databricks-tellr-app 0.3.13.dev4__tar.gz → 0.3.13.dev12__tar.gz

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev4
+Version: 0.3.13.dev12
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -24,7 +24,7 @@ Requires-Dist: tinycss2==1.3.0
 Requires-Dist: esprima==4.0.1
 Requires-Dist: sqlalchemy==2.0.36
 Requires-Dist: psycopg2-binary==2.9.10
-Requires-Dist: databricks-sql-connector==3.0.1
+Requires-Dist: databricks-sql-connector>=3.0.0
 Requires-Dist: httpx==0.28.1
 Requires-Dist: jinja2==3.1.2
 Requires-Dist: python-dotenv==1.2.1
@@ -32,12 +32,12 @@ Requires-Dist: pyyaml==6.0.1
 Requires-Dist: pandas==2.3.3
 Requires-Dist: python-pptx==0.6.23
 Requires-Dist: playwright==1.48.0
-Requires-Dist: Pillow==11.3.0
-Requires-Dist: google-api-python-client==2.190.0
-Requires-Dist: google-auth-oauthlib==1.2.4
-Requires-Dist: google-auth-httplib2==0.3.0
-Requires-Dist: cryptography==46.0.3
-Requires-Dist: sse-starlette==3.0.3
+Requires-Dist: Pillow>=10.0.0
+Requires-Dist: google-api-python-client>=2.100.0
+Requires-Dist: google-auth-oauthlib>=1.2.0
+Requires-Dist: google-auth-httplib2>=0.2.0
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: sse-starlette>=3.0.0
 Requires-Dist: databricks-sdk==0.120.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/databricks_tellr_app/run.py

@@ -62,18 +62,6 @@ def init_database(seed_databricks_defaults: bool = False) -> None:
         logger.error(f"Failed to seed defaults: {e}\n{tb}")
         raise SystemExit(1) from e
 
-    # Seed/load the Fernet master key pre-fork (SDR-4437 CRITICAL-3) so all
-    # uvicorn workers find the encryption_keys row already present.
-    logger.info("Ensuring encryption key...")
-    try:
-        from src.core.encryption import ensure_encryption_key
-        ensure_encryption_key()
-        logger.info("Encryption key ready")
-    except Exception as e:
-        tb = traceback.format_exc()
-        logger.error(f"Failed to ensure encryption key: {e}\n{tb}")
-        raise SystemExit(1) from e
-
 
 def main() -> None:
     """Start the uvicorn server."""

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.3.13.dev4
+Version: 0.3.13.dev12
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -24,7 +24,7 @@ Requires-Dist: tinycss2==1.3.0
 Requires-Dist: esprima==4.0.1
 Requires-Dist: sqlalchemy==2.0.36
 Requires-Dist: psycopg2-binary==2.9.10
-Requires-Dist: databricks-sql-connector==3.0.1
+Requires-Dist: databricks-sql-connector>=3.0.0
 Requires-Dist: httpx==0.28.1
 Requires-Dist: jinja2==3.1.2
 Requires-Dist: python-dotenv==1.2.1
@@ -32,12 +32,12 @@ Requires-Dist: pyyaml==6.0.1
 Requires-Dist: pandas==2.3.3
 Requires-Dist: python-pptx==0.6.23
 Requires-Dist: playwright==1.48.0
-Requires-Dist: Pillow==11.3.0
-Requires-Dist: google-api-python-client==2.190.0
-Requires-Dist: google-auth-oauthlib==1.2.4
-Requires-Dist: google-auth-httplib2==0.3.0
-Requires-Dist: cryptography==46.0.3
-Requires-Dist: sse-starlette==3.0.3
+Requires-Dist: Pillow>=10.0.0
+Requires-Dist: google-api-python-client>=2.100.0
+Requires-Dist: google-auth-oauthlib>=1.2.0
+Requires-Dist: google-auth-httplib2>=0.2.0
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: sse-starlette>=3.0.0
 Requires-Dist: databricks-sdk==0.120.0
 Requires-Dist: mlflow[databricks]==3.14.0
 Requires-Dist: mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ setup.py
 ./src/api/middleware/__init__.py
 ./src/api/middleware/request_logging.py
 ./src/api/routes/__init__.py
+./src/api/routes/_authz.py
 ./src/api/routes/admin.py
 ./src/api/routes/admin_usage.py
 ./src/api/routes/agent_config.py
@@ -76,7 +77,6 @@ setup.py
 ./src/database/__init__.py
 ./src/database/models/__init__.py
 ./src/database/models/deck_contributor.py
-./src/database/models/encryption_key.py
 ./src/database/models/feedback.py
 ./src/database/models/genie_space.py
 ./src/database/models/google_global_credentials.py
@@ -157,6 +157,7 @@ src/api/fixtures/tour_demo_deck.json
 src/api/middleware/__init__.py
 src/api/middleware/request_logging.py
 src/api/routes/__init__.py
+src/api/routes/_authz.py
 src/api/routes/admin.py
 src/api/routes/admin_usage.py
 src/api/routes/agent_config.py
@@ -220,7 +221,6 @@ src/core/user_context.py
 src/database/__init__.py
 src/database/models/__init__.py
 src/database/models/deck_contributor.py
-src/database/models/encryption_key.py
 src/database/models/feedback.py
 src/database/models/genie_space.py
 src/database/models/google_global_credentials.py

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/databricks_tellr_app.egg-info/requires.txt

@@ -18,7 +18,7 @@ tinycss2==1.3.0
 esprima==4.0.1
 sqlalchemy==2.0.36
 psycopg2-binary==2.9.10
-databricks-sql-connector==3.0.1
+databricks-sql-connector>=3.0.0
 httpx==0.28.1
 jinja2==3.1.2
 python-dotenv==1.2.1
@@ -26,12 +26,12 @@ pyyaml==6.0.1
 pandas==2.3.3
 python-pptx==0.6.23
 playwright==1.48.0
-Pillow==11.3.0
-google-api-python-client==2.190.0
-google-auth-oauthlib==1.2.4
-google-auth-httplib2==0.3.0
-cryptography==46.0.3
-sse-starlette==3.0.3
+Pillow>=10.0.0
+google-api-python-client>=2.100.0
+google-auth-oauthlib>=1.2.0
+google-auth-httplib2>=0.2.0
+cryptography>=42.0.0
+sse-starlette>=3.0.0
 databricks-sdk==0.120.0
 mlflow[databricks]==3.14.0
 mlflow-skinny==3.14.0

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.3.13.dev4"
+version = "0.3.13.dev12"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -29,7 +29,7 @@ dependencies = [
     "esprima==4.0.1",
     "sqlalchemy==2.0.36",
     "psycopg2-binary==2.9.10",
-    "databricks-sql-connector==3.0.1",
+    "databricks-sql-connector>=3.0.0",
     "httpx==0.28.1",
     "jinja2==3.1.2",
     "python-dotenv==1.2.1",
@@ -37,12 +37,12 @@ dependencies = [
     "pandas==2.3.3",
     "python-pptx==0.6.23",
     "playwright==1.48.0",
-    "Pillow==11.3.0",
-    "google-api-python-client==2.190.0",
-    "google-auth-oauthlib==1.2.4",
-    "google-auth-httplib2==0.3.0",
-    "cryptography==46.0.3",
-    "sse-starlette==3.0.3",
+    "Pillow>=10.0.0",
+    "google-api-python-client>=2.100.0",
+    "google-auth-oauthlib>=1.2.0",
+    "google-auth-httplib2>=0.2.0",
+    "cryptography>=42.0.0",
+    "sse-starlette>=3.0.0",
     # --- Resolver-speedup pins: the backtracking-driver cluster ---
     # Databricks Apps installs this wheel in a platform-managed BUILD phase with a
     # ~10-minute budget. Left ranged, the databricks-langchain ->
@@ -58,8 +58,6 @@ dependencies = [
     # via a devloop deploy if these constraints change. Formerly injected at
     # deploy time as _RESOLVER_SPEEDUP_PINS; now carried in the wheel so a bare
     # `pip install databricks-tellr-app` is safe.
-    # SDR-4437 MEDIUM-7 (July 2026): the 7 formerly-ranged direct deps above
-    # this block are now exact-pinned too; same refresh discipline.
     "databricks-sdk==0.120.0",
     "mlflow[databricks]==3.14.0",
     "mlflow-skinny==3.14.0",

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/src/api/main.py

@@ -13,7 +13,7 @@ from pathlib import Path
 
 from fastapi import FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import FileResponse
+from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 
 from src.api.routes import admin, admin_usage, agent_config, chat, export, feedback, images, profiles, sessions, slides, tools, tour, verification, version, google_slides, setup, local_version
@@ -417,6 +417,30 @@ from src.api.middleware.request_logging import RequestLoggingMiddleware
 
 app.add_middleware(RequestLoggingMiddleware)
 
+# ---------------------------------------------------------------------------
+# Exception handlers — keep BELOW the middleware-registration block above
+# (Track A of SDR-4437 owns that block; do not reorder or interleave).
+#
+# HIGH-6: when user_auth_middleware fails to build the OBO client, the request
+# used to proceed silently as the SP; now the first user-scoped call raises
+# UserClientRequiredError, mapped here to a clean 401 instead of a 500 from
+# deep inside a tool call.
+# ---------------------------------------------------------------------------
+from src.core.databricks_client import UserClientRequiredError
+
+
+@app.exception_handler(UserClientRequiredError)
+async def user_client_required_handler(request: Request, exc: UserClientRequiredError):
+    logger.warning("User-scoped call without a bound OBO client: %s", exc)
+    return JSONResponse(
+        status_code=401,
+        content={
+            "detail": "Your Databricks identity could not be resolved for this "
+            "request. Please refresh the page to re-authenticate."
+        },
+    )
+
+
 # Include API routers
 app.include_router(admin.router)
 app.include_router(admin_usage.router)

