databricks-tellr-app 0.4.2.dev7__tar.gz → 0.4.2.dev8__tar.gz

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev7
+Version: 0.4.2.dev8
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev7
+Version: 0.4.2.dev8
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -37,6 +37,7 @@ setup.py
 ./src/api/routes/settings/__init__.py
 ./src/api/routes/settings/contributors.py
 ./src/api/routes/settings/deck_prompts.py
+./src/api/routes/settings/design_systems.py
 ./src/api/routes/settings/identities.py
 ./src/api/routes/settings/slide_styles.py
 ./src/api/schemas/__init__.py
@@ -55,13 +56,11 @@ setup.py
 ./src/api/services/job_queue.py
 ./src/api/services/session_manager.py
 ./src/api/services/session_naming.py
-./src/api/services/slide_repository.py
 ./src/api/services/usage_events.py
 ./src/api/services/usage_service.py
 ./src/api/utils/__init__.py
 ./src/api/utils/validation.py
 ./src/core/__init__.py
-./src/core/backfill_session_slides_startup.py
 ./src/core/config_loader.py
 ./src/core/context_utils.py
 ./src/core/database.py
@@ -79,8 +78,10 @@ setup.py
 ./src/core/settings_db.py
 ./src/core/user_context.py
 ./src/database/__init__.py
+./src/database/types.py
 ./src/database/models/__init__.py
 ./src/database/models/deck_contributor.py
+./src/database/models/design_system.py
 ./src/database/models/encryption_key.py
 ./src/database/models/feedback.py
 ./src/database/models/genie_space.py
@@ -105,6 +106,9 @@ setup.py
 ./src/services/agent_factory.py
 ./src/services/config_service.py
 ./src/services/config_validator.py
+./src/services/design_system_compiler.py
+./src/services/design_system_service.py
+./src/services/design_system_templates.py
 ./src/services/drive_uploader.py
 ./src/services/genie_service.py
 ./src/services/google_slides_auth.py
@@ -136,12 +140,14 @@ setup.py
 ./src/services/identity_providers/workspace_provider.py
 ./src/services/tools/__init__.py
 ./src/services/tools/agent_bricks_tool.py
+./src/services/tools/ds_asset_tool.py
 ./src/services/tools/genie_tool.py
 ./src/services/tools/mcp_tool.py
 ./src/services/tools/model_endpoint_tool.py
 ./src/services/tools/vector_tool.py
 ./src/utils/__init__.py
 ./src/utils/css_utils.py
+./src/utils/ds_asset_utils.py
 ./src/utils/error_handling.py
 ./src/utils/html_safety.py
 ./src/utils/html_utils.py
@@ -193,6 +199,7 @@ src/api/routes/version.py
 src/api/routes/settings/__init__.py
 src/api/routes/settings/contributors.py
 src/api/routes/settings/deck_prompts.py
+src/api/routes/settings/design_systems.py
 src/api/routes/settings/identities.py
 src/api/routes/settings/slide_styles.py
 src/api/schemas/__init__.py
@@ -211,13 +218,11 @@ src/api/services/feedback_service.py
 src/api/services/job_queue.py
 src/api/services/session_manager.py
 src/api/services/session_naming.py
-src/api/services/slide_repository.py
 src/api/services/usage_events.py
 src/api/services/usage_service.py
 src/api/utils/__init__.py
 src/api/utils/validation.py
 src/core/__init__.py
-src/core/backfill_session_slides_startup.py
 src/core/config_loader.py
 src/core/context_utils.py
 src/core/database.py
@@ -235,8 +240,10 @@ src/core/prompt_modules.py
 src/core/settings_db.py
 src/core/user_context.py
 src/database/__init__.py
+src/database/types.py
 src/database/models/__init__.py
 src/database/models/deck_contributor.py
+src/database/models/design_system.py
 src/database/models/encryption_key.py
 src/database/models/feedback.py
 src/database/models/genie_space.py
@@ -261,6 +268,9 @@ src/services/agent.py
 src/services/agent_factory.py
 src/services/config_service.py
 src/services/config_validator.py
+src/services/design_system_compiler.py
+src/services/design_system_service.py
+src/services/design_system_templates.py
 src/services/drive_uploader.py
 src/services/genie_service.py
 src/services/google_slides_auth.py
@@ -292,12 +302,14 @@ src/services/identity_providers/local_provider.py
 src/services/identity_providers/workspace_provider.py
 src/services/tools/__init__.py
 src/services/tools/agent_bricks_tool.py
+src/services/tools/ds_asset_tool.py
 src/services/tools/genie_tool.py
 src/services/tools/mcp_tool.py
 src/services/tools/model_endpoint_tool.py
 src/services/tools/vector_tool.py
 src/utils/__init__.py
 src/utils/css_utils.py
+src/utils/ds_asset_utils.py
 src/utils/error_handling.py
 src/utils/html_safety.py
 src/utils/html_utils.py

