databricks-tellr-app 0.4.3.dev15__tar.gz → 0.4.3.dev16__tar.gz

{databricks_tellr_app-0.4.3.dev15 → databricks_tellr_app-0.4.3.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev15
+Version: 0.4.3.dev16
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev15 → databricks_tellr_app-0.4.3.dev16}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev15
+Version: 0.4.3.dev16
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev15 → databricks_tellr_app-0.4.3.dev16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev15"
+version = "0.4.3.dev16"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev15 → databricks_tellr_app-0.4.3.dev16}/src/api/routes/sessions.py

@@ -743,28 +743,11 @@ async def get_session_slides(session_id: str):
         ) from e
 
 
-@router.post("/cleanup")
-async def cleanup_expired_sessions():
-    """Clean up expired sessions.
-
-    Returns:
-        Number of sessions deleted
-    """
-    try:
-        session_manager = get_session_manager()
-        count = await asyncio.to_thread(session_manager.cleanup_expired_sessions)
-
-        logger.info("Session cleanup completed", extra={"deleted_count": count})
-
-        return {"status": "completed", "deleted_count": count}
-
-    except Exception as e:
-        logger.error(f"Failed to cleanup sessions: {e}", exc_info=True)
-        raise HTTPException(
-            status_code=500,
-            detail="Cleanup failed",
-        ) from e
-
+# F-CR-16 (SDR-4437): the POST /cleanup endpoint was removed — it had no
+# authorization check and allowed any authenticated CAN_USE user to delete all
+# sessions older than 24h (cascading to decks, chat history, etc.). The endpoint
+# was unused (no frontend caller, no scheduler, no script), so removal was safer
+# than gating. See SDR-4437 for details.
 
 # F-CR-10 (SDR-4437): the debug-only POST /{session_id}/export endpoint was
 # removed — it was unused by the frontend and dumped full session data (all chat

{databricks_tellr_app-0.4.3.dev15 → databricks_tellr_app-0.4.3.dev16}/src/api/services/session_manager.py

@@ -2073,41 +2073,6 @@ class SessionManager:
 
             return count
 
-    # Cleanup operations
-    def cleanup_expired_sessions(self) -> int:
-        """Delete sessions that have exceeded TTL.
-
-        WARNING: user_sessions is the app's durable usage history. This
-        method is intentionally NOT scheduled anywhere — it is only
-        reachable via the manual POST /api/sessions/cleanup endpoint.
-        Do not wire it to a scheduler; doing so would destroy the
-        history that the /admin usage dashboard's pre-event-log
-        aggregations rely on.
-
-        Returns:
-            Number of sessions deleted
-        """
-        cutoff = datetime.utcnow() - timedelta(hours=self.session_ttl_hours)
-
-        with get_db_session() as db:
-            expired = (
-                db.query(UserSession)
-                .filter(UserSession.last_activity < cutoff)
-                .all()
-            )
-
-            count = len(expired)
-            for session in expired:
-                db.delete(session)
-
-            if count > 0:
-                logger.info(
-                    "Cleaned up expired sessions",
-                    extra={"count": count, "cutoff": cutoff.isoformat()},
-                )
-
-            return count
-
     def _get_session_or_raise(self, db: Session, session_id: str) -> UserSession:
         """Get session by ID or raise error.