databricks-tellr-app 0.4.2.dev20__tar.gz → 0.4.3.dev2__tar.gz

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev20
+Version: 0.4.3.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev2}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev20
+Version: 0.4.3.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.2.dev20"
+version = "0.4.3.dev2"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev2}/src/api/middleware/security_headers.py

@@ -31,6 +31,28 @@ Content-Security-Policy differentiated by response type:
   'none', no eval) plus the html_safety.py scanner, and any header at
   all is a strict improvement over the previous no-CSP state.
 
+  SDR-4437 M-CSP — ACCEPTED RESIDUAL (pending SE sign-off). M-CSP asks
+  to move ``script-src`` off ``'unsafe-inline'`` to hashes/nonces. That
+  is infeasible here and was verified:
+    * The SPA's own document has NO inline <script> — index.html loads a
+      single external module (``/src/main.tsx``), already covered by
+      ``'self'``. So the SPA itself does not need 'unsafe-inline'.
+    * The 'unsafe-inline' exists ONLY for the srcdoc slide iframes, whose
+      generated HTML contains arbitrary inline <script> (Chart.js init,
+      etc.) and which inherit THIS document policy in addition to their
+      own SLIDE_CSP meta (both enforce; most restrictive wins).
+    * Per CSP2+, adding any nonce or hash to ``script-src`` makes the
+      browser IGNORE 'unsafe-inline'. A nonce on the parent would
+      therefore disable inline execution for the inherited srcdoc slide
+      scripts and break slide rendering app-wide — you cannot have
+      "nonce + unsafe-inline" both take effect.
+  Removing it would require re-architecting slides away from srcdoc
+  (backend-served ``src`` iframes), which the frame-ancestors / no-src
+  design above deliberately avoids. The residual is bounded: slides stay
+  confined by SLIDE_CSP (an egress boundary) + the html_safety scanner,
+  and the DOCUMENT_CSP ⊇ SLIDE_CSP superset invariant is locked by
+  tests/unit/test_export_csp.py::test_document_csp_header_is_superset_of_slide_csp.
+
 - Everything else (JSON APIs, assets, SSE) gets the deny-all
   ``API_CSP`` — nothing executes in a JSON response.
 

{databricks_tellr_app-0.4.2.dev20 → databricks_tellr_app-0.4.3.dev2}/src/database/types.py

@@ -70,9 +70,20 @@ class NormalizedAgentConfig(TypeDecorator):
     not have its caller's dict edited underneath it).
 
     Emits an ordinary ``JSON`` column, so adopting it needs no migration.
+
+    ``none_as_null=True`` is load-bearing, not tidiness. ``sqlalchemy.JSON`` defaults
+    to ``none_as_null=False``, which serializes a bound ``None`` into the two-byte
+    document ``null`` instead of leaving the column as SQL NULL — and the JSON scalar
+    ``null`` is NOT SQL NULL. It is a stored value that merely READS as empty:
+    ``IS NULL`` does not match it, while the ORM attribute deserializes it to ``None``
+    exactly like SQL NULL, so nothing above the driver can tell the two apart. The
+    startup backfill ``migrate_profiles`` selects the rows it has to fill with
+    ``agent_config.is_(None)``, so adopting this type silently made every freshly
+    seeded profile invisible to it. See
+    ``tests/unit/test_unset_agent_config_is_sql_null.py``.
     """
 
-    impl = JSON
+    impl = JSON(none_as_null=True)
     cache_ok = True
 
     def process_bind_param(self, value: Any, dialect: Any) -> Any: