databricks-tellr-app 0.4.3.dev11__tar.gz → 0.4.3.dev13__tar.gz

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev11
+Version: 0.4.3.dev13
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev11
+Version: 0.4.3.dev13
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev11"
+version = "0.4.3.dev13"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/main.py

@@ -321,14 +321,12 @@ async def user_auth_middleware(request: Request, call_next):
     user_name = None
 
     if token:
-        # Diagnostic logging: check if token is service principal ID (debug to avoid log spam on every request/poll)
-        token_prefix = token[:20] if len(token) > 20 else token
+        # Diagnostic logging: flag SP-vs-user tokens. F-CR-9 (SDR-4437): never log
+        # any part of the bearer token (no prefix, no length) — only derived booleans.
         is_sp_token = client_id and token.startswith(client_id)
         logger.debug(
             "OBO auth: extracted token from header",
             extra={
-                "token_prefix": token_prefix,
-                "token_length": len(token),
                 "is_service_principal": is_sp_token,
                 "header_present": True,
             },
@@ -491,11 +489,19 @@ logger.info("MCP server mounted at /mcp")
 
 @app.get("/api/health")
 async def health():
-    """Health check endpoint."""
+    """Health check endpoint.
+
+    ``encryption_key_source`` is load-bearing for deployment: ``tellr.update``
+    polls it to confirm a relocated app is reading the secret before it deletes
+    the Lakebase key row. Reports the source only — never the key.
+    """
+    from src.core.encryption import key_source
+
     return {
         "status": "healthy",
         "environment": ENVIRONMENT,
         "version": "0.3.0",
+        "encryption_key_source": key_source(),
     }
 
 

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/middleware/security_headers.py

@@ -31,6 +31,28 @@ Content-Security-Policy differentiated by response type:
   'none', no eval) plus the html_safety.py scanner, and any header at
   all is a strict improvement over the previous no-CSP state.
 
+  SDR-4437 M-CSP — ACCEPTED RESIDUAL (pending SE sign-off). M-CSP asks
+  to move ``script-src`` off ``'unsafe-inline'`` to hashes/nonces. That
+  is infeasible here and was verified:
+    * The SPA's own document has NO inline <script> — index.html loads a
+      single external module (``/src/main.tsx``), already covered by
+      ``'self'``. So the SPA itself does not need 'unsafe-inline'.
+    * The 'unsafe-inline' exists ONLY for the srcdoc slide iframes, whose
+      generated HTML contains arbitrary inline <script> (Chart.js init,
+      etc.) and which inherit THIS document policy in addition to their
+      own SLIDE_CSP meta (both enforce; most restrictive wins).
+    * Per CSP2+, adding any nonce or hash to ``script-src`` makes the
+      browser IGNORE 'unsafe-inline'. A nonce on the parent would
+      therefore disable inline execution for the inherited srcdoc slide
+      scripts and break slide rendering app-wide — you cannot have
+      "nonce + unsafe-inline" both take effect.
+  Removing it would require re-architecting slides away from srcdoc
+  (backend-served ``src`` iframes), which the frame-ancestors / no-src
+  design above deliberately avoids. The residual is bounded: slides stay
+  confined by SLIDE_CSP (an egress boundary) + the html_safety scanner,
+  and the DOCUMENT_CSP ⊇ SLIDE_CSP superset invariant is locked by
+  tests/unit/test_export_csp.py::test_document_csp_header_is_superset_of_slide_csp.
+
 - Everything else (JSON APIs, assets, SSE) gets the deny-all
   ``API_CSP`` — nothing executes in a JSON response.
 

