dependencies = [
     # via a devloop deploy if these constraints change. Formerly injected at
     # deploy time as _RESOLVER_SPEEDUP_PINS; now carried in the wheel so a bare
     # `pip install databricks-tellr-app` is safe.
+    # SDR-4437 MEDIUM-7 (July 2026): the 7 formerly-ranged direct deps above
+    # this block are now exact-pinned too; same refresh discipline.
     "databricks-sdk==0.120.0",
     "mlflow[databricks]==3.14.0",
     "mlflow-skinny==3.14.0",

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/src/api/main.py

@@ -417,24 +417,6 @@ from src.api.middleware.request_logging import RequestLoggingMiddleware
 
 app.add_middleware(RequestLoggingMiddleware)
 
-# === SDR-4437 Track A security middleware (PR-1a/PR-1b) ==================
-# Keep ALL security-middleware registration inside this delimited block
-# (PR-2 adds an exception handler below the middleware block — do not edit
-# outside these markers). Starlette wraps later-added middleware outermost;
-# ordering here is deliberate:
-#   SecurityHeaders (outermost, added last) -> CSRF -> RequestLogging ->
-#   user_auth -> CORS(dev) -> normalize_mcp_path -> routes
-# Headers must stamp EVERY response (including CSRF 403s); CSRF must reject
-# forged cross-site requests before OBO auth work and before request_logs
-# DB writes. CSRF runs outside normalize_mcp_path, so it sees the raw
-# un-rewritten /mcp path (its exemption handles both /mcp and /mcp/).
-from src.api.middleware.csrf import CSRFProtectionMiddleware  # noqa: E402
-from src.api.middleware.security_headers import SecurityHeadersMiddleware  # noqa: E402
-
-app.add_middleware(CSRFProtectionMiddleware)
-app.add_middleware(SecurityHeadersMiddleware)
-# === end SDR-4437 Track A security middleware =============================
-
 # Include API routers
 app.include_router(admin.router)
 app.include_router(admin_usage.router)