databricks_tellr_app-0.3.13.dev12/src/api/routes/_authz.py

@@ -0,0 +1,337 @@
+"""Shared authorization helpers for API routes (SDR-4437 PR-2).
+
+Consolidates the deck-permission helpers that previously lived in
+``sessions.py`` and ``slides.py`` (names and signatures preserved), and adds:
+
+- ``_require_export_job_access`` — job-ID → session_id → deck permission
+  (closes the job-ID IDOR on export poll/download and Google Slides poll).
+- ``require_admin`` — HIGH-2 admin primitive. Admin == holds CAN_MANAGE on
+  the Databricks App itself, tested by reading the app's ACL with the
+  caller's own OBO client (reading an object's ACL requires CAN_MANAGE on
+  it, so the read succeeding *is* the admin test; group-held / inherited
+  CAN_MANAGE resolves server-side for free).
+"""
+
+import logging
+import os
+import time
+from typing import Optional, Tuple
+
+from databricks.sdk.errors import PermissionDenied
+from fastapi import HTTPException
+from sqlalchemy.orm import Session
+
+from src.api.services.session_manager import SessionNotFoundError, get_session_manager
+from src.core.database import get_db_session
+from src.core.permission_context import get_permission_context
+from src.core.user_context import get_current_user
+from src.database.models.profile_contributor import PermissionLevel
+from src.services.permission_service import PERMISSION_PRIORITY, get_permission_service
+
+logger = logging.getLogger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# Deck-permission helpers (moved from sessions.py / slides.py — verbatim)
+# ---------------------------------------------------------------------------
+
+
+def _get_session_permission_for_info(
+    session_info: dict,
+    db: Session,
+) -> Tuple[bool, Optional[PermissionLevel]]:
+    """Check user's permission on a session via deck_contributors.
+
+    (Moved from sessions.py:_get_session_permission.)
+
+    Resolves to the root session (parent for contributor sessions) and checks
+    the DeckContributor table for the current user's permission level.
+
+    Args:
+        session_info: Session dict with id, created_by, parent_session_id, etc.
+        db: Database session
+
+    Returns:
+        Tuple of (has_access, permission_level)
+    """
+    perm_ctx = get_permission_context()
+    perm_service = get_permission_service()
+    parent_id = session_info.get("parent_session_internal_id")
+    root_session_id = parent_id if parent_id is not None else session_info.get("id")
+    perm = perm_service.get_deck_permission(
+        db, root_session_id,
+        user_id=perm_ctx.user_id if perm_ctx else None,
+        user_name=perm_ctx.user_name if perm_ctx else None,
+        group_ids=perm_ctx.group_ids if perm_ctx else None,
+    )
+    if perm is None:
+        return False, None
+    return True, perm
+
+
+def _get_session_permission_by_id(
+    session_id: str,
+    db: Session,
+) -> Tuple[bool, Optional[PermissionLevel]]:
+    """Check if current user has access to a session's slides via deck_contributors.
+
+    (Moved from slides.py:_get_session_permission.)
+
+    Resolves to the root session (parent for contributor sessions) and checks
+    the DeckContributor table for the current user's permission level.
+
+    Args:
+        session_id: Session identifier (string)
+        db: Database session
+
+    Returns:
+        Tuple of (has_access, permission_level)
+    """
+    session_manager = get_session_manager()
+    ctx = get_permission_context()
+
+    try:
+        session_info = session_manager.get_session(session_id)
+    except SessionNotFoundError:
+        return False, None
+
+    perm_service = get_permission_service()
+    parent_internal_id = session_info.get("parent_session_internal_id")
+    root_session_id = (
+        parent_internal_id if parent_internal_id is not None else session_info.get("id")
+    )
+
+    perm = perm_service.get_deck_permission(
+        db, root_session_id,
+        user_id=ctx.user_id if ctx else None,
+        user_name=ctx.user_name if ctx else None,
+        group_ids=ctx.group_ids if ctx else None,
+    )
+    if perm is None:
+        return False, None
+    return True, perm
+
+
+def _require_session_access(
+    session_info: dict,
+    db: Session,
+    min_permission: PermissionLevel = PermissionLevel.CAN_VIEW,
+) -> PermissionLevel:
+    """Require user has at least the specified permission level on a session.
+
+    (Moved from sessions.py.)
+
+    Args:
+        session_info: Session dict with created_by and profile_id
+        db: Database session
+        min_permission: Minimum required permission (default: CAN_VIEW)
+
+    Returns:
+        The user's actual permission level
+
+    Raises:
+        HTTPException 403: If user doesn't have required permission
+    """
+    has_access, permission = _get_session_permission_for_info(session_info, db)
+
+    if not has_access or permission is None:
+        raise HTTPException(
+            status_code=403,
+            detail="You don't have permission to access this session",
+        )
+
+    if PERMISSION_PRIORITY[permission] < PERMISSION_PRIORITY[min_permission]:
+        raise HTTPException(
+            status_code=403,
+            detail=f"This action requires {min_permission.value} permission",
+        )
+
+    return permission
+
+
+def _require_slide_permission(
+    session_id: str,
+    db: Session,
+    min_permission: PermissionLevel = PermissionLevel.CAN_VIEW,
+) -> PermissionLevel:
+    """Require user has at least the specified permission level on slides.
+
+    (Moved from slides.py.)
+
+    Args:
+        session_id: Session identifier
+        db: Database session
+        min_permission: Minimum required permission (default: CAN_VIEW)
+
+    Returns:
+        The user's actual permission level
+
+    Raises:
+        HTTPException 403: If user doesn't have required permission
+    """
+    has_access, permission = _get_session_permission_by_id(session_id, db)
+
+    if not has_access or permission is None:
+        raise HTTPException(
+            status_code=403,
+            detail="You don't have permission to access these slides",
+        )
+
+    if PERMISSION_PRIORITY[permission] < PERMISSION_PRIORITY[min_permission]:
+        raise HTTPException(
+            status_code=403,
+            detail=f"This action requires {min_permission.value} permission",
+        )
+
+    return permission
+
+
+def _check_deck_permission_for_session(
+    session_id: str,
+    min_permission: PermissionLevel = PermissionLevel.CAN_VIEW,
+) -> None:
+    """Look up a session by string ID, resolve root, and enforce deck permission.
+
+    (Moved from sessions.py.)
+
+    This is the standard pattern for endpoints that only have a session_id string
+    and need to gate on deck permissions.  It opens its own DB session via
+    ``get_db_session`` so it can be called from endpoints that do not already
+    have one.
+
+    Args:
+        session_id: The string session_id passed to the endpoint.
+        min_permission: Minimum required permission level.
+
+    Raises:
+        HTTPException 404: If the session does not exist (stale tab, deleted session, wrong ID).
+        HTTPException 403: If the caller lacks the required permission.
+    """
+    session_manager = get_session_manager()
+    try:
+        session_info = session_manager.get_session(session_id)
+    except SessionNotFoundError:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Session not found: {session_id}",
+        ) from None
+    with get_db_session() as db:
+        _require_session_access(session_info, db, min_permission)
+
+
+# ---------------------------------------------------------------------------
+# Job-ID access (export poll/download, Google Slides poll)
+# ---------------------------------------------------------------------------
+
+
+def _require_export_job_access(
+    job_id: str,
+    min_permission: PermissionLevel = PermissionLevel.CAN_VIEW,
+) -> None:
+    """Resolve an export job's session and enforce deck permission on it.
+
+    Every ExportJob row is session-bound (both enqueue sites require a
+    session_id), so possession of a job_id must not grant access to another
+    user's export — the caller needs ``min_permission`` on the job's deck.
+
+    Raises:
+        HTTPException 404: unknown job_id.
+        HTTPException 404/403: from the deck-permission check.
+    """
+    from src.database.models.session import ExportJob
+
+    with get_db_session() as db:
+        job = db.query(ExportJob).filter(ExportJob.job_id == job_id).first()
+        session_id = job.session_id if job is not None else None
+    if session_id is None:
+        raise HTTPException(status_code=404, detail="Export job not found")
+    _check_deck_permission_for_session(session_id, min_permission)
+
+
+# ---------------------------------------------------------------------------
+# HIGH-2: admin primitive — App CAN_MANAGE via OBO self-test
+# ---------------------------------------------------------------------------
+
+_ADMIN_CACHE: dict = {}
+_ADMIN_CACHE_TTL_SECONDS = 60.0
+
+
+def _is_production() -> bool:
+    return os.getenv("ENVIRONMENT", "development") == "production"
+
+
+def _admin_acl_probe(user_name: str) -> bool:
+    """Return True iff the caller's OBO client can read the app's ACL.
+
+    Reading an object's ACL in Databricks requires CAN_MANAGE on it, so a
+    successful ``apps.get_permissions`` call with the caller's own token is
+    the admin test. A CAN_USE-only caller raises ``PermissionDenied``, which
+    ``require_admin`` treats as a definitive (cacheable) deny; any other
+    error (missing OBO client, API/network failure) fails closed for the
+    current request without being cached. Missing app name -> False.
+    ``user_name`` is for logging/attribution only — the *token* is what is
+    being tested.
+    """
+    app_name = os.environ.get("DATABRICKS_APP_NAME")
+    if not app_name:
+        logger.warning("require_admin: DATABRICKS_APP_NAME unset; failing closed")
+        return False
+    from src.core.databricks_client import get_user_client
+
+    client = get_user_client()
+    client.apps.get_permissions(app_name)
+    return True
+
+
+def require_admin() -> None:
+    """FastAPI dependency: caller must hold CAN_MANAGE on the Databricks App.
+
+    - Local dev/test: bypass (dev auth is DEV_USER_ID with no token or ACL
+      behind it) — same pattern as the dev-only CORS gate in main.py.
+    - Verdicts cached per-username with a short TTL. The cache is in-memory
+      and therefore per-worker — deliberately fine here: a cache miss on
+      another worker just re-runs the ACL lookup; correctness never depends
+      on which worker got the request.
+    - Only *definitive* verdicts are cached: a probe result, or a
+      ``PermissionDenied`` from the API (the token demonstrably lacks
+      CAN_MANAGE). Transient probe errors fail closed for the current
+      request but are NOT cached — otherwise one network blip would lock a
+      real admin out for the full TTL.
+    - Fail closed (403) on non-admin, missing user, missing OBO client, or
+      lookup error.
+    """
+    if not _is_production():
+        return
+    user = get_current_user()
+    if not user:
+        raise HTTPException(status_code=403, detail="Admin access required")
+
+    now = time.monotonic()
+    cached = _ADMIN_CACHE.get(user)
+    if cached is not None and now - cached[1] < _ADMIN_CACHE_TTL_SECONDS:
+        verdict = cached[0]
+    else:
+        try:
+            verdict = _admin_acl_probe(user)
+            _ADMIN_CACHE[user] = (verdict, now)
+        except PermissionDenied:
+            # Definitive API answer: the token lacks CAN_MANAGE. Cacheable.
+            verdict = False
+            _ADMIN_CACHE[user] = (verdict, now)
+        except Exception:
+            logger.warning(
+                "require_admin: ACL probe failed for %s; failing closed (uncached)",
+                user,
+                exc_info=True,
+            )
+            # Fail closed on THIS request only — do not cache error-derived
+            # denials (a transient blip must not deny an admin for the TTL).
+            verdict = False
+
+    if not verdict:
+        raise HTTPException(status_code=403, detail="Admin access required")
+
+
+def reset_admin_cache() -> None:
+    """Clear the admin-verdict cache (tests)."""
+    _ADMIN_CACHE.clear()

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/src/api/routes/admin.py

@@ -9,6 +9,7 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 
+from src.api.routes._authz import require_admin
 from src.api.utils.validation import validate_credentials_json
 from src.core.database import get_db
 from src.core.encryption import decrypt_data, encrypt_data
@@ -23,7 +24,10 @@ from src.database.models.google_oauth_token import GoogleOAuthToken
 
 logger = logging.getLogger(__name__)
 
-router = APIRouter(prefix="/api/admin", tags=["admin"])
+# SDR-4437 HIGH-2: entire admin surface requires App CAN_MANAGE.
+router = APIRouter(
+    prefix="/api/admin", tags=["admin"], dependencies=[Depends(require_admin)]
+)
 
 _MAX_CREDENTIALS_SIZE = 100 * 1024
 

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/src/api/routes/admin_usage.py

@@ -1,4 +1,4 @@
-"""Admin usage-analytics endpoints (ungated, like the rest of /admin)."""
+"""Admin usage-analytics endpoints (admin-gated, like the rest of /admin)."""
 
 import logging
 from datetime import date as dt_date
@@ -7,11 +7,18 @@ from datetime import datetime
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.orm import Session
 
+from src.api.routes._authz import require_admin
 from src.api.services.usage_service import MAX_WINDOW_DAYS, UsageService
 from src.core.database import get_db
 
 logger = logging.getLogger(__name__)
-router = APIRouter(prefix="/api/admin/usage", tags=["admin-usage"])
+
+# SDR-4437 MEDIUM-6: workspace-wide usage analytics are admin-only.
+router = APIRouter(
+    prefix="/api/admin/usage",
+    tags=["admin-usage"],
+    dependencies=[Depends(require_admin)],
+)
 
 
 def _parse_date(value: str, name: str) -> dt_date:

{databricks_tellr_app-0.3.13.dev4 → databricks_tellr_app-0.3.13.dev12}/src/api/routes/agent_config.py

@@ -7,10 +7,12 @@ from typing import Literal
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel, Field, ValidationError
 
+from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.schemas.agent_config import AgentConfig, ToolEntry, resolve_agent_config
 from src.api.services.session_manager import SessionNotFoundError, get_session_manager
 from src.core.database import get_db_session
 from src.database.models import UserSession
+from src.database.models.profile_contributor import PermissionLevel
 
 logger = logging.getLogger(__name__)
 
@@ -83,6 +85,8 @@ class PatchToolRequest(BaseModel):
 @router.get("")
 async def get_agent_config(session_id: str):
     """Return the current agent config for a session (defaults if null)."""
+    # SDR-4437 HIGH-1: reading a session's agent config requires CAN_VIEW.
+    _check_deck_permission_for_session(session_id, PermissionLevel.CAN_VIEW)
     try:
         mgr = get_session_manager()
         session = await asyncio.to_thread(mgr.get_session, session_id)
@@ -99,6 +103,8 @@ async def get_agent_config(session_id: str):
 @router.put("")
 async def put_agent_config(session_id: str, config: AgentConfig):
     """Replace the full agent config for a session."""
+    # SDR-4437 HIGH-1: agent-config writes repoint the session's tools — CAN_MANAGE.
+    _check_deck_permission_for_session(session_id, PermissionLevel.CAN_MANAGE)
     # Pydantic already validated duplicates via model_validator.
     # Now validate foreign-key references.
     _validate_references(config)
@@ -114,6 +120,8 @@ async def put_agent_config(session_id: str, config: AgentConfig):
 @router.patch("/tools")
 async def patch_tools(session_id: str, body: PatchToolRequest):
     """Add or remove a single tool from the session's agent config."""
+    # SDR-4437 HIGH-1: agent-config writes repoint the session's tools — CAN_MANAGE.
+    _check_deck_permission_for_session(session_id, PermissionLevel.CAN_MANAGE)
     try:
         mgr = get_session_manager()
         session = await asyncio.to_thread(mgr.get_session, session_id)