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/chat.py

@@ -384,7 +384,7 @@ async def send_message(
         logger.error(f"Chat request failed: {e}", exc_info=True)
         raise HTTPException(
             status_code=500,
-            detail=f"Failed to process message: {str(e)}",
+            detail="Failed to process message",
         ) from e
     finally:
         await asyncio.to_thread(
@@ -543,18 +543,6 @@ async def send_message_streaming(
     )
 
 
-@router.get("/health")
-async def health_check():
-    """Health check endpoint.
-
-    Returns:
-        Status information
-    """
-    return {
-        "status": "healthy",
-        "service": "AI Slide Generator",
-    }
-
 
 @router.post("/chat/async")
 async def submit_chat_async(
@@ -662,7 +650,7 @@ async def submit_chat_async(
             session_manager.release_session_lock, request.session_id
         )
         logger.error(f"Failed to submit async chat: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get("/chat/poll/{request_id}")

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/export.py

@@ -754,13 +754,13 @@ async def export_to_pptx(request: ExportPPTXRequest):
                     temp_dir.rmdir()
             except Exception:
                 pass
-            raise HTTPException(status_code=500, detail=f"Export failed: {str(e)}")
+            raise HTTPException(status_code=500, detail="Export failed")
         
     except HTTPException:
         raise
     except Exception as e:
         logger.error("PPTX export failed", exc_info=True, extra={"error": str(e)})
-        raise HTTPException(status_code=500, detail=f"Export failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="Export failed")
 
 
 # =============================================================================
@@ -893,7 +893,7 @@ async def start_pptx_export_async(request: ExportPPTXRequest):
     except Exception as e:
         total_time = time.time() - start_time
         logger.error(f"Failed to start async export after {total_time:.2f}s: {e}", exc_info=True)
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Failed to start export")
 
 
 @router.get("/pptx/poll/{job_id}", response_model=ExportJobResponse)
@@ -1038,7 +1038,7 @@ async def export_pptx_editable_from_records(request: ExportPPTXFromRecordsReques
         pptx_bytes = build_pptx(title, request.slides, font_mode=font_mode)
     except Exception as e:
         logger.exception(f"Editable PPTX emission failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Editable PPTX export failed")
 
     safe = "".join(c if c.isalnum() or c in "-_" else "_" for c in title).strip("_") or "slides"
     from fastapi.responses import Response

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/google_slides.py

@@ -10,9 +10,10 @@ user tokens are stored per-user in the ``google_oauth_tokens`` table.
 import json
 import logging
 import os
+import secrets
 from typing import Any, Optional
 
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, Response
 from fastapi.responses import HTMLResponse
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
@@ -33,6 +34,12 @@ logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/api/export/google-slides", tags=["google-slides"])
 
+# F-CR-3 (SDR-4437): the OAuth "state" carries an unguessable nonce that is also
+# stored in this short-lived cookie; the callback requires them to match before
+# exchanging the authorization code (anti-CSRF / anti-login-CSRF double-submit).
+_OAUTH_STATE_COOKIE = "g_oauth_state"
+_OAUTH_COOKIE_PATH = "/api/export/google-slides"
+
 
 # -------------------------------------------------------------------------
 # Helpers
@@ -98,32 +105,76 @@ class AuthUrlResponse(BaseModel):
 # -------------------------------------------------------------------------
 
 
-def _build_redirect_uri(request: Request) -> str:
-    """Build the OAuth callback redirect URI from the current request.
-
-    Google requires redirect URIs to match *exactly* what's registered in GCP,
-    with no query parameters.
+def _build_app_origin(request: Request) -> str:
+    """Return the public origin (``scheme://host``) serving the app.
 
     Behind a reverse proxy (e.g. Databricks Apps), ``request.base_url``
     returns the internal address (``http://localhost:8000``).  We use the
     ``X-Forwarded-Host`` / ``X-Forwarded-Proto`` headers set by the proxy
-    to reconstruct the public URL instead.
-
-    For localhost, Google only allows ``http``.
+    to reconstruct the public URL instead. For localhost, force ``http``.
     """
     forwarded_host = request.headers.get("x-forwarded-host")
     forwarded_proto = request.headers.get("x-forwarded-proto")
 