databricks_tellr_app-0.3.13.dev4/src/core/encryption.py

@@ -0,0 +1,125 @@
+"""Fernet symmetric encryption for sensitive data (OAuth credentials, tokens).
+
+Uses AES-128-CBC with HMAC-SHA256 authentication via the ``cryptography``
+library. The master key lives in the ``encryption_keys`` table of the
+application database (SDR-4437 CRITICAL-3): dynamic, persistent across
+restarts/restores, unique per deployment, zero operator setup.
+
+Resolution is SELECT-first, then race-safe INSERT-if-absent:
+
+1. ``SELECT key_value FROM encryption_keys WHERE id = 1`` — read-first is
+   load-bearing: on upgraded installs the table is created by the *deployer*
+   role and the app SP holds an explicit SELECT, INSERT grant; reading first
+   means INSERT privilege is never exercised when the row already exists.
+2. If absent, seed from a legacy ``.encryption_key`` file in the project root
+   (local dev — keeps pre-existing dev ciphertext decryptable), else generate
+   a fresh key.
+3. ``INSERT ... ON CONFLICT (id) DO NOTHING`` + read-back, so concurrent
+   workers/replicas converge on one key.
+
+There is deliberately NO env-var fallback: the deploy tool relocates the
+legacy ``GOOGLE_OAUTH_ENCRYPTION_KEY`` into this table at update time, and
+old-tool + new-wheel skew is unsupported (see the SDR-4437 remediation
+design, PR-3).
+"""
+
+import logging
+from functools import lru_cache
+from pathlib import Path
+
+from cryptography.fernet import Fernet, InvalidToken
+from sqlalchemy import text
+
+logger = logging.getLogger(__name__)
+
+_KEY_FILE = Path(__file__).resolve().parents[2] / ".encryption_key"
+
+# NOTE: these statements are deliberately schema-UNQUALIFIED, unlike the
+# _qual()-qualified raw SQL in database.py::_run_migrations. This module must
+# also run against SQLite (unit tests — no schemas) and schema-less local
+# Postgres. On Lakebase the bare name resolves to
+# <LAKEBASE_SCHEMA>.encryption_keys ONLY because _get_database_url appends
+# options=-csearch_path%3D<schema> to the URL (database.py:239,259) and the
+# do_connect listener injects just the password, preserving those options.
+# If that search_path mechanism ever changes, these statements would silently
+# target public.encryption_keys — keep this coupling in mind.
+_SELECT_KEY = text("SELECT key_value FROM encryption_keys WHERE id = 1")
+_INSERT_KEY = text(
+    "INSERT INTO encryption_keys (id, key_value, created_at) "
+    "VALUES (1, :key_value, CURRENT_TIMESTAMP) "
+    "ON CONFLICT (id) DO NOTHING"
+)
+
+
+def _validated(key: bytes) -> bytes:
+    try:
+        Fernet(key)
+    except (ValueError, TypeError) as exc:
+        raise RuntimeError(
+            "encryption_keys row id=1 is not a valid Fernet key — refusing to "
+            "start with a corrupt master key. Restore the correct key value "
+            "before restarting."
+        ) from exc
+    return key
+
+
+def _seed_value() -> bytes:
+    """Pick the value to seed an empty encryption_keys table with."""
+    if _KEY_FILE.exists():
+        key = _KEY_FILE.read_text().strip()
+        if key:
+            logger.info("Seeding encryption_keys from legacy key file %s", _KEY_FILE)
+            return key.encode()
+    logger.info("Generating new Fernet master key (fresh install)")
+    return Fernet.generate_key()
+
+
+@lru_cache(maxsize=1)
+def get_encryption_key() -> bytes:
+    """Return the Fernet master key from the encryption_keys table (id=1)."""
+    from src.core.database import get_db_session
+
+    # 1. Read-first (see module docstring for why this order matters).
+    with get_db_session() as session:
+        row = session.execute(_SELECT_KEY).first()
+    if row and row[0]:
+        return _validated(row[0].encode())
+
+    # 2 + 3. Seed if absent — race-safe across workers/replicas.
+    seed = _seed_value()
+    with get_db_session() as session:
+        session.execute(_INSERT_KEY, {"key_value": seed.decode()})
+    with get_db_session() as session:
+        row = session.execute(_SELECT_KEY).first()
+    if not row or not row[0]:
+        raise RuntimeError(
+            "Failed to seed encryption_keys: no key row after insert. "
+            "Check the app's SELECT, INSERT grants on the data schema."
+        )
+    return _validated(row[0].encode())
+
+
+def ensure_encryption_key() -> None:
+    """Pre-fork boot hook: load/seed the key before uvicorn workers fork.
+
+    Called from the deployed app's init_database step so all workers find
+    the row already present (the lazy path in get_encryption_key covers
+    local dev and replicas regardless).
+    """
+    get_encryption_key()
+
+
+def encrypt_data(plaintext: str) -> str:
+    """Encrypt *plaintext* and return a base64-encoded ciphertext string."""
+    f = Fernet(get_encryption_key())
+    return f.encrypt(plaintext.encode()).decode()
+
+
+def decrypt_data(ciphertext: str) -> str:
+    """Decrypt a base64-encoded *ciphertext* string and return the plaintext.
+
+    Raises:
+        cryptography.fernet.InvalidToken: If the key does not match or data is corrupt.
+    """
+    f = Fernet(get_encryption_key())
+    return f.decrypt(ciphertext.encode()).decode()

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/src/core/lakebase.py

@@ -280,120 +280,6 @@ def get_lakebase_connection_url(
     return url
 
 
-def setup_lakebase_schema(
-    instance_name: str,
-    schema: str,
-    client_id: str,
-    user: Optional[str] = None,
-    client: Optional[WorkspaceClient] = None,
-    endpoint_name: Optional[str] = None,
-    host: Optional[str] = None,
-    lakebase_type: str = "provisioned",
-) -> None:
-    """
-    Set up schema and grant permissions in Lakebase for an app.
-
-    Supports both provisioned and autoscaling Lakebase.
-
-    This function connects to the Lakebase instance and:
-    1. Creates the schema if it doesn't exist
-    2. Grants necessary permissions to the app's service principal (client_id)
-
-    Note: This should be called after the app is created and the database
-    resource is attached, as the client_id comes from the app's service principal.
-
-    Args:
-        instance_name: Name of the Lakebase instance
-        schema: Schema name to create
-        client_id: App's service principal client ID (becomes Postgres role)
-        user: Postgres username for connection (uses default if not provided)
-        client: Optional WorkspaceClient
-        endpoint_name: Full endpoint resource name (autoscaling only)
-        host: Pre-resolved host (autoscaling only)
-        lakebase_type: 'autoscaling' or 'provisioned'
-
-    Raises:
-        LakebaseError: If schema setup fails
-    """
-    logger.info(
-        "Setting up Lakebase schema",
-        extra={
-            "instance_name": instance_name, "schema": schema,
-            "client_id": client_id, "lakebase_type": lakebase_type,
-        },
-    )
-
-    try:
-        # Get connection info
-        conn_info = get_lakebase_connection_info(
-            instance_name=instance_name,
-            user=user,
-            client=client,
-            endpoint_name=endpoint_name,
-            host=host,
-            lakebase_type=lakebase_type,
-        )
-
-        # Use psycopg2 directly for DDL operations
-        import psycopg2
-
-        conn = psycopg2.connect(
-            host=conn_info["host"],
-            port=conn_info["port"],
-            user=conn_info["user"],
-            password=conn_info["password"],
-            dbname=conn_info["database"],
-            sslmode="require",
-        )
-        conn.autocommit = True
-
-        with conn.cursor() as cur:
-            # Create schema if not exists
-            cur.execute(f'CREATE SCHEMA IF NOT EXISTS "{schema}"')
-            logger.info(f"Schema created or verified: {schema}")
-
-            # Grant permissions to app's service principal
-            # The client_id is automatically available as a Postgres role when
-            # the database is added as an app resource
-            cur.execute(f'GRANT USAGE ON SCHEMA "{schema}" TO "{client_id}"')
-            cur.execute(f'GRANT CREATE ON SCHEMA "{schema}" TO "{client_id}"')
-
-            # Grant permissions on all tables in schema (for existing tables)
-            cur.execute(
-                f'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA "{schema}" TO "{client_id}"'
-            )
-
-            # Grant permissions on all sequences in schema (for auto-increment columns)
-            cur.execute(
-                f'GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "{schema}" TO "{client_id}"'
-            )
-
-            # Set default privileges for future tables
-            cur.execute(
-                f'ALTER DEFAULT PRIVILEGES IN SCHEMA "{schema}" '
-                f'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "{client_id}"'
-            )
-
-            # Set default privileges for future sequences
-            cur.execute(
-                f'ALTER DEFAULT PRIVILEGES IN SCHEMA "{schema}" '
-                f'GRANT USAGE, SELECT ON SEQUENCES TO "{client_id}"'
-            )
-
-            logger.info(f"Permissions granted to {client_id} on schema {schema}")
-
-        conn.close()
-
-    except ImportError:
-        raise LakebaseError(
-            "psycopg2 is required for Lakebase schema setup. "
-            "Install with: pip install psycopg2-binary"
-        )
-    except Exception as e:
-        logger.error(f"Failed to setup Lakebase schema: {e}", exc_info=True)
-        raise LakebaseError(f"Lakebase schema setup failed: {e}") from e
-
-
 def initialize_lakebase_tables(
     instance_name: str,
     schema: str,

{databricks_tellr_app-0.3.13.dev2 → databricks_tellr_app-0.3.13.dev4}/src/database/models/__init__.py

@@ -1,6 +1,7 @@
 """Database models."""
 
 from src.database.models.deck_contributor import DeckContributor
+from src.database.models.encryption_key import EncryptionKey
 from src.database.models.feedback import FeedbackConversation, SurveyResponse
 from src.database.models.genie_space import ConfigGenieSpace
 from src.database.models.google_global_credentials import GoogleGlobalCredentials
@@ -34,6 +35,7 @@ __all__ = [
     "ChatRequest",
     "ConfigGenieSpace",
     "DeckContributor",
+    "EncryptionKey",
     "ConfigProfile",
     "ConfigProfileContributor",
     "ConfigPrompts",

databricks_tellr_app-0.3.13.dev4/src/database/models/encryption_key.py

@@ -0,0 +1,30 @@
+"""Application-managed encryption key storage (SDR-4437 CRITICAL-3).
+
+Holds the Fernet master key for OAuth credential/token encryption in the
+ACL-governed Lakebase data schema instead of app.yaml. Single-row table
+(id = 1). Deliberately shares the data schema's grants: the key carries
+the same ACLs as the ciphertext it protects — an explicitly accepted risk
+in the SDR-4437 remediation design. Do NOT add key-specific grant
+tightening here.
+"""
+
+from sqlalchemy import Column, DateTime, Integer, Text
+
+from src.core.database import Base
+
+
+class EncryptionKey(Base):
+    """Fernet master key for OAuth credential/token encryption."""
+
+    __tablename__ = "encryption_keys"
+
+    id = Column(Integer, primary_key=True, autoincrement=False)
+    key_value = Column(Text, nullable=False)
+    # No Python-side default: every insert path (the app's raw-SQL seed and
+    # the deploy migration DDL) supplies CURRENT_TIMESTAMP explicitly, so a
+    # default would be dead code — and the codebase-conventional
+    # datetime.utcnow is deprecated on Python 3.12+.
+    created_at = Column(DateTime, nullable=False)
+
+    def __repr__(self) -> str:  # never print key material
+        return f"<EncryptionKey(id={self.id}, created_at={self.created_at})>"

