databricks-tellr-app 0.4.2.dev8__tar.gz → 0.4.2.dev9__tar.gz

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev8
+Version: 0.4.2.dev9
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.2.dev8
+Version: 0.4.2.dev9
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.2.dev8"
+version = "0.4.2.dev9"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/src/api/mcp_server.py

@@ -586,10 +586,30 @@ def _render_deck_response(
         base_url: Public app URL prefix for building deck URLs. Empty
             string yields relative URLs.
 
-    ``SlideDeck.from_dict`` rebuilds the deck from the stored snapshot,
+    Image and design-system asset placeholders are substituted at this shared
+    response boundary so both MCP deck-returning tools emit standalone data
+    without expanding the persisted snapshot. Design-system assets are scoped
+    to the session's active design system and fail closed when it has none.
+
+    ``SlideDeck.from_dict`` rebuilds the deck from the substituted snapshot,
     including per-slide scripts/metadata and head metadata.
     """
     deck_dict = deck_dict or {}
+    session_id = session["session_id"]
+
+    from src.api.services.chat_service import resolve_active_design_system_id
+    from src.utils.ds_asset_utils import substitute_deck_dict_ds_assets
+    from src.utils.image_utils import substitute_deck_dict_images
+
+    design_system_id = resolve_active_design_system_id(session_id)
+    with get_db_session() as db:
+        substitute_deck_dict_images(deck_dict, db)
+        substitute_deck_dict_ds_assets(
+            deck_dict,
+            db,
+            design_system_id=design_system_id,
+        )
+
     if deck_dict:
         deck = SlideDeck.from_dict(
             deck_dict,
@@ -598,7 +618,6 @@ def _render_deck_response(
     else:
         deck = SlideDeck(title=session.get("title"))
 
-    session_id = session["session_id"]
     deck_url = (
         f"{base_url}/sessions/{session_id}/edit"
         if base_url

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/src/api/routes/settings/design_systems.py

@@ -8,10 +8,16 @@ the drop-in equivalent of ``slide_style_library.style_content`` — so it flows
 through the existing generation seam (see ``agent_factory._get_prompt_content``).
 
 Name uniqueness: creation/import return **409 Conflict** on a duplicate name
-(``design_system.name`` is unique, spec §6), matching the slide-styles
-convention. This is deliberately non-destructive — an org-shared asset is never
-silently overwritten; the caller supplies a different name (import accepts a
-``name`` form field) to import a copy.
+(spec §6), matching the slide-styles convention. This is deliberately
+non-destructive — an org-shared asset is never silently overwritten; the caller
+supplies a different name (import accepts a ``name`` form field) to import a copy.
+
+Uniqueness is scoped to **LIVE** rows, at both layers: the pre-checks here filter
+``is_active``, and the database enforces the partial unique index
+``uq_design_system_name_active`` (``WHERE is_active``). A whole-table rule made the
+soft DELETE below reserve the name FOREVER — the tombstone is hidden from the list
+endpoint, so a user who deleted a design system could never re-import under the same
+name and had nothing left to delete. A name held only by a tombstone is free.
 """
 import logging
 import os
@@ -548,7 +554,14 @@ def create_design_system(
 ):
     """Create a design system from structured input (assets arrive via /import)."""
     try:
-        existing = db.query(DesignSystem).filter(DesignSystem.name == request.name).first()
+        # LIVE rows only, matching the partial unique index
+        # ``uq_design_system_name_active``. A soft-deleted system's name is free to
+        # reuse — see the DesignSystem model's note on the name column.
+        existing = (
+            db.query(DesignSystem)
+            .filter(DesignSystem.name == request.name, DesignSystem.is_active == True)  # noqa: E712
+            .first()
+        )
         if existing:
             raise HTTPException(
                 status_code=status.HTTP_409_CONFLICT,
@@ -638,9 +651,16 @@ def update_design_system(
         _require_creator_or_admin(ds)
 
         if request.name and request.name != ds.name:
+            # LIVE rows only, matching the partial unique index
+            # ``uq_design_system_name_active`` — the same reason as create/import: a
+            # tombstone must not reserve a name the picker no longer shows.
             clash = (
                 db.query(DesignSystem)
-                .filter(DesignSystem.name == request.name, DesignSystem.id != ds_id)
+                .filter(
+                    DesignSystem.name == request.name,
+                    DesignSystem.id != ds_id,
+                    DesignSystem.is_active == True,  # noqa: E712
+                )
                 .first()
             )
             if clash:

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/src/core/database.py

@@ -549,7 +549,15 @@ def _run_migrations(engine, schema: str | None = None):
         # deleted, so a reader of this list can see what happened to them.
         _migrate_uncap_brand_text_columns(conn, inspector, schema, _qual, is_sqlite)
 
+        # --- design system: name uniqueness scoped to LIVE rows, so a soft delete
+        # --- stops reserving the name forever (partial unique index) ---
+        _migrate_design_system_partial_name_index(
+            conn, inspector, schema, _qual, is_sqlite
+        )
+
         # --- keep newly created objects owned by the shared role (prod forks) ---
+        # Runs LAST so every object created above — including the partial name index
+        # — is re-homed onto the shared owner.
         _reassign_new_objects_to_shared_owner(conn, is_sqlite)
 
 
@@ -763,7 +771,9 @@ def _migrate_uncap_brand_text_columns(
       ``VARCHAR(n)`` is a no-rewrite change — ``text`` and ``varchar`` share a
       storage representation, so Postgres only updates the catalog. Existing values
       are preserved exactly; ``text`` has no length limit to violate.
-      ``design_system.name`` carries a UNIQUE constraint, which is unaffected: a
+      ``design_system.name`` is covered by a unique index — the PARTIAL
+      ``uq_design_system_name_active``, see
+      :func:`_migrate_design_system_partial_name_index` — which is unaffected: a
       unique btree index over ``text`` is normal, bounded only by the ~2704-byte
       index-tuple maximum that a design-system name does not approach. If one ever
       did, the INSERT would fail loudly rather than truncate — so no prefix or
@@ -832,6 +842,148 @@ def _migrate_uncap_brand_text_columns(
             )
 