     if forwarded_host:
         scheme = forwarded_proto or "https"
-        base = f"{scheme}://{forwarded_host.split(',')[0].strip()}"
-    else:
-        base = str(request.base_url).rstrip("/")
-        # Force http for localhost (Google rejects https://localhost)
-        if "://localhost" in base or "://127.0.0.1" in base:
-            base = base.replace("https://", "http://")
+        return f"{scheme}://{forwarded_host.split(',')[0].strip()}"
+
+    base = str(request.base_url).rstrip("/")
+    if "://localhost" in base or "://127.0.0.1" in base:
+        base = base.replace("https://", "http://")
+    return base
+
+
+def _build_redirect_uri(request: Request) -> str:
+    """Build the OAuth callback redirect URI from the current request.
+
+    Google requires redirect URIs to match *exactly* what's registered in GCP,
+    with no query parameters.
+    """
+    return f"{_build_app_origin(request)}/api/export/google-slides/auth/callback"
+
+
+# Callback page template. The JS object braces are intentionally literal; the
+# %TOKENS% are substituted below so the postMessage targets the explicit app
+# origin (F-CR-3) instead of the wildcard '*'.
+_CALLBACK_TEMPLATE = """
+<html><body>
+    <h2>%TITLE%</h2>
+    <p>%MESSAGE%</p>
+    <script>
+        if (window.opener) {
+            window.opener.postMessage({ type: 'google-slides-auth', success: %SUCCESS% }, %ORIGIN%);
+        }
+        setTimeout(() => window.close(), %DELAY%);
+    </script>
+</body></html>
+"""
 
-    return f"{base}/api/export/google-slides/auth/callback"
+
+def _callback_response(app_origin: str, *, success: bool) -> HTMLResponse:
+    """Render the popup callback page and clear the anti-CSRF state cookie.
+
+    ``postMessage`` targets ``app_origin`` explicitly (F-CR-3); ``json.dumps``
+    yields a safely-quoted JS string literal for the origin.
+    """
+    if success:
+        title, message, delay = "Authorization Successful", "You can close this window.", "1500"
+    else:
+        title = "Authorization Failed"
+        message = "Authorization could not be completed. Please close this window and try again."
+        delay = "3000"
+    body = (
+        _CALLBACK_TEMPLATE
+        .replace("%TITLE%", title)
+        .replace("%MESSAGE%", message)
+        .replace("%SUCCESS%", "true" if success else "false")
+        .replace("%ORIGIN%", json.dumps(app_origin))
+        .replace("%DELAY%", delay)
+    )
+    resp = HTMLResponse(content=body, status_code=200)
+    resp.delete_cookie(_OAUTH_STATE_COOKIE, path=_OAUTH_COOKIE_PATH)
+    return resp
 
 
 @router.get("/auth/status", response_model=AuthStatusResponse)
@@ -141,6 +192,7 @@ async def auth_status(db: Session = Depends(get_db)):
 @router.get("/auth/url", response_model=AuthUrlResponse)
 async def auth_url(
     request: Request,
+    response: Response,
     db: Session = Depends(get_db),
 ):
     """Generate the Google OAuth consent URL.
@@ -149,13 +201,26 @@ async def auth_url(
     passed via the OAuth ``state`` parameter so the callback can persist the
     token for the correct user — the redirect URI itself stays clean
     (no query params) to satisfy Google's exact-match requirement.
+
+    F-CR-3: an unguessable nonce is bound into both the ``state`` and a
+    short-lived cookie; the callback requires them to match.
     """
     try:
         auth = _get_auth(db)
         redirect_uri = _build_redirect_uri(request)
-        state = json.dumps({"user": _get_user_identity()})
+        nonce = secrets.token_urlsafe(32)
+        state = json.dumps({"user": _get_user_identity(), "nonce": nonce})
         url = auth.get_auth_url(redirect_uri=redirect_uri, state=state)
 
+        response.set_cookie(
+            key=_OAUTH_STATE_COOKIE,
+            value=nonce,
+            max_age=600,
+            httponly=True,
+            secure=True,
+            samesite="lax",  # sent on Google's top-level redirect back to us
+            path=_OAUTH_COOKIE_PATH,
+        )
         return AuthUrlResponse(url=url)
     except GoogleSlidesAuthError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
@@ -184,12 +249,22 @@ async def auth_callback(
     them in the ``google_oauth_tokens`` table.  Returns a small HTML page
     that notifies the opener window and closes itself.
     """
+    app_origin = _build_app_origin(request)
+    cookie_nonce = request.cookies.get(_OAUTH_STATE_COOKIE)
     try:
         state_data = json.loads(state) if state else {}
         user = state_data.get("user")
         if not user:
             raise ValueError("Missing user in OAuth state")
 