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.2.dev7"
+version = "0.4.2.dev8"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/src/api/main.py

@@ -27,6 +27,7 @@ from src.core.permission_context import (
 from src.api.routes.settings import (
     contributors_router,
     deck_prompts_router,
+    design_systems_router,
     identities_router,
     slide_styles_router,
 )
@@ -40,7 +41,6 @@ from src.core.database import (
     stop_token_refresh,
 )
 from src.core.migrate_profiles_to_agent_config import migrate_profiles, backfill_sessions
-from src.core.backfill_session_slides_startup import backfill_unmigrated_decks
 
 logger = logging.getLogger(__name__)
 
@@ -115,16 +115,6 @@ async def lifespan(app: FastAPI):
             backfilled = backfill_sessions(get_session_local())
             if backfilled:
                 logger.info(f"Backfilled {backfilled} sessions with agent_config")
-
-            # Row-per-slide: migrate historical deck_json blobs into session_slides
-            # rows. Guarded by a NOT EXISTS anti-join, so this is a no-op scan once
-            # every deck has rows. Runs here rather than as a manual script so an
-            # upgrade cannot leave decks half-migrated (a deck edited before a
-            # hand-run backfill acquires rows without its verdicts, and the
-            # idempotency guard then skips it permanently).
-            slide_decks = backfill_unmigrated_decks(get_session_local())
-            if slide_decks:
-                logger.info(f"Backfilled {slide_decks} deck(s) into session_slides rows")
         except Exception as e:
             logger.error(f"Failed to initialize database: {e}")
             raise
@@ -495,6 +485,7 @@ app.include_router(contributors_router, prefix="/api/settings", tags=["settings"
 app.include_router(deck_prompts_router, prefix="/api/settings", tags=["settings"])
 app.include_router(identities_router, prefix="/api/settings", tags=["settings"])
 app.include_router(slide_styles_router, prefix="/api/settings", tags=["settings"])
+app.include_router(design_systems_router, prefix="/api/settings", tags=["settings"])
 
 # MCP server — mount the FastMCP streamable-HTTP ASGI app at /mcp.
 # Must be registered before the SPA catch-all (which is added lazily by
@@ -535,16 +526,27 @@ async def get_current_user():
     
     Also includes the user's Databricks ID and group IDs from the permission
     context, which are used for profile permission checks.
+
+    ``is_admin`` is a UX-only signal so the frontend can hide admin surfaces
+    the caller cannot use; it is NOT authorization. Every admin route keeps
+    ``Depends(require_admin)`` and those 403s remain the real protection. It
+    is derived from that same primitive (``is_caller_admin``), so it cannot
+    advertise access the server would refuse, and it fails closed.
     """
+    from src.api.routes._authz import is_caller_admin
     from src.core.permission_context import get_permission_context
-    
+
     ctx_user = get_ctx_user()
     perm_ctx = get_permission_context()
-    
+
+    # Never raises (fails closed to False), so it cannot break identity resolution.
+    is_admin = is_caller_admin()
+
     if ctx_user:
         result = {
             "username": ctx_user,
             "display_name": ctx_user,
+            "is_admin": is_admin,
         }
         # Include permission context info if available
         if perm_ctx:
@@ -562,12 +564,14 @@ async def get_current_user():
             "username": user.user_name,
             "display_name": user.display_name or user.user_name,
             "user_id": user.id,
+            "is_admin": is_admin,
         }
     except Exception as e:
         logger.warning(f"Failed to get current user: {e}")
         return {
             "username": "user",
             "display_name": "User",
+            "is_admin": is_admin,
         }
 
 

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/src/api/mcp_server.py

@@ -28,7 +28,7 @@ from src.api.services.job_queue import enqueue_job, get_job_status
 from src.api.services.session_manager import get_session_manager
 from src.core.database import get_db_session
 from src.core.permission_context import get_permission_context
-from src.core.settings_db import get_default_slide_style_id
+from src.core.settings_db import get_default_design_system_id, get_default_slide_style_id
 from src.domain.slide_deck import SlideDeck
 from src.services.permission_service import get_permission_service
 
@@ -292,6 +292,106 @@ def _request_from_context(ctx: Context) -> Request:
     return req
 
