databricks-tellr-app 0.4.2.dev20__tar.gz → 0.4.3.dev1__tar.gz

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev20
+Version: 0.4.3.dev1
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev20
+Version: 0.4.3.dev1
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.2.dev20"
+version = "0.4.3.dev1"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/api/routes/images.py

@@ -1,4 +1,5 @@
 """Image upload and management API endpoints."""
+import base64
 import logging
 import os
 from typing import List, Optional
@@ -20,7 +21,7 @@ router = APIRouter(prefix="/api/images", tags=["images"])
 
 class ImageResponse(BaseModel):
     """Response schema for image metadata."""
-    id: int
+    id: str  # Opaque token (SDR-4437 F-TM-7) — the internal int PK is never exposed.
     filename: str
     original_filename: str
     mime_type: str
@@ -46,7 +47,7 @@ class ImageListResponse(BaseModel):
 
 class ImageDataResponse(BaseModel):
     """Response containing image base64 data."""
-    id: int
+    id: str  # Opaque token (SDR-4437 F-TM-7).
     mime_type: str
     base64_data: str
     data_uri: str  # Ready-to-use: "data:image/png;base64,..."
@@ -80,7 +81,7 @@ def _get_current_user() -> str:
 
 def _image_to_response(img: ImageAsset) -> ImageResponse:
     return ImageResponse(
-        id=img.id,
+        id=img.token,  # Expose the opaque token, never the enumerable int PK.
         filename=img.filename,
         original_filename=img.original_filename,
         mime_type=img.mime_type,
@@ -167,58 +168,75 @@ def list_images(
         )
 
 
-@router.get("/{image_id}", response_model=ImageResponse)
-def get_image(image_id: int, db: Session = Depends(get_db)):
-    """Get image metadata by ID."""
+def _deny_ephemeral_cross_user(image: ImageAsset) -> None:
+    """Defense-in-depth (SDR-4437 F-TM-7): chat-pasted ("ephemeral") images are
+    private to their uploader. Library images stay open-read. Raise 404 (not 403)
+    so a wrong caller cannot even confirm the image exists.
+    """
+    if image.category == "ephemeral" and image.uploaded_by != _get_current_user():
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+
+
+@router.get("/{token}", response_model=ImageResponse)
+def get_image(token: str, db: Session = Depends(get_db)):
+    """Get image metadata by opaque token."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,
         ).first()
         if not image:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+        _deny_ephemeral_cross_user(image)
         return _image_to_response(image)
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Error getting image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error getting image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image",
         )
 
 
-@router.get("/{image_id}/data", response_model=ImageDataResponse)
-def get_image_data(image_id: int, db: Session = Depends(get_db)):
-    """Get full image as base64 data (for embedding in slides)."""
+@router.get("/{token}/data", response_model=ImageDataResponse)
+def get_image_data(token: str, db: Session = Depends(get_db)):
+    """Get full image as base64 data (for embedding in slides), keyed by token."""
     try:
-        b64_data, mime_type = image_service.get_image_base64(db, image_id)
+        image = db.query(ImageAsset).filter(
+            ImageAsset.token == token,
+            ImageAsset.is_active == True,
+        ).first()
+        if not image:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+        _deny_ephemeral_cross_user(image)
+        b64_data = base64.b64encode(image.image_data).decode("utf-8")
         return ImageDataResponse(
-            id=image_id,
-            mime_type=mime_type,
+            id=image.token,
+            mime_type=image.mime_type,
             base64_data=b64_data,
-            data_uri=f"data:{mime_type};base64,{b64_data}",
+            data_uri=f"data:{image.mime_type};base64,{b64_data}",
         )
-    except ValueError as e:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+    except HTTPException:
+        raise
     except Exception as e:
-        logger.error(f"Error getting image data {image_id}: {e}", exc_info=True)
+        logger.error(f"Error getting image data: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image data",
         )
 
 
-@router.put("/{image_id}", response_model=ImageResponse)
+@router.put("/{token}", response_model=ImageResponse)
 def update_image(
-    image_id: int,
+    token: str,
     request: ImageUpdateRequest,
     db: Session = Depends(get_db),
 ):
     """Update image metadata (tags, description, category)."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,
         ).first()
         if not image:
@@ -246,20 +264,20 @@ def update_image(
         raise
     except Exception as e:
         db.rollback()
-        logger.error(f"Error updating image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error updating image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to update image",
         )
 
