databricks-tellr-app 0.4.3.dev1__tar.gz → 0.4.3.dev2__tar.gz

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev1
+Version: 0.4.3.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev1
+Version: 0.4.3.dev2
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev1"
+version = "0.4.3.dev2"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/api/middleware/security_headers.py

@@ -31,6 +31,28 @@ Content-Security-Policy differentiated by response type:
   'none', no eval) plus the html_safety.py scanner, and any header at
   all is a strict improvement over the previous no-CSP state.
 
+  SDR-4437 M-CSP — ACCEPTED RESIDUAL (pending SE sign-off). M-CSP asks
+  to move ``script-src`` off ``'unsafe-inline'`` to hashes/nonces. That
+  is infeasible here and was verified:
+    * The SPA's own document has NO inline <script> — index.html loads a
+      single external module (``/src/main.tsx``), already covered by
+      ``'self'``. So the SPA itself does not need 'unsafe-inline'.
+    * The 'unsafe-inline' exists ONLY for the srcdoc slide iframes, whose
+      generated HTML contains arbitrary inline <script> (Chart.js init,
+      etc.) and which inherit THIS document policy in addition to their
+      own SLIDE_CSP meta (both enforce; most restrictive wins).
+    * Per CSP2+, adding any nonce or hash to ``script-src`` makes the
+      browser IGNORE 'unsafe-inline'. A nonce on the parent would
+      therefore disable inline execution for the inherited srcdoc slide
+      scripts and break slide rendering app-wide — you cannot have
+      "nonce + unsafe-inline" both take effect.
+  Removing it would require re-architecting slides away from srcdoc
+  (backend-served ``src`` iframes), which the frame-ancestors / no-src
+  design above deliberately avoids. The residual is bounded: slides stay
+  confined by SLIDE_CSP (an egress boundary) + the html_safety scanner,
+  and the DOCUMENT_CSP ⊇ SLIDE_CSP superset invariant is locked by
+  tests/unit/test_export_csp.py::test_document_csp_header_is_superset_of_slide_csp.
+
 - Everything else (JSON APIs, assets, SSE) gets the deny-all
   ``API_CSP`` — nothing executes in a JSON response.
 

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/api/routes/images.py

@@ -1,5 +1,4 @@
 """Image upload and management API endpoints."""
-import base64
 import logging
 import os
 from typing import List, Optional
@@ -21,7 +20,7 @@ router = APIRouter(prefix="/api/images", tags=["images"])
 
 class ImageResponse(BaseModel):
     """Response schema for image metadata."""
-    id: str  # Opaque token (SDR-4437 F-TM-7) — the internal int PK is never exposed.
+    id: int
     filename: str
     original_filename: str
     mime_type: str
@@ -47,7 +46,7 @@ class ImageListResponse(BaseModel):
 
 class ImageDataResponse(BaseModel):
     """Response containing image base64 data."""
-    id: str  # Opaque token (SDR-4437 F-TM-7).
+    id: int
     mime_type: str
     base64_data: str
     data_uri: str  # Ready-to-use: "data:image/png;base64,..."
@@ -81,7 +80,7 @@ def _get_current_user() -> str:
 
 def _image_to_response(img: ImageAsset) -> ImageResponse:
     return ImageResponse(
-        id=img.token,  # Expose the opaque token, never the enumerable int PK.
+        id=img.id,
         filename=img.filename,
         original_filename=img.original_filename,
         mime_type=img.mime_type,
@@ -168,75 +167,58 @@ def list_images(
         )
 
 
-def _deny_ephemeral_cross_user(image: ImageAsset) -> None:
-    """Defense-in-depth (SDR-4437 F-TM-7): chat-pasted ("ephemeral") images are
-    private to their uploader. Library images stay open-read. Raise 404 (not 403)
-    so a wrong caller cannot even confirm the image exists.
-    """
-    if image.category == "ephemeral" and image.uploaded_by != _get_current_user():
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
-
-
-@router.get("/{token}", response_model=ImageResponse)
-def get_image(token: str, db: Session = Depends(get_db)):
-    """Get image metadata by opaque token."""
+@router.get("/{image_id}", response_model=ImageResponse)
+def get_image(image_id: int, db: Session = Depends(get_db)):
+    """Get image metadata by ID."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.token == token,
+            ImageAsset.id == image_id,
             ImageAsset.is_active == True,
         ).first()
         if not image:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
-        _deny_ephemeral_cross_user(image)
         return _image_to_response(image)
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Error getting image: {e}", exc_info=True)
+        logger.error(f"Error getting image {image_id}: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image",
         )
 