 
+def _template_names_and_ids(design_system_id: int) -> list[tuple[str, int]]:
+    """The ACTIVE design system's ``(template name, template id)`` pairs.
+
+    Eagerly materialized to PLAIN values while the DB session is still OPEN.
+    This replaces a helper that returned the ``DesignSystem`` ORM instance
+    itself: ``get_db_session()`` commits and closes on exit, and the
+    sessionmaker uses SQLAlchemy's default ``expire_on_commit=True``, so that
+    instance was detached with its ``templates`` relationship expired. Reading
+    it raised ``DetachedInstanceError``, which the resolver caught and reported
+    as "name matched nothing" — silently ignoring every valid production
+    ``template_name``. Returning plain values makes that class of bug
+    unavailable rather than merely fixed.
+
+    Returns an empty list when the design system is missing or inactive, so the
+    caller's "no match -> no pin" path is unchanged. Scoped to the ONE design
+    system, so a name can never pin another system's template.
+    """
+    from src.core.database import get_db_session
+    from src.database.models import DesignSystem
+    from src.services.design_system_templates import materialize_templates
+
+    with get_db_session() as db:
+        design_system = (
+            db.query(DesignSystem)
+            .filter_by(id=design_system_id, is_active=True)
+            .first()
+        )
+        if design_system is None:
+            return []
+        # Same idempotent derivation the generation path uses, for systems
+        # imported before the templates table existed.
+        materialize_templates(design_system)
+        db.flush()  # newly materialized rows need ids before we read them
+        return [
+            (str(getattr(template, "name", None) or ""), int(template.id))
+            for template in (getattr(design_system, "templates", None) or [])
+            if getattr(template, "id", None) is not None
+        ]
+
+
+def _normalized_template_name(value: Optional[str]) -> str:
+    """The comparison key for template-name matching: casefolded, with all
+    whitespace runs collapsed to a single space.
+
+    Applied to BOTH sides so the notion of "the same name" is defined in exactly
+    one place — which is also what makes ambiguity detectable rather than
+    order-dependent.
+    """
+    return " ".join((value or "").split()).casefold()
+
+
+def _resolve_template_name(design_system_id: int, template_name: str) -> Optional[int]:
+    """Resolve a template NAME to its id within *design_system_id*.
+
+    MCP callers have no template ids — they see names (the compiler injects
+    the name+description catalog as soft-pick guidance), so a caller that
+    wants a specific layout pins it by name. Matching is case- and
+    whitespace-insensitive.
+
+    Because matching is insensitive, two DISTINCT rows can both match one query
+    ("Two Column" and "two column"). That is AMBIGUOUS, and returning the first
+    hit made the winner depend on relationship load order — a caller could
+    silently get the other layout, and which one could change between requests.
+    An ambiguous name is therefore UNRESOLVED: treated exactly like a name that
+    matches nothing, and logged so the duplicate rows are discoverable.
+
+    Returns ``None`` — never raises — when the design system is missing, the
+    name matches nothing, the name is ambiguous, or the lookup fails. An
+    unresolvable name must degrade to "no pin" (the model then soft-picks as
+    usual), never a 500.
+    """
+    wanted = _normalized_template_name(template_name)
+    if not wanted:
+        return None
+    try:
+        matches = [
+            template_id
+            for name, template_id in _template_names_and_ids(design_system_id)
+            if _normalized_template_name(name) == wanted
+        ]
+        if len(matches) == 1:
+            return matches[0]
+        if matches:
+            logger.warning(
+                "MCP template_name %r is ambiguous in design system %s: it matches "
+                "%d templates (ids %s). Ignoring the pin — the model soft-picks a "
+                "layout instead. Rename the duplicates to make the name unique.",
+                template_name,
+                design_system_id,
+                len(matches),
+                ", ".join(str(template_id) for template_id in sorted(matches)),
+            )
+    except Exception:
+        logger.exception(
+            "Failed to resolve MCP template_name against design system %s",
+            design_system_id,
+        )
+    return None
+
+
 @mcp.tool(
     name="create_deck",
     description=(
@@ -301,7 +401,10 @@ def _request_from_context(ctx: Context) -> Request:
         "appears in their tellr UI. v1 runs prompt-only: the agent does not "
         "invoke Genie, Vector Search, or other tools. Callers that want data-"
         "backed decks should gather the data themselves and include it in the "
-        "prompt."
+        "prompt. The deck uses the org-default design system unless "
+        "design_system_id or slide_style_id says otherwise; pass template_name "
+        "to pin one of that design system's named templates (otherwise the "
+        "model picks the best-matching one)."
     ),
 )
 async def create_deck(
@@ -309,6 +412,8 @@ async def create_deck(
     prompt: str,
     num_slides: Optional[int] = None,
     slide_style_id: Optional[int] = None,
+    design_system_id: Optional[int] = None,
+    template_name: Optional[str] = None,
     deck_prompt_id: Optional[int] = None,
     correlation_id: Optional[str] = None,
 ) -> dict:
@@ -317,6 +422,8 @@ async def create_deck(
         prompt=prompt,
         num_slides=num_slides,
         slide_style_id=slide_style_id,
+        design_system_id=design_system_id,
+        template_name=template_name,
         deck_prompt_id=deck_prompt_id,
         correlation_id=correlation_id,
     )
@@ -327,6 +434,8 @@ async def _create_deck_impl(
     prompt: str,
     num_slides: Optional[int] = None,
     slide_style_id: Optional[int] = None,
+    design_system_id: Optional[int] = None,
+    template_name: Optional[str] = None,
     deck_prompt_id: Optional[int] = None,
     correlation_id: Optional[str] = None,
 ) -> dict:
@@ -352,16 +461,48 @@ async def _create_deck_impl(
     try:
         with mcp_auth_scope(request) as identity:
             agent_config: dict[str, Any] = {"tools": []}
-            # Mirror the browser chat flow: if the caller didn't specify a
-            # style, fall back to the tellr-configured default
-            # (slide_style_library.is_default=True) rather than the
-            # hardcoded DEFAULT_SLIDE_STYLE constant that agent_factory
-            # uses when agent_config.slide_style_id is absent.
-            effective_style_id = slide_style_id
-            if effective_style_id is None:
-                effective_style_id = get_default_slide_style_id()
-            if effective_style_id is not None:
-                agent_config["slide_style_id"] = effective_style_id
+            # Resolve the style SOURCE exactly as the browser chat flow does
+            # (see routes/chat.py::_apply_org_default_style_source): a design
+            # system outranks a slide style, an explicit choice always wins,
+            # and only ONE source is ever seeded so the prompt never carries
+            # two competing style authorities. Before this, MCP decks could not
+            # reach a design system at all — only slide_style_id was ever set,
+            # so they always got the default slide style.
+            effective_ds_id = design_system_id
+            if effective_ds_id is None and slide_style_id is None:
+                effective_ds_id = get_default_design_system_id()
+
+            if effective_ds_id is not None:
+                agent_config["design_system_id"] = effective_ds_id
+                # Templates belong to a design system, so a name is only
+                # meaningful here. Unresolvable -> no pin (logged), and the
+                # model soft-picks from the catalog the compiler injects.
+                if template_name and template_name.strip():
+                    template_id = _resolve_template_name(effective_ds_id, template_name)
+                    if template_id is not None:
+                        agent_config["template_id"] = template_id
+                    else:
+                        logger.warning(
+                            "MCP create_deck: template_name %r matched no template "
+                            "on design system %s; generating without a pin",
+                            template_name,
+                            effective_ds_id,
+                        )
+            else:
+                # No design system in play: fall back to the tellr-configured
+                # default slide style rather than the hardcoded
+                # DEFAULT_SLIDE_STYLE constant agent_factory would otherwise use.
+                effective_style_id = slide_style_id
+                if effective_style_id is None:
+                    effective_style_id = get_default_slide_style_id()
+                if effective_style_id is not None:
+                    agent_config["slide_style_id"] = effective_style_id
+                if template_name and template_name.strip():
+                    logger.warning(
+                        "MCP create_deck: template_name %r ignored — templates "
+                        "require a design system and none is selected",
+                        template_name,
+                    )
             if deck_prompt_id is not None:
                 agent_config["deck_prompt_id"] = deck_prompt_id
             if num_slides is not None:

{databricks_tellr_app-0.4.2.dev7 → databricks_tellr_app-0.4.2.dev8}/src/api/routes/_authz.py

@@ -372,6 +372,42 @@ def require_admin() -> None:
         raise HTTPException(status_code=403, detail="Admin access required")
 
 
+def is_caller_admin() -> bool:
+    """Return the admin verdict for the current caller as a boolean.
+
+    UX-ONLY signal, for hiding admin surfaces the caller cannot use. This is
+    NOT authorization: every admin route keeps ``Depends(require_admin)`` and
+    those 403s remain the real protection. A caller who forges this flag
+    client-side gains nothing but a page whose every request 403s.
+
+    Deliberately implemented by *delegating to* ``require_admin`` and mapping
+    its 403 to ``False`` rather than re-deriving the verdict. The flag then
+    cannot drift from the gate it advertises, and there is exactly one
+    group-lookup, cache and fail-closed policy in the codebase.
+
+    Consequently the non-production bypass is inherited too: in local dev/test
+    this returns ``True`` for everyone, matching the routes that also allow
+    everyone there, so devloop testing of admin surfaces is not obstructed.
+    In production the verdict is real workspace ``admins`` group membership.
+
+    Never raises: unlike the dependency form, a caller asking "am I admin?"
+    must always get an answer, so any unexpected error degrades to ``False``
+    (fail closed) instead of failing the endpoint that embeds it.
+    """
+    try:
+        require_admin()
+        return True
+    except HTTPException:
+        return False
+    except Exception:
+        logger.warning(
+            "is_caller_admin: admin check raised unexpectedly; reporting "
+            "non-admin",
+            exc_info=True,
+        )
+        return False
+
+
 def reset_admin_cache() -> None:
     """Clear the admin-verdict cache (tests)."""
     _ADMIN_CACHE.clear()