+        # F-CR-3: verify the anti-CSRF nonce BEFORE exchanging the code. The
+        # state nonce must match the cookie set when the auth URL was issued.
+        state_nonce = state_data.get("nonce")
+        if not cookie_nonce or not state_nonce or not secrets.compare_digest(
+            str(cookie_nonce), str(state_nonce)
+        ):
+            raise ValueError("OAuth state nonce mismatch")
+
         auth = _get_auth(db)
         redirect_uri = _build_redirect_uri(request)
         code_verifier = state_data.get("code_verifier")
@@ -198,39 +273,13 @@ async def auth_callback(
             "Google Slides OAuth callback successful",
             extra={"user": _get_user_identity()},
         )
-    except Exception as exc:
+    except Exception:
+        # F-CR-2 (SDR-4437): never reflect the raw exception into the HTML page —
+        # it is logged server-side above. Show a static, generic failure message.
         logger.error("OAuth callback failed", exc_info=True)
-        return HTMLResponse(
-            content=f"""
-            <html><body>
-                <h2>Authorization Failed</h2>
-                <p>{exc}</p>
-                <script>
-                    if (window.opener) {{
-                        window.opener.postMessage({{ type: 'google-slides-auth', success: false }}, '*');
-                    }}
-                    setTimeout(() => window.close(), 3000);
-                </script>
-            </body></html>
-            """,
-            status_code=200,
-        )
+        return _callback_response(app_origin, success=False)
 
-    return HTMLResponse(
-        content="""
-        <html><body>
-            <h2>Authorization Successful</h2>
-            <p>You can close this window.</p>
-            <script>
-                if (window.opener) {
-                    window.opener.postMessage({ type: 'google-slides-auth', success: true }, '*');
-                }
-                setTimeout(() => window.close(), 1500);
-            </script>
-        </body></html>
-        """,
-        status_code=200,
-    )
+    return _callback_response(app_origin, success=True)
 
 
 # -------------------------------------------------------------------------
@@ -284,7 +333,7 @@ async def start_google_slides_export(
         slide_deck = chat_service.get_slides(request_body.session_id)
     except Exception as exc:
         logger.error("Failed to fetch slides", exc_info=True)
-        raise HTTPException(status_code=500, detail=f"Failed to fetch slides: {exc}") from exc
+        raise HTTPException(status_code=500, detail="Failed to fetch slides") from exc
 
     if not slide_deck or not slide_deck.get("slides"):
         raise HTTPException(status_code=404, detail="No slides available")
@@ -448,7 +497,7 @@ async def export_google_slides_from_records(
             )
     except Exception as exc:
         logger.error("Drive upload failed", exc_info=True)
-        raise HTTPException(status_code=502, detail=f"Drive upload failed: {exc}") from exc
+        raise HTTPException(status_code=502, detail="Drive upload failed") from exc
 
     session_manager.set_google_slides_info(
         session_id=request.session_id,
@@ -598,7 +647,7 @@ async def export_google_slides_from_huashu(
         logger.error("Drive upload failed (huashu path)", exc_info=True)
         raise HTTPException(
             status_code=502,
-            detail=f"Drive upload failed: {exc}",
+            detail="Drive upload failed",
         ) from exc
 
     session_manager.set_google_slides_info(

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/sessions.py

@@ -9,10 +9,7 @@ Session access is controlled by:
 """
 
 import asyncio
-import json
 import logging
-from datetime import datetime
-from pathlib import Path
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -553,7 +550,7 @@ async def duplicate_session(
         logger.error(f"Failed to duplicate session: {e}", exc_info=True)
         raise HTTPException(
             status_code=500,
-            detail=f"Failed to duplicate session: {str(e)}",
+            detail="Failed to duplicate session",
         ) from e
 