 
-@router.get("/{token}/data", response_model=ImageDataResponse)
-def get_image_data(token: str, db: Session = Depends(get_db)):
-    """Get full image as base64 data (for embedding in slides), keyed by token."""
+@router.get("/{image_id}/data", response_model=ImageDataResponse)
+def get_image_data(image_id: int, db: Session = Depends(get_db)):
+    """Get full image as base64 data (for embedding in slides)."""
     try:
-        image = db.query(ImageAsset).filter(
-            ImageAsset.token == token,
-            ImageAsset.is_active == True,
-        ).first()
-        if not image:
-            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
-        _deny_ephemeral_cross_user(image)
-        b64_data = base64.b64encode(image.image_data).decode("utf-8")
+        b64_data, mime_type = image_service.get_image_base64(db, image_id)
         return ImageDataResponse(
-            id=image.token,
-            mime_type=image.mime_type,
+            id=image_id,
+            mime_type=mime_type,
             base64_data=b64_data,
-            data_uri=f"data:{image.mime_type};base64,{b64_data}",
+            data_uri=f"data:{mime_type};base64,{b64_data}",
         )
-    except HTTPException:
-        raise
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
     except Exception as e:
-        logger.error(f"Error getting image data: {e}", exc_info=True)
+        logger.error(f"Error getting image data {image_id}: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image data",
         )
 
 
-@router.put("/{token}", response_model=ImageResponse)
+@router.put("/{image_id}", response_model=ImageResponse)
 def update_image(
-    token: str,
+    image_id: int,
     request: ImageUpdateRequest,
     db: Session = Depends(get_db),
 ):
     """Update image metadata (tags, description, category)."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.token == token,
+            ImageAsset.id == image_id,
             ImageAsset.is_active == True,
         ).first()
         if not image:
@@ -264,20 +246,20 @@ def update_image(
         raise
     except Exception as e:
         db.rollback()
-        logger.error(f"Error updating image: {e}", exc_info=True)
+        logger.error(f"Error updating image {image_id}: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to update image",
         )
 
 
-@router.delete("/{token}", status_code=status.HTTP_204_NO_CONTENT)
-def delete_image(token: str, db: Session = Depends(get_db)):
+@router.delete("/{image_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_image(image_id: int, db: Session = Depends(get_db)):
     """Soft-delete an image."""
     try:
         user = _get_current_user()
         image = db.query(ImageAsset).filter(
-            ImageAsset.token == token,
+            ImageAsset.id == image_id,
             ImageAsset.is_active == True,  # noqa: E712
         ).first()
         if not image:
@@ -288,14 +270,14 @@ def delete_image(token: str, db: Session = Depends(get_db)):
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="You don't have permission to modify this image",
             )
-        image_service.delete_image(db, token, user)
+        image_service.delete_image(db, image_id, user)
     except HTTPException:
         raise
     except ValueError as e:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
     except Exception as e:
         db.rollback()
-        logger.error(f"Error deleting image: {e}", exc_info=True)
+        logger.error(f"Error deleting image {image_id}: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to delete image",

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/api/schemas/requests.py

@@ -74,9 +74,9 @@ class ChatRequest(BaseModel):
         default=None,
         description="Optional context containing the slides to edit",
     )
-    image_ids: Optional[list[str]] = Field(
+    image_ids: Optional[list[int]] = Field(
         default=None,
-        description="Opaque tokens of images attached to this message (SDR-4437 F-TM-7)",
+        description="IDs of images attached to this message (from upload or paste)",
     )
     agent_config: Optional[dict] = Field(
         default=None,

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/api/services/chat_service.py

@@ -345,7 +345,7 @@ class ChatService:
         session_id: str,
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
-        image_ids: Optional[List[str]] = None,
+        image_ids: Optional[List[int]] = None,
     ) -> Dict[str, Any]:
         """Send a message to the agent and get response.
 
@@ -828,7 +828,7 @@ class ChatService:
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
         request_id: Optional[str] = None,
-        image_ids: Optional[List[str]] = None,
+        image_ids: Optional[List[int]] = None,
         is_first_message_override: Optional[bool] = None,
     ) -> Generator[StreamEvent, None, None]:
         """Send a message and yield streaming events.
@@ -1993,30 +1993,27 @@ class ChatService:
         
         return ([], None)
 
-    def _inject_image_context(self, message: str, image_ids: List[str]) -> str:
-        """Append image metadata to user message so the agent knows about attached images.
-
-        ``image_ids`` are opaque image tokens (SDR-4437 F-TM-7), not int PKs.
-        """
+    def _inject_image_context(self, message: str, image_ids: List[int]) -> str:
+        """Append image metadata to user message so the agent knows about attached images."""
         from src.core.database import get_db_session
         from src.services import image_service
 
         image_descriptions = []
         with get_db_session() as db:
-            for img_token in image_ids:
+            for img_id in image_ids:
                 try:
                     img = db.query(image_service.ImageAsset).filter(
-                        image_service.ImageAsset.token == img_token,
+                        image_service.ImageAsset.id == img_id,
                         image_service.ImageAsset.is_active == True,
                     ).first()
                     if img:
                         image_descriptions.append(
-                            f'- Image ID {img.token}: "{img.original_filename}" '
+                            f'- Image ID {img.id}: "{img.original_filename}" '
                             f'({img.description or "no description"}). '
-                            f'Use: <img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />'
+                            f'Use: <img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />'
                         )
                 except Exception as e:
-                    logger.warning(f"Failed to load image {img_token} for context injection: {e}")
+                    logger.warning(f"Failed to load image {img_id} for context injection: {e}")
 
         if not image_descriptions:
             return message

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/core/database.py

@@ -524,8 +524,6 @@ def _run_migrations(engine, schema: str | None = None):
         # --- image_assets.tags: json → jsonb (PostgreSQL) for native @> queries ---
         _migrate_image_assets_tags_json_to_jsonb(conn, schema, _qual, is_sqlite)
 
-        # --- image_assets.token: unguessable external id + backfill (SDR-4437 F-TM-7) ---
-        _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite)
         # --- agent_config: style precedence in the DB, for the raw-SQL writers no
         # --- Python-side bind hook can see (PostgreSQL only; no-op on SQLite) ---
         _migrate_agent_config_precedence_trigger(
@@ -1060,44 +1058,6 @@ def _ensure_llm_judge_backend_default(
         )
 
 
-def _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite) -> None:
-    """Add the unguessable ``token`` column to image_assets and backfill (SDR-4437 F-TM-7).
-
-    The int PK is enumerable, so image reads now key on an opaque token. Fresh
-    installs get the column via create_all(); existing tables need this ALTER +
-    per-row backfill. Idempotent: gated on the column's absence.
-    """
-    import secrets
-
-    from sqlalchemy import text
-
-    table = "image_assets"
-    try:
-        cols = {c["name"] for c in inspector.get_columns(table, schema=schema)}
-    except Exception:
-        return
-    if not cols or "token" in cols:
-        return
-
-    q = _qual(table)
-    logger.info(f"Migration: adding token column to {table} (SDR-4437 F-TM-7)")
-    # Add nullable first so the ALTER succeeds on a populated table.
-    conn.execute(text(f"ALTER TABLE {q} ADD COLUMN token VARCHAR(64)"))
-
-    # Backfill every existing row with a distinct unguessable token.
-    row_ids = [r[0] for r in conn.execute(text(f"SELECT id FROM {q} WHERE token IS NULL")).fetchall()]
-    for row_id in row_ids:
-        conn.execute(
-            text(f"UPDATE {q} SET token = :tok WHERE id = :id"),
-            {"tok": secrets.token_urlsafe(32), "id": row_id},
-        )
-
-    # Enforce uniqueness (and non-null on PostgreSQL, now that every row has a token).
-    conn.execute(text(
-        f"CREATE UNIQUE INDEX IF NOT EXISTS ix_image_assets_token ON {q} (token)"
-    ))
-    if not is_sqlite:
-        conn.execute(text(f"ALTER TABLE {q} ALTER COLUMN token SET NOT NULL"))
 #: The one place the precedence rule is written in SQL. ``$$``-quoted so the body
 #: needs no escaping, and named after the rule rather than the tables, since both
 #: ``agent_config`` columns share it.

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/database/models/image.py

@@ -1,5 +1,4 @@
 """Image asset model — metadata and binary data stored together in Lakebase."""
-import secrets
 from datetime import datetime
 
 from sqlalchemy import Boolean, Column, DateTime, Integer, JSON, LargeBinary, String, Text
@@ -11,17 +10,6 @@ from src.core.database import Base
 _TagsColumn = JSON().with_variant(JSONB(), "postgresql")
 
 
-def _new_image_token() -> str:
-    """Unguessable external identifier (SDR-4437 F-TM-7).
-
-    The autoincrement int PK is enumerable, so it is never exposed. This
-    opaque token is the only identifier that leaves the server — it is what
-    the API returns, what chat sends in ``image_ids``, and what goes in
-    ``{{image:...}}`` slide placeholders.
-    """
-    return secrets.token_urlsafe(32)
-
-
 class ImageAsset(Base):
     """Uploaded image with binary data stored directly in PostgreSQL.
 
@@ -32,9 +20,7 @@ class ImageAsset(Base):
 
     __tablename__ = "image_assets"
 
-    id = Column(Integer, primary_key=True)  # Internal only — never serialized.
-    # Unguessable external identifier (SDR-4437 F-TM-7). token_urlsafe(32) → 43 chars.
-    token = Column(String(64), unique=True, nullable=False, index=True, default=_new_image_token)
+    id = Column(Integer, primary_key=True)
     filename = Column(String(255), nullable=False)           # Generated: {uuid}.{ext}
     original_filename = Column(String(255), nullable=False)  # User's original filename
     mime_type = Column(String(50), nullable=False)           # image/png, image/jpeg, image/gif, image/svg+xml

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/services/image_service.py

@@ -51,7 +51,7 @@ def upload_image(
         ).first()
         if existing:
             raise ValueError(
-                f"An image named '{original_filename}' already exists. "
+                f"An image named '{original_filename}' already exists (id={existing.id}). "
                 "Please rename the file or delete the existing image first."
             )
 
@@ -86,19 +86,19 @@ def upload_image(
     return image
 
 
-def get_image_base64(db: Session, token: str) -> tuple[str, str]:
+def get_image_base64(db: Session, image_id: int) -> tuple[str, str]:
     """
-    Get full image as base64 string, keyed by the opaque token (SDR-4437 F-TM-7).
+    Get full image as base64 string.
 
     Returns:
         Tuple of (base64_data, mime_type)
     """
     image = db.query(ImageAsset).filter(
-        ImageAsset.token == token,
+        ImageAsset.id == image_id,
         ImageAsset.is_active == True,
     ).first()
     if not image:
-        raise ValueError(f"Image {token} not found")
+        raise ValueError(f"Image {image_id} not found")
 
     b64 = base64.b64encode(image.image_data).decode("utf-8")
     return b64, image.mime_type
@@ -175,11 +175,11 @@ def search_images(
     ).all()
 
 
-def delete_image(db: Session, token: str, user: str) -> None:
-    """Soft-delete an image, keyed by the opaque token (SDR-4437 F-TM-7)."""
-    image = db.query(ImageAsset).filter(ImageAsset.token == token).first()
+def delete_image(db: Session, image_id: int, user: str) -> None:
+    """Soft-delete an image."""
+    image = db.query(ImageAsset).filter(ImageAsset.id == image_id).first()
     if not image:
-        raise ValueError(f"Image {token} not found")
+        raise ValueError(f"Image {image_id} not found")
 
     image.is_active = False
     image.updated_by = user

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/services/image_tools.py

@@ -53,13 +53,13 @@ def search_images(
         # Must build results inside session scope to avoid DetachedInstanceError
         results = [
             {
-                "id": img.token,  # Opaque token (SDR-4437 F-TM-7), never the int PK.
+                "id": img.id,
                 "filename": img.original_filename,
                 "description": img.description,
                 "tags": img.tags,
                 "category": img.category,
                 "mime_type": img.mime_type,
-                "usage": f'<img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />',
+                "usage": f'<img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />',
             }
             for img in images
         ]

{databricks_tellr_app-0.4.3.dev1 → databricks_tellr_app-0.4.3.dev2}/src/utils/image_utils.py

@@ -8,8 +8,7 @@ from src.services import image_service
 
 logger = logging.getLogger(__name__)
 
-# Tokens are secrets.token_urlsafe(...) → [A-Za-z0-9_-] (SDR-4437 F-TM-7).
-IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:([A-Za-z0-9_-]+)\}\}")
+IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:(\d+)\}\}")
 
 
 def substitute_image_placeholders(html: str, db: Session) -> str:
@@ -23,12 +22,12 @@ def substitute_image_placeholders(html: str, db: Session) -> str:
         return html
 
     def replace_match(match):
-        image_token = match.group(1)
+        image_id = int(match.group(1))
         try:
-            b64_data, mime_type = image_service.get_image_base64(db, image_token)
+            b64_data, mime_type = image_service.get_image_base64(db, image_id)
             return f"data:{mime_type};base64,{b64_data}"
         except Exception as e:
-            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_token}}}}}: {e}")
+            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_id}}}}}: {e}")
             return match.group(0)  # Leave placeholder if image not found
 
     return IMAGE_PLACEHOLDER_PATTERN.sub(replace_match, html)