 
-@router.delete("/{image_id}", status_code=status.HTTP_204_NO_CONTENT)
-def delete_image(image_id: int, db: Session = Depends(get_db)):
+@router.delete("/{token}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_image(token: str, db: Session = Depends(get_db)):
     """Soft-delete an image."""
     try:
         user = _get_current_user()
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,  # noqa: E712
         ).first()
         if not image:
@@ -270,14 +288,14 @@ def delete_image(image_id: int, db: Session = Depends(get_db)):
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="You don't have permission to modify this image",
             )
-        image_service.delete_image(db, image_id, user)
+        image_service.delete_image(db, token, user)
     except HTTPException:
         raise
     except ValueError as e:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
     except Exception as e:
         db.rollback()
-        logger.error(f"Error deleting image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error deleting image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to delete image",

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/api/schemas/requests.py

@@ -74,9 +74,9 @@ class ChatRequest(BaseModel):
         default=None,
         description="Optional context containing the slides to edit",
     )
-    image_ids: Optional[list[int]] = Field(
+    image_ids: Optional[list[str]] = Field(
         default=None,
-        description="IDs of images attached to this message (from upload or paste)",
+        description="Opaque tokens of images attached to this message (SDR-4437 F-TM-7)",
     )
     agent_config: Optional[dict] = Field(
         default=None,

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/api/services/chat_service.py

@@ -345,7 +345,7 @@ class ChatService:
         session_id: str,
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
-        image_ids: Optional[List[int]] = None,
+        image_ids: Optional[List[str]] = None,
     ) -> Dict[str, Any]:
         """Send a message to the agent and get response.
 
@@ -828,7 +828,7 @@ class ChatService:
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
         request_id: Optional[str] = None,
-        image_ids: Optional[List[int]] = None,
+        image_ids: Optional[List[str]] = None,
         is_first_message_override: Optional[bool] = None,
     ) -> Generator[StreamEvent, None, None]:
         """Send a message and yield streaming events.
@@ -1993,27 +1993,30 @@ class ChatService:
         
         return ([], None)
 
-    def _inject_image_context(self, message: str, image_ids: List[int]) -> str:
-        """Append image metadata to user message so the agent knows about attached images."""
+    def _inject_image_context(self, message: str, image_ids: List[str]) -> str:
+        """Append image metadata to user message so the agent knows about attached images.
+
+        ``image_ids`` are opaque image tokens (SDR-4437 F-TM-7), not int PKs.
+        """
         from src.core.database import get_db_session
         from src.services import image_service
 
         image_descriptions = []
         with get_db_session() as db:
-            for img_id in image_ids:
+            for img_token in image_ids:
                 try:
                     img = db.query(image_service.ImageAsset).filter(
-                        image_service.ImageAsset.id == img_id,
+                        image_service.ImageAsset.token == img_token,
                         image_service.ImageAsset.is_active == True,
                     ).first()
                     if img:
                         image_descriptions.append(
-                            f'- Image ID {img.id}: "{img.original_filename}" '
+                            f'- Image ID {img.token}: "{img.original_filename}" '
                             f'({img.description or "no description"}). '
-                            f'Use: <img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />'
+                            f'Use: <img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />'
                         )
                 except Exception as e:
-                    logger.warning(f"Failed to load image {img_id} for context injection: {e}")
+                    logger.warning(f"Failed to load image {img_token} for context injection: {e}")
 
         if not image_descriptions:
             return message

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/core/database.py

@@ -524,6 +524,8 @@ def _run_migrations(engine, schema: str | None = None):
         # --- image_assets.tags: json → jsonb (PostgreSQL) for native @> queries ---
         _migrate_image_assets_tags_json_to_jsonb(conn, schema, _qual, is_sqlite)
 
+        # --- image_assets.token: unguessable external id + backfill (SDR-4437 F-TM-7) ---
+        _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite)
         # --- agent_config: style precedence in the DB, for the raw-SQL writers no
         # --- Python-side bind hook can see (PostgreSQL only; no-op on SQLite) ---
         _migrate_agent_config_precedence_trigger(
@@ -1058,6 +1060,44 @@ def _ensure_llm_judge_backend_default(
         )
 
 
+def _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite) -> None:
+    """Add the unguessable ``token`` column to image_assets and backfill (SDR-4437 F-TM-7).
+
+    The int PK is enumerable, so image reads now key on an opaque token. Fresh
+    installs get the column via create_all(); existing tables need this ALTER +
+    per-row backfill. Idempotent: gated on the column's absence.
+    """
+    import secrets
+
+    from sqlalchemy import text
+
+    table = "image_assets"
+    try:
+        cols = {c["name"] for c in inspector.get_columns(table, schema=schema)}
+    except Exception:
+        return
+    if not cols or "token" in cols:
+        return
+
+    q = _qual(table)
+    logger.info(f"Migration: adding token column to {table} (SDR-4437 F-TM-7)")
+    # Add nullable first so the ALTER succeeds on a populated table.
+    conn.execute(text(f"ALTER TABLE {q} ADD COLUMN token VARCHAR(64)"))
+
+    # Backfill every existing row with a distinct unguessable token.
+    row_ids = [r[0] for r in conn.execute(text(f"SELECT id FROM {q} WHERE token IS NULL")).fetchall()]
+    for row_id in row_ids:
+        conn.execute(
+            text(f"UPDATE {q} SET token = :tok WHERE id = :id"),
+            {"tok": secrets.token_urlsafe(32), "id": row_id},
+        )
+
+    # Enforce uniqueness (and non-null on PostgreSQL, now that every row has a token).
+    conn.execute(text(
+        f"CREATE UNIQUE INDEX IF NOT EXISTS ix_image_assets_token ON {q} (token)"
+    ))
+    if not is_sqlite:
+        conn.execute(text(f"ALTER TABLE {q} ALTER COLUMN token SET NOT NULL"))
 #: The one place the precedence rule is written in SQL. ``$$``-quoted so the body
 #: needs no escaping, and named after the rule rather than the tables, since both
 #: ``agent_config`` columns share it.

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/database/models/image.py

@@ -1,4 +1,5 @@
 """Image asset model — metadata and binary data stored together in Lakebase."""
+import secrets
 from datetime import datetime
 
 from sqlalchemy import Boolean, Column, DateTime, Integer, JSON, LargeBinary, String, Text
@@ -10,6 +11,17 @@ from src.core.database import Base
 _TagsColumn = JSON().with_variant(JSONB(), "postgresql")
 
 
+def _new_image_token() -> str:
+    """Unguessable external identifier (SDR-4437 F-TM-7).
+
+    The autoincrement int PK is enumerable, so it is never exposed. This
+    opaque token is the only identifier that leaves the server — it is what
+    the API returns, what chat sends in ``image_ids``, and what goes in
+    ``{{image:...}}`` slide placeholders.
+    """
+    return secrets.token_urlsafe(32)
+
+
 class ImageAsset(Base):
     """Uploaded image with binary data stored directly in PostgreSQL.
 
@@ -20,7 +32,9 @@ class ImageAsset(Base):
 
     __tablename__ = "image_assets"
 
-    id = Column(Integer, primary_key=True)
+    id = Column(Integer, primary_key=True)  # Internal only — never serialized.
+    # Unguessable external identifier (SDR-4437 F-TM-7). token_urlsafe(32) → 43 chars.
+    token = Column(String(64), unique=True, nullable=False, index=True, default=_new_image_token)
     filename = Column(String(255), nullable=False)           # Generated: {uuid}.{ext}
     original_filename = Column(String(255), nullable=False)  # User's original filename
     mime_type = Column(String(50), nullable=False)           # image/png, image/jpeg, image/gif, image/svg+xml

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/database/types.py

@@ -70,9 +70,20 @@ class NormalizedAgentConfig(TypeDecorator):
     not have its caller's dict edited underneath it).
 
