databricks-tellr-app 0.4.3.dev3401__tar.gz → 0.4.3.dev3432__tar.gz

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3401
+Version: 0.4.3.dev3432
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev3401
+Version: 0.4.3.dev3432
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/databricks_tellr_app.egg-info/SOURCES.txt

@@ -137,6 +137,7 @@ setup.py
 ./src/services/identity_providers/__init__.py
 ./src/services/identity_providers/account_provider.py
 ./src/services/identity_providers/local_provider.py
+./src/services/identity_providers/scim_filter.py
 ./src/services/identity_providers/workspace_provider.py
 ./src/services/tools/__init__.py
 ./src/services/tools/agent_bricks_tool.py
@@ -299,6 +300,7 @@ src/services/evaluation/llm_judge.py
 src/services/identity_providers/__init__.py
 src/services/identity_providers/account_provider.py
 src/services/identity_providers/local_provider.py
+src/services/identity_providers/scim_filter.py
 src/services/identity_providers/workspace_provider.py
 src/services/tools/__init__.py
 src/services/tools/agent_bricks_tool.py

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev3401"
+version = "0.4.3.dev3432"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/src/api/routes/chat.py

@@ -25,6 +25,7 @@ from src.api.schemas.agent_config import normalize_style_source_exclusivity
 from src.api.schemas.requests import ChatRequest
 from src.api.schemas.responses import ChatResponse
 from src.api.schemas.streaming import StreamEvent, StreamEventType
+from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.services.chat_service import get_chat_service
 from src.api.services.job_queue import enqueue_job
 from src.api.services.session_manager import SessionNotFoundError, get_session_manager
@@ -120,32 +121,6 @@ def _check_chat_permission(session_id: str, db: DBSession) -> None:
     )
 
 
-def _require_chat_request_owner(session_id: str) -> None:
-    """Allow polling only for the session that owns the chat request.
-
-    ChatRequest rows are bound to a session, and conversations are private
-    (same rule as ``GET /api/sessions/{id}/messages``): only the session
-    creator may read them. A viewer's contributor session is a different
-    session with a different creator, so deck-level CAN_VIEW is not enough.
-
-    Raises:
-        HTTPException 404: Session no longer exists.
-        HTTPException 403: Caller is not the session creator.
-    """
-    session_manager = get_session_manager()
-    try:
-        session_info = session_manager.get_session(session_id)
-    except SessionNotFoundError:
-        raise HTTPException(status_code=404, detail="Request not found")
-
-    current_user = get_current_user()
-    if not current_user or session_info.get("created_by") != current_user:
-        raise HTTPException(
-            status_code=403,
-            detail="Conversations are private. Only the session creator can view chat events.",
-        )
-
-
 def _apply_org_default_style_source(
     agent_config_data: dict,
     *,
@@ -696,21 +671,21 @@ async def poll_chat(
         Dictionary with status, events, last_message_id, and result
 
     Raises:
-        HTTPException: 404 if request not found, 403 if caller is not the
-            session creator
+        HTTPException: 404 if request not found
     """
     session_manager = get_session_manager()
 
     # SDR-4437 (chat-poll IDOR): a request_id must not grant access to another
     # user's chat events/result. ChatRequest rows are session-bound — resolve
-    # the session and require the caller to be its creator (F-CR-31: same
-    # privacy rule as /messages; deck CAN_VIEW must not expose chat events).
+    # the session and require CAN_VIEW on the deck.
     session_id = await asyncio.to_thread(
         session_manager.get_session_id_for_request, request_id
     )
     if session_id is None:
         raise HTTPException(status_code=404, detail="Request not found")
-    await asyncio.to_thread(_require_chat_request_owner, session_id)
+    await asyncio.to_thread(
+        _check_deck_permission_for_session, session_id, PermissionLevel.CAN_VIEW
+    )
 
     chat_request = await asyncio.to_thread(
         session_manager.get_chat_request, request_id

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/src/services/identity_provider.py

@@ -14,6 +14,8 @@ from enum import Enum
 from functools import lru_cache
 from typing import Dict, List, Optional
 
+from src.services.identity_providers.scim_filter import escape_scim_filter_string
+
 logger = logging.getLogger(__name__)
 
 
@@ -33,8 +35,9 @@ def _resolve_cached(email: str) -> str:
         provider = get_identity_provider()
         from src.services.identity_providers.workspace_provider import WorkspaceIdentityProvider
         if isinstance(provider._provider, WorkspaceIdentityProvider):
+            escaped_email = escape_scim_filter_string(email)
             for u in provider._provider._client.users.list(
-                filter=f'userName eq "{email}"',
+                filter=f'userName eq "{escaped_email}"',
                 attributes="id,userName,displayName",
             ):
                 if u.display_name:

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/src/services/identity_providers/account_provider.py

@@ -12,6 +12,8 @@ from typing import List, Optional
 
 import requests
 
+from src.services.identity_providers.scim_filter import escape_scim_filter_string
+
 logger = logging.getLogger(__name__)
 
 
@@ -181,9 +183,10 @@ class AccountIdentityProvider:
             Combined list of matching users and groups
         """
         results = []
+        escaped_query = escape_scim_filter_string(query)
         
         if include_users:
-            user_filter = f'userName co "{query}" or displayName co "{query}"'
+            user_filter = f'userName co "{escaped_query}" or displayName co "{escaped_query}"'
             try:
                 users = self.list_users(filter_query=user_filter, max_results=max_results)
                 results.extend(users)
@@ -191,7 +194,7 @@ class AccountIdentityProvider:
                 logger.warning("Failed to search users in Account API")
         
         if include_groups:
-            group_filter = f'displayName co "{query}"'
+            group_filter = f'displayName co "{escaped_query}"'
             try:
                 groups = self.list_groups(filter_query=group_filter, max_results=max_results)
                 results.extend(groups)

databricks_tellr_app-0.4.3.dev3432/src/services/identity_providers/scim_filter.py

@@ -0,0 +1,6 @@
+"""Helpers for safely constructing SCIM filters."""
+
+
+def escape_scim_filter_string(value: str) -> str:
+    """Escape a value for use inside a SCIM filter string literal."""
+    return value.replace("\\", "\\\\").replace('"', '\\"')

{databricks_tellr_app-0.4.3.dev3401 → databricks_tellr_app-0.4.3.dev3432}/src/services/identity_providers/workspace_provider.py

@@ -12,6 +12,8 @@ from typing import List, Optional
 
 from databricks.sdk import WorkspaceClient
 
+from src.services.identity_providers.scim_filter import escape_scim_filter_string
+
 logger = logging.getLogger(__name__)
 
 
@@ -50,8 +52,9 @@ class WorkspaceIdentityProvider:
         try:
             kwargs: dict = {"attributes": "id,userName,displayName"}
             if filter_query:
+                escaped_query = escape_scim_filter_string(filter_query)
                 kwargs["filter"] = (
-                    f'userName co "{filter_query}" or displayName co "{filter_query}"'
+                    f'userName co "{escaped_query}" or displayName co "{escaped_query}"'
                 )
 
             users: List[dict] = []
@@ -90,7 +93,8 @@ class WorkspaceIdentityProvider:
         try:
             kwargs: dict = {"attributes": "id,displayName"}
             if filter_query:
-                kwargs["filter"] = f'displayName co "{filter_query}"'
+                escaped_query = escape_scim_filter_string(filter_query)
+                kwargs["filter"] = f'displayName co "{escaped_query}"'
 
             groups: List[dict] = []
             for g in self._client.groups.list(**kwargs):