 
+#: Name of the partial unique index that scopes design-system name uniqueness to
+#: LIVE rows. Must match the ``Index(...)`` declared in
+#: ``src/database/models/design_system.py`` — ``create_all`` builds it under this
+#: name on fresh installs and this migration builds it under the same name on
+#: already-provisioned ones, so the two paths converge on one schema.
+_DS_NAME_ACTIVE_INDEX = "uq_design_system_name_active"
+
+
+def _migrate_design_system_partial_name_index(
+    conn, inspector, schema, _qual, is_sqlite
+) -> None:
+    """Scope ``design_system.name`` uniqueness to LIVE rows (idempotent).
+
+    ``design_system.name`` originally carried a whole-table UNIQUE constraint. That
+    made the soft delete leak the name PERMANENTLY: ``DELETE`` tombstones the row
+    (``is_active = False``), the list endpoint hides it, and the tombstone then held
+    its name against every subsequent import — a name the user could no longer see,
+    delete, or reuse. The reported symptom was an unfixable
+    "A design system named 'X' already exists (id=N)" on re-importing a corrected
+    bundle under the name the user had just deleted.
+
+    Filtering only the application-side name pre-checks would NOT have fixed it: it
+    converts the clean 409 into an ``IntegrityError`` at commit, i.e. an HTTP 500 on
+    a legitimate upload. The uniqueness RULE itself is what was wrong, so this
+    replaces the whole-table constraint with a PARTIAL unique index over
+    ``WHERE is_active``. Tombstones are then unconstrained — many may share one name,
+    which is what lets a delete/re-import cycle repeat indefinitely instead of
+    working exactly once — while two LIVE rows still cannot.
+
+    Ordering is deliberate: the replacement index is CREATED FIRST and the old
+    constraint is dropped ONLY IF that succeeded. The database is therefore never
+    left with no uniqueness enforcement at all — including on a database where the
+    constraint was already dropped but duplicate live names somehow exist, in which
+    case the CREATE fails, the DROP is skipped, and the existing constraint stays.
+
+    Idempotent: returns early once the partial index is present, so repeat startups
+    and a fresh ``create_all`` database (where the ORM already declares the index)
+    are both no-ops. Each statement runs in its OWN SAVEPOINT so a failure — e.g.
+    insufficient privileges on a locked-down deploy, or an inherited foreign-owned
+    table on a copy-on-write branch fork — cannot poison the outer migration
+    transaction.
+
+    Discovery, not assumption: the old constraint's name is REFLECTED rather than
+    hardcoded to Postgres's ``design_system_name_key`` default, and both shapes are
+    handled — a UNIQUE *constraint* (what a column-level ``unique=True`` emits, and
+    what needs ``DROP CONSTRAINT``) and a bare unique *index* (which needs
+    ``DROP INDEX``).
+
+    No-op on SQLite. It is not a deployment target (``_get_database_url`` only ever
+    returns PostgreSQL unless ``DATABASE_URL`` is set explicitly), and the tests
+    build their schema with ``create_all``, which emits the partial index directly —
+    SQLite has supported partial indexes since 3.8, so the unit suite exercises the
+    SAME rule as Lakebase. An explicitly-configured pre-existing SQLite file would
+    keep its inline table-level UNIQUE, which SQLite cannot drop without rebuilding
+    the table; rebuilding a table of brand blobs is not worth doing for a
+    configuration nothing deploys, so it is left alone rather than silently rewritten.
+    """
+    from sqlalchemy import inspect, text
+
+    if is_sqlite:
+        return
+
+    # Reflect LIVE, with a fresh inspector: the shared one caches its reflection
+    # from before the design_system table may have been created earlier in this same
+    # migration transaction.
+    try:
+        insp = inspect(conn)
+        indexes = insp.get_indexes("design_system", schema=schema)
+        unique_constraints = insp.get_unique_constraints("design_system", schema=schema)
+    except Exception:
+        return  # table absent on this deploy
+
+    if any(ix.get("name") == _DS_NAME_ACTIVE_INDEX for ix in indexes):
+        return  # already scoped
+
+    logger.info(
+        "Migration: scoping design_system.name uniqueness to active rows (%s)",
+        _DS_NAME_ACTIVE_INDEX,
+    )
+    try:
+        with conn.begin_nested():
+            conn.execute(text(
+                f"CREATE UNIQUE INDEX {_DS_NAME_ACTIVE_INDEX} "
+                f'ON {_qual("design_system")} (name) WHERE is_active'
+            ))
+    except Exception:
+        logger.warning(
+            "Migration: could not create %s; design_system.name keeps its existing "
+            "whole-table uniqueness and a soft-deleted name stays reserved",
+            _DS_NAME_ACTIVE_INDEX,
+            exc_info=True,
+        )
+        return
+
+    # Only now is it safe to remove the whole-table rule the new index replaces.
+    # A column-level ``unique=True`` emits a UNIQUE CONSTRAINT; some databases may
+    # instead carry a bare unique index. Drop whichever is actually there, and only
+    # when it covers exactly ``(name)`` — a composite unique over more columns is a
+    # different rule this migration has no business removing.
+    for constraint in unique_constraints:
+        if list(constraint.get("column_names") or []) != ["name"]:
+            continue
+        name = constraint.get("name")
+        if not name:
+            continue
+        try:
+            with conn.begin_nested():
+                conn.execute(text(
+                    f'ALTER TABLE {_qual("design_system")} DROP CONSTRAINT "{name}"'
+                ))
+            logger.info("Migration: dropped whole-table unique constraint %s", name)
+        except Exception:
+            logger.warning(
+                "Migration: could not drop unique constraint %s; a soft-deleted "
+                "design-system name stays reserved until it is removed",
+                name,
+                exc_info=True,
+            )
+
+    constraint_names = {c.get("name") for c in unique_constraints}
+    for index in indexes:
+        if not index.get("unique") or list(index.get("column_names") or []) != ["name"]:
+            continue
+        name = index.get("name")
+        # A constraint-backing index is dropped with its constraint above; issuing
+        # DROP INDEX for it would fail.
+        if not name or name in constraint_names:
+            continue
+        try:
+            with conn.begin_nested():
+                qualified = f'"{schema}"."{name}"' if schema else f'"{name}"'
+                conn.execute(text(f"DROP INDEX {qualified}"))
+            logger.info("Migration: dropped whole-table unique index %s", name)
+        except Exception:
+            logger.warning(
+                "Migration: could not drop unique index %s; a soft-deleted "
+                "design-system name stays reserved until it is removed",
+                name,
+                exc_info=True,
+            )
+
+
 def _reassign_new_objects_to_shared_owner(
     conn, is_sqlite: bool, owning_role: str = "tellr_app_owners"
 ) -> None:

{databricks_tellr_app-0.4.2.dev8 → databricks_tellr_app-0.4.2.dev9}/src/database/models/design_system.py

@@ -69,6 +69,7 @@ from sqlalchemy import (
     Column,
     DateTime,
     ForeignKey,
+    Index,
     Integer,
     LargeBinary,
     String,
@@ -124,14 +125,19 @@ class DesignSystem(Base):
     # here silently TRUNCATED an imported name to 255 characters, storing the brand
     # under a name it never chose.
     #
-    # ``unique`` is RETAINED on the now-unbounded column. On PostgreSQL/Lakebase a
-    # UNIQUE constraint on ``text`` is a normal btree index; the only limit is the
-    # ~2704-byte per-entry index-tuple maximum, which a design-system NAME does not
-    # approach in practice. If a name ever did, the insert would fail loudly with an
-    # index-row-size error rather than corrupt or truncate anything — so no prefix /
-    # expression index is needed, and none is used. Uniqueness is a real product
-    # rule (the picker addresses systems by name), so it is not dropped.
-    name = Column(Text, nullable=False, unique=True)
+    # Uniqueness is enforced, but only over LIVE rows, by the partial unique index
+    # ``uq_design_system_name_active`` declared below — NOT by a column-level
+    # ``unique=True``. A whole-table UNIQUE constraint made a soft delete leak the
+    # name permanently: DELETE tombstones the row (``is_active = False``), the list
+    # endpoint hides it, and the tombstone then held its name against every later
+    # import — a name the user could no longer see, delete, or reuse. Scoping the
+    # index to ``WHERE is_active`` is what makes the tombstone stop owning the name,
+    # and it is the DATABASE half of the fix: the application pre-checks in
+    # ``design_system_service.import_bundle`` and the create/rename routes filter
+    # ``is_active`` to fail fast with a 409, but this index is what actually decides.
+    # Both halves must move together — filtering the pre-checks alone converts the
+    # clean 409 into an IntegrityError 500 at commit.
+    name = Column(Text, nullable=False)
     description = Column(Text, nullable=True)
 
     # Authorship + org-default flags (org-shared visibility; no per-user isolation)
@@ -195,6 +201,38 @@ class DesignSystem(Base):
         passive_deletes=True,
     )
 
+    # Name uniqueness scoped to LIVE rows. See the ``name`` column note for why a
+    # whole-table UNIQUE constraint was wrong.
+    #
+    # Deliberately a partial unique INDEX rather than a UNIQUE constraint: Postgres
+    # has no partial unique constraints, only partial unique indexes, and a
+    # column-level ``unique=True`` would emit exactly the whole-table constraint this
+    # replaces. Declared here so ``create_all`` builds it on fresh installs;
+    # ``_migrate_design_system_partial_name_index`` converts already-provisioned
+    # databases.
+    #
+    # ``WHERE is_active`` means MANY tombstones may share one name — intended, so a
+    # delete/re-import cycle can repeat indefinitely rather than working exactly once.
+    #
+    # Emitted identically on both dialects (verified): SQLite has supported partial
+    # indexes since 3.8, so the SQLite used in tests enforces the SAME rule as
+    # PostgreSQL/Lakebase and the behaviour is actually covered by the unit suite —
+    # it would not be under a ``postgresql_where``-only declaration. On
+    # PostgreSQL/Lakebase this is a unique btree index over ``text``, bounded only by
+    # the ~2704-byte index-tuple maximum a design-system name does not approach; an
+    # over-long name still fails loudly and is still translated by
+    # ``translate_name_index_limit_error``, so the uncapped-brand-text guarantee is
+    # unchanged.
+    __table_args__ = (
+        Index(
+            "uq_design_system_name_active",
+            "name",
+            unique=True,
+            postgresql_where=text("is_active"),
+            sqlite_where=text("is_active"),
+        ),
+    )
+
     def __repr__(self):
         return (
             f"<DesignSystem(id={self.id}, name='{self.name}', "