databricks_tellr_app-0.3.13.dev2/src/api/middleware/csrf.py

@@ -1,109 +0,0 @@
-"""Origin-validation CSRF protection (SDR-4437 CRITICAL-2, PR-1b).
-
-Threat model: the app sets no cookies of its own — auth arrives via
-proxy-attested ``x-forwarded-*`` headers. The CSRF-relevant ambient
-credential is the platform SSO cookie at the Databricks Apps proxy: a
-cross-site browser request to the app URL rides that cookie, the proxy
-authenticates it and forwards it carrying the victim's identity.
-Validating the browser-attested ``Origin`` (falling back to ``Referer``)
-against the app's own origin closes this at the app layer.
-
-Deliberate choices (documented for security review):
-
-- **Neither header present -> allow.** Cross-origin browser POSTs always
-  send ``Origin``, so the realistic attack always presents a mismatch;
-  header-less mutating requests are non-browser clients (scripts/curl via
-  the proxy), which rejecting would break for no security gain. A strict
-  mode can be revisited if security review requires it.
-- **/mcp is exempt.** It authenticates with bearer tokens, not cookies, so
-  it is not a CSRF target. The mounted sub-app IS wrapped by the parent
-  app's middleware (that is how ``normalize_mcp_path`` works), so the
-  exemption must be this explicit path check, not an assumption that
-  mounts bypass middleware. This middleware runs OUTSIDE
-  ``normalize_mcp_path``, so it sees the raw ``/mcp`` (un-rewritten) path
-  — both ``/mcp`` and ``/mcp/...`` are matched; ``/mcp-anything`` is not.
-- **Expected origin:** ``DATABRICKS_APP_URL`` (platform-injected on
-  Databricks Apps deploys — same assumption as
-  ``src/api/mcp_server.py::_public_app_url``). If unset, fall back to the
-  origin reconstructed from ``x-forwarded-proto``/``x-forwarded-host``
-  (the proxy always sends these; same pattern as
-  ``google_slides.py::_build_redirect_uri``), so a missing var degrades to
-  a self-referential check instead of blocking all writes.
-- **Inactive outside production** — consistent with the dev-only CORS gate
-  in ``main.py`` (dev auth is ``DEV_USER_ID`` with no proxy in front).
-"""
-
-import logging
-import os
-from urllib.parse import urlsplit
-
-from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.requests import Request
-from starlette.responses import JSONResponse, Response
-
-logger = logging.getLogger(__name__)
-
-_UNSAFE_METHODS = frozenset({"POST", "PUT", "PATCH", "DELETE"})
-
-
-def _origin_of(url: str) -> str:
-    """Normalize a URL (or Origin header value) to ``scheme://host[:port]``.
-
-    Returns "" for values with no parseable scheme+host (e.g. ``null``).
-    """
-    parts = urlsplit(url.strip())
-    if not parts.scheme or not parts.netloc:
-        return ""
-    return f"{parts.scheme.lower()}://{parts.netloc.lower()}"
-
-
-class CSRFProtectionMiddleware(BaseHTTPMiddleware):
-    """Reject state-changing requests whose Origin/Referer is cross-site."""
-
-    def __init__(self, app, enabled: bool | None = None):
-        super().__init__(app)
-        self.enabled = (
-            enabled
-            if enabled is not None
-            else os.getenv("ENVIRONMENT", "development") == "production"
-        )
-
-    async def dispatch(self, request: Request, call_next) -> Response:
-        if not self.enabled or request.method not in _UNSAFE_METHODS:
-            return await call_next(request)
-
-        path = request.url.path
-        if path == "/mcp" or path.startswith("/mcp/"):
-            return await call_next(request)
-
-        claimed = request.headers.get("origin") or request.headers.get("referer")
-        if not claimed:
-            return await call_next(request)
-
-        claimed_origin = _origin_of(claimed)
-        expected_origin = self._expected_origin(request)
-        if claimed_origin and expected_origin and claimed_origin == expected_origin:
-            return await call_next(request)
-
-        logger.warning(
-            "CSRF: rejected cross-origin %s %s (claimed=%r, expected=%r)",
-            request.method,
-            path,
-            claimed_origin,
-            expected_origin,
-        )
-        return JSONResponse(
-            status_code=403,
-            content={"detail": "Cross-origin request rejected"},
-        )
-
-    @staticmethod
-    def _expected_origin(request: Request) -> str:
-        app_url = os.getenv("DATABRICKS_APP_URL", "")
-        if app_url:
-            return _origin_of(app_url)
-        host = request.headers.get("x-forwarded-host", "")
-        proto = request.headers.get("x-forwarded-proto", "https")
-        if host:
-            return f"{proto.strip().lower()}://{host.split(',')[0].strip().lower()}"
-        return ""