     Emits an ordinary ``JSON`` column, so adopting it needs no migration.
+
+    ``none_as_null=True`` is load-bearing, not tidiness. ``sqlalchemy.JSON`` defaults
+    to ``none_as_null=False``, which serializes a bound ``None`` into the two-byte
+    document ``null`` instead of leaving the column as SQL NULL — and the JSON scalar
+    ``null`` is NOT SQL NULL. It is a stored value that merely READS as empty:
+    ``IS NULL`` does not match it, while the ORM attribute deserializes it to ``None``
+    exactly like SQL NULL, so nothing above the driver can tell the two apart. The
+    startup backfill ``migrate_profiles`` selects the rows it has to fill with
+    ``agent_config.is_(None)``, so adopting this type silently made every freshly
+    seeded profile invisible to it. See
+    ``tests/unit/test_unset_agent_config_is_sql_null.py``.
     """
 
-    impl = JSON
+    impl = JSON(none_as_null=True)
     cache_ok = True
 
     def process_bind_param(self, value: Any, dialect: Any) -> Any:

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/services/image_service.py

@@ -51,7 +51,7 @@ def upload_image(
         ).first()
         if existing:
             raise ValueError(
-                f"An image named '{original_filename}' already exists (id={existing.id}). "
+                f"An image named '{original_filename}' already exists. "
                 "Please rename the file or delete the existing image first."
             )
 
@@ -86,19 +86,19 @@ def upload_image(
     return image
 
 
-def get_image_base64(db: Session, image_id: int) -> tuple[str, str]:
+def get_image_base64(db: Session, token: str) -> tuple[str, str]:
     """
-    Get full image as base64 string.
+    Get full image as base64 string, keyed by the opaque token (SDR-4437 F-TM-7).
 
     Returns:
         Tuple of (base64_data, mime_type)
     """
     image = db.query(ImageAsset).filter(
-        ImageAsset.id == image_id,
+        ImageAsset.token == token,
         ImageAsset.is_active == True,
     ).first()
     if not image:
-        raise ValueError(f"Image {image_id} not found")
+        raise ValueError(f"Image {token} not found")
 
     b64 = base64.b64encode(image.image_data).decode("utf-8")
     return b64, image.mime_type
@@ -175,11 +175,11 @@ def search_images(
     ).all()
 
 
-def delete_image(db: Session, image_id: int, user: str) -> None:
-    """Soft-delete an image."""
-    image = db.query(ImageAsset).filter(ImageAsset.id == image_id).first()
+def delete_image(db: Session, token: str, user: str) -> None:
+    """Soft-delete an image, keyed by the opaque token (SDR-4437 F-TM-7)."""
+    image = db.query(ImageAsset).filter(ImageAsset.token == token).first()
     if not image:
-        raise ValueError(f"Image {image_id} not found")
+        raise ValueError(f"Image {token} not found")
 
     image.is_active = False
     image.updated_by = user

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/services/image_tools.py

@@ -53,13 +53,13 @@ def search_images(
         # Must build results inside session scope to avoid DetachedInstanceError
         results = [
             {
-                "id": img.id,
+                "id": img.token,  # Opaque token (SDR-4437 F-TM-7), never the int PK.
                 "filename": img.original_filename,
                 "description": img.description,
                 "tags": img.tags,
                 "category": img.category,
                 "mime_type": img.mime_type,
-                "usage": f'<img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />',
+                "usage": f'<img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />',
             }
             for img in images
         ]

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev1}/src/utils/image_utils.py

@@ -8,7 +8,8 @@ from src.services import image_service
 
 logger = logging.getLogger(__name__)
 
-IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:(\d+)\}\}")
+# Tokens are secrets.token_urlsafe(...) → [A-Za-z0-9_-] (SDR-4437 F-TM-7).
+IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:([A-Za-z0-9_-]+)\}\}")
 
 
 def substitute_image_placeholders(html: str, db: Session) -> str:
@@ -22,12 +23,12 @@ def substitute_image_placeholders(html: str, db: Session) -> str:
         return html
 
     def replace_match(match):
-        image_id = int(match.group(1))
+        image_token = match.group(1)
         try:
-            b64_data, mime_type = image_service.get_image_base64(db, image_id)
+            b64_data, mime_type = image_service.get_image_base64(db, image_token)
             return f"data:{mime_type};base64,{b64_data}"
         except Exception as e:
-            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_id}}}}}: {e}")
+            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_token}}}}}: {e}")
             return match.group(0)  # Leave placeholder if image not found
 
     return IMAGE_PLACEHOLDER_PATTERN.sub(replace_match, html)