 
@@ -769,86 +766,9 @@ async def cleanup_expired_sessions():
         ) from e
 
 
-@router.post("/{session_id}/export")
-async def export_session(session_id: str):
-    """Export full session data to logs/sessions/{session_id}.json for debugging.
-    
-    Exports:
-    - Session info (id, timestamps, profile)
-    - All chat messages (user + AI responses with full content)
-    - Full slide deck (HTML, scripts, slide count)
-    
-    Args:
-        session_id: Session to export
-        
-    Returns:
-        Export confirmation with file path
-    """
-    try:
-        # Permission check: require CAN_VIEW on the deck
-        await asyncio.to_thread(
-            _check_deck_permission_for_session, session_id, PermissionLevel.CAN_VIEW
-        )
-
-        session_manager = get_session_manager()
-
-        # Get all session data
-        session = await asyncio.to_thread(session_manager.get_session, session_id)
-        messages = await asyncio.to_thread(session_manager.get_messages, session_id)
-        slide_deck = await asyncio.to_thread(session_manager.get_slide_deck, session_id)
-        
-        # Build export data
-        export_data = {
-            "exported_at": datetime.utcnow().isoformat(),
-            "session": session,
-            "messages": messages,
-            "slide_deck": slide_deck,
-            "summary": {
-                "message_count": len(messages),
-                "slide_count": slide_deck.get("slide_count", 0) if slide_deck else 0,
-                "user_messages": sum(1 for m in messages if m.get("role") == "user"),
-                "ai_messages": sum(1 for m in messages if m.get("role") == "assistant"),
-            }
-        }
-        
-        # Ensure logs/sessions directory exists
-        sessions_dir = Path("logs/sessions")
-        sessions_dir.mkdir(parents=True, exist_ok=True)
-        
-        # Write to file
-        export_path = sessions_dir / f"{session_id}.json"
-        with open(export_path, "w", encoding="utf-8") as f:
-            json.dump(export_data, f, indent=2, default=str)
-        
-        logger.info(
-            "Session exported",
-            extra={
-                "session_id": session_id,
-                "export_path": str(export_path),
-                "message_count": len(messages),
-            },
-        )
-        
-        return {
-            "status": "exported",
-            "session_id": session_id,
-            "export_path": str(export_path),
-            "summary": export_data["summary"],
-        }
-        
-    except SessionNotFoundError:
-        raise HTTPException(
-            status_code=404,
-            detail=f"Session not found: {session_id}",
-        )
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.error(f"Failed to export session: {e}", exc_info=True)
-        raise HTTPException(
-            status_code=500,
-            detail="Export failed",
-        ) from e
+# F-CR-10 (SDR-4437): the debug-only POST /{session_id}/export endpoint was
+# removed — it was unused by the frontend and dumped full session data (all chat
+# messages + deck) to logs/sessions/{id}.json.
 
 
 # =========================================================================

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/settings/identities.py

@@ -109,7 +109,7 @@ def list_users(
         logger.error(f"Failed to list users: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to list users: {e}",
+            detail="Failed to list users",
         )
 
 
@@ -149,7 +149,7 @@ def list_groups(
         logger.error(f"Failed to list groups: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to list groups: {e}",
+            detail="Failed to list groups",
         )
 
 
@@ -203,5 +203,5 @@ def search_identities(
         logger.error(f"Failed to search identities: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to search identities: {e}",
+            detail="Failed to search identities",
         )

{databricks_tellr_app-0.4.3.dev11 → databricks_tellr_app-0.4.3.dev13}/src/api/routes/setup.py

@@ -123,7 +123,7 @@ async def configure_workspace(request: ConfigureWorkspaceRequest):
         logger.error(f"Failed to configure workspace: {e}")
         raise HTTPException(
             status_code=500,
-            detail=f"Failed to save configuration: {str(e)}"
+            detail="Failed to save configuration"
         )
 
 
@@ -154,5 +154,5 @@ async def test_connection():
         logger.error(f"Connection test failed: {e}")
         raise HTTPException(
             status_code=400,
-            detail=f"Connection failed: {str(e)}"
+            detail="Connection failed"
         )