databricks-tellr-app 0.4.3.dev3400__tar.gz → 0.4.3.dev3401__tar.gz

{databricks_tellr_app-0.4.3.dev3400 → databricks_tellr_app-0.4.3.dev3401}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3400
+Version: 0.4.3.dev3401
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3400 → databricks_tellr_app-0.4.3.dev3401}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3400
+Version: 0.4.3.dev3401
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3400 → databricks_tellr_app-0.4.3.dev3401}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev3400"
+version = "0.4.3.dev3401"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev3400 → databricks_tellr_app-0.4.3.dev3401}/src/api/routes/chat.py

@@ -25,7 +25,6 @@ from src.api.schemas.agent_config import normalize_style_source_exclusivity
 from src.api.schemas.requests import ChatRequest
 from src.api.schemas.responses import ChatResponse
 from src.api.schemas.streaming import StreamEvent, StreamEventType
-from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.services.chat_service import get_chat_service
 from src.api.services.job_queue import enqueue_job
 from src.api.services.session_manager import SessionNotFoundError, get_session_manager
@@ -121,6 +120,32 @@ def _check_chat_permission(session_id: str, db: DBSession) -> None:
     )
 
 
+def _require_chat_request_owner(session_id: str) -> None:
+    """Allow polling only for the session that owns the chat request.
+
+    ChatRequest rows are bound to a session, and conversations are private
+    (same rule as ``GET /api/sessions/{id}/messages``): only the session
+    creator may read them. A viewer's contributor session is a different
+    session with a different creator, so deck-level CAN_VIEW is not enough.
+
+    Raises:
+        HTTPException 404: Session no longer exists.
+        HTTPException 403: Caller is not the session creator.
+    """
+    session_manager = get_session_manager()
+    try:
+        session_info = session_manager.get_session(session_id)
+    except SessionNotFoundError:
+        raise HTTPException(status_code=404, detail="Request not found")
+
+    current_user = get_current_user()
+    if not current_user or session_info.get("created_by") != current_user:
+        raise HTTPException(
+            status_code=403,
+            detail="Conversations are private. Only the session creator can view chat events.",
+        )
+
+
 def _apply_org_default_style_source(
     agent_config_data: dict,
     *,
@@ -671,21 +696,21 @@ async def poll_chat(
         Dictionary with status, events, last_message_id, and result
 
     Raises:
-        HTTPException: 404 if request not found
+        HTTPException: 404 if request not found, 403 if caller is not the
+            session creator
     """
     session_manager = get_session_manager()
 
     # SDR-4437 (chat-poll IDOR): a request_id must not grant access to another
     # user's chat events/result. ChatRequest rows are session-bound — resolve
-    # the session and require CAN_VIEW on the deck.
+    # the session and require the caller to be its creator (F-CR-31: same
+    # privacy rule as /messages; deck CAN_VIEW must not expose chat events).
     session_id = await asyncio.to_thread(
         session_manager.get_session_id_for_request, request_id
     )
     if session_id is None:
         raise HTTPException(status_code=404, detail="Request not found")
-    await asyncio.to_thread(
-        _check_deck_permission_for_session, session_id, PermissionLevel.CAN_VIEW
-    )
+    await asyncio.to_thread(_require_chat_request_owner, session_id)
 
     chat_request = await asyncio.to_thread(
         session_manager.get_chat_request, request_id

{databricks_tellr_app-0.4.3.dev3400 → databricks_tellr_app-0.4.3.dev3401}/src/api/routes/profiles.py

@@ -7,7 +7,7 @@ from typing import Any, Optional
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel, Field
 
-from src.api.routes._authz import _check_deck_permission_for_session, require_admin
+from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.schemas.agent_config import (
     AgentConfig,
     resolve_agent_config,
@@ -282,10 +282,6 @@ async def update_profile(profile_id: int, body: UpdateProfileRequest):
         perm_service.require_edit_profile(db, profile_id)
         profile = _get_profile(db, profile_id)
 
-        if body.is_default is not None:
-            # is_default is workspace-wide; promoting or demoting it is an admin action.
-            require_admin()
-
         if body.name is not None:
             profile.name = body.name
         if body.description is not None: