databricks-tellr-app 0.4.3.dev43__tar.gz → 0.4.3.dev3401__tar.gz

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev43
+Version: 0.4.3.dev3401
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev43
+Version: 0.4.3.dev3401
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev43"
+version = "0.4.3.dev3401"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/api/routes/chat.py

@@ -25,7 +25,6 @@ from src.api.schemas.agent_config import normalize_style_source_exclusivity
 from src.api.schemas.requests import ChatRequest
 from src.api.schemas.responses import ChatResponse
 from src.api.schemas.streaming import StreamEvent, StreamEventType
-from src.api.routes._authz import _check_deck_permission_for_session
 from src.api.services.chat_service import get_chat_service
 from src.api.services.job_queue import enqueue_job
 from src.api.services.session_manager import SessionNotFoundError, get_session_manager
@@ -121,6 +120,32 @@ def _check_chat_permission(session_id: str, db: DBSession) -> None:
     )
 
 
+def _require_chat_request_owner(session_id: str) -> None:
+    """Allow polling only for the session that owns the chat request.
+
+    ChatRequest rows are bound to a session, and conversations are private
+    (same rule as ``GET /api/sessions/{id}/messages``): only the session
+    creator may read them. A viewer's contributor session is a different
+    session with a different creator, so deck-level CAN_VIEW is not enough.
+
+    Raises:
+        HTTPException 404: Session no longer exists.
+        HTTPException 403: Caller is not the session creator.
+    """
+    session_manager = get_session_manager()
+    try:
+        session_info = session_manager.get_session(session_id)
+    except SessionNotFoundError:
+        raise HTTPException(status_code=404, detail="Request not found")
+
+    current_user = get_current_user()
+    if not current_user or session_info.get("created_by") != current_user:
+        raise HTTPException(
+            status_code=403,
+            detail="Conversations are private. Only the session creator can view chat events.",
+        )
+
+
 def _apply_org_default_style_source(
     agent_config_data: dict,
     *,
@@ -671,21 +696,21 @@ async def poll_chat(
         Dictionary with status, events, last_message_id, and result
 
     Raises:
-        HTTPException: 404 if request not found
+        HTTPException: 404 if request not found, 403 if caller is not the
+            session creator
     """
     session_manager = get_session_manager()
 
     # SDR-4437 (chat-poll IDOR): a request_id must not grant access to another
     # user's chat events/result. ChatRequest rows are session-bound — resolve
-    # the session and require CAN_VIEW on the deck.
+    # the session and require the caller to be its creator (F-CR-31: same
+    # privacy rule as /messages; deck CAN_VIEW must not expose chat events).
     session_id = await asyncio.to_thread(
         session_manager.get_session_id_for_request, request_id
     )
     if session_id is None:
         raise HTTPException(status_code=404, detail="Request not found")
-    await asyncio.to_thread(
-        _check_deck_permission_for_session, session_id, PermissionLevel.CAN_VIEW
-    )
+    await asyncio.to_thread(_require_chat_request_owner, session_id)
 
     chat_request = await asyncio.to_thread(
         session_manager.get_chat_request, request_id

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/api/routes/export.py

@@ -702,7 +702,6 @@ async def start_pptx_export_async(request: ExportPPTXRequest):
         enqueue_export_job,
         generate_job_id,
     )
-    from src.services.image_service import resolve_requesting_user
 
     import time
     start_time = time.time()
@@ -760,9 +759,6 @@ async def start_pptx_export_async(request: ExportPPTXRequest):
             job_id,
             {
                 "session_id": request.session_id,
-                # Acting user for {{image:ID}} ownership checks (F-CR-27): the
-                # worker runs outside this request's user context.
-                "user_identity": resolve_requesting_user(),
                 "chart_images_per_slide": chart_images_per_slide,
                 "title": slide_deck.get("title", "slides"),
                 "total_slides": total_slides,

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/api/services/export_job_queue.py

@@ -212,9 +212,7 @@ async def process_export_job(job_id: str, payload: dict) -> None:
         from src.core.database import get_db_session
         ds_id = resolve_active_design_system_id(session_id)
         with get_db_session() as db:
-            substitute_deck_dict_images(
-                slide_deck, db, requesting_user=payload.get("user_identity")
-            )
+            substitute_deck_dict_images(slide_deck, db)
             substitute_deck_dict_ds_assets(slide_deck, db, design_system_id=ds_id)
 
         slides = slide_deck.get("slides", [])

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/services/image_service.py

@@ -1,7 +1,6 @@
 """Image upload, thumbnail generation, and retrieval service."""
 import base64
 import logging
-import os
 import uuid
 from io import BytesIO
 from typing import List, Optional
@@ -87,35 +86,10 @@ def upload_image(
     return image
 
 
-def resolve_requesting_user() -> Optional[str]:
-    """Identity to check image ownership against on non-route fetch paths.
-
-    Mirrors ``routes.images._get_current_user`` (the identity ``upload_image``
-    stamps into ``uploaded_by``) without an extra API call: the dev/test
-    ``"system"`` fallback, otherwise the request-scoped username set by the auth
-    middleware / MCP auth. ``None`` when no identity is bound (fail-closed for
-    ephemeral images).
-    """
-    if os.getenv("ENVIRONMENT") in ("development", "test"):
-        return "system"
-    from src.core.user_context import get_current_user
-
-    return get_current_user()
-
-
-def get_image_base64(
-    db: Session, token: str, *, requesting_user: Optional[str]
-) -> tuple[str, str]:
+def get_image_base64(db: Session, token: str) -> tuple[str, str]:
     """
     Get full image as base64 string, keyed by the opaque token (SDR-4437 F-TM-7).
 
-    Applies the same privacy guard as the ``GET /api/images/{token}`` routes
-    (F-CR-27): chat-pasted ("ephemeral") images are private to their uploader,
-    so a token for another user's ephemeral image is reported not-found. Library
-    images stay open-read. ``requesting_user`` is mandatory and keyword-only so
-    every caller makes the acting identity explicit; ``None`` fails closed for
-    ephemeral images.
-
     Returns:
         Tuple of (base64_data, mime_type)
     """
@@ -123,10 +97,7 @@ def get_image_base64(
         ImageAsset.token == token,
         ImageAsset.is_active == True,
     ).first()
-    if not image or (
-        image.category == "ephemeral"
-        and (requesting_user is None or image.uploaded_by != requesting_user)
-    ):
+    if not image:
         raise ValueError(f"Image {token} not found")
 
     b64 = base64.b64encode(image.image_data).decode("utf-8")

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/services/image_tools.py

@@ -10,8 +10,6 @@ from src.services import image_service
 
 logger = logging.getLogger(__name__)
 
-_NO_IMAGES_MESSAGE = "No images found matching your criteria."
-
 
 class SearchImagesInput(BaseModel):
     """Input schema for image search tool."""
@@ -43,27 +41,12 @@ def search_images(
     Returns:
         JSON list of matching images with id, filename, description, and tags
     """
-    # F-CR-27: chat-pasted ("ephemeral") images are private to their uploader and
-    # are never discoverable through the agent tool. The user's own pastes reach
-    # the agent via their message, not via search.
-    if category is not None and category.strip().lower() == "ephemeral":
-        logger.warning("search_images: refusing category='ephemeral' (private images)")
-        return json.dumps({"message": _NO_IMAGES_MESSAGE, "images": []})
-
-    # Scope the listing to the caller (same as GET /api/images). Fail closed when
-    # no identity is bound rather than listing every user's images.
-    requesting_user = image_service.resolve_requesting_user()
-    if requesting_user is None:
-        logger.warning("search_images: no requesting user bound; returning no images")
-        return json.dumps({"message": _NO_IMAGES_MESSAGE, "images": []})
-
     with get_db_session() as db:
         images = image_service.search_images(
             db=db,
             query=query,
             category=category,
             tags=tags,
-            uploaded_by=requesting_user,
         )
 
         # Return metadata only - NEVER base64
@@ -82,6 +65,6 @@ def search_images(
         ]
 
     if not results:
-        return json.dumps({"message": _NO_IMAGES_MESSAGE, "images": []})
+        return json.dumps({"message": "No images found matching your criteria.", "images": []})
 
     return json.dumps({"message": f"Found {len(results)} image(s).", "images": results})

{databricks_tellr_app-0.4.3.dev43 → databricks_tellr_app-0.4.3.dev3401}/src/utils/image_utils.py

@@ -1,7 +1,6 @@
 """Image placeholder substitution for generated slides."""
 import logging
 import re
-from typing import Optional
 
 from sqlalchemy.orm import Session
 
@@ -13,31 +12,20 @@ logger = logging.getLogger(__name__)
 IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:([A-Za-z0-9_-]+)\}\}")
 
 
-def substitute_image_placeholders(
-    html: str, db: Session, *, requesting_user: Optional[str] = None
-) -> str:
+def substitute_image_placeholders(html: str, db: Session) -> str:
     """
     Replace {{image:ID}} placeholders with base64 data URIs.
 
     Called after agent generates HTML, before returning to frontend.
     Works in both HTML img src and CSS url() contexts.
-
-    Resolution is scoped to the acting user (F-CR-27): another user's ephemeral
-    image is left as an unresolved placeholder. ``requesting_user`` defaults to
-    the request-scoped identity (``image_service.resolve_requesting_user``);
-    background callers without a request context must pass it explicitly.
     """
     if not html or "{{image:" not in html:
         return html
-    if requesting_user is None:
-        requesting_user = image_service.resolve_requesting_user()
 
     def replace_match(match):
         image_token = match.group(1)
         try:
-            b64_data, mime_type = image_service.get_image_base64(
-                db, image_token, requesting_user=requesting_user
-            )
+            b64_data, mime_type = image_service.get_image_base64(db, image_token)
             return f"data:{mime_type};base64,{b64_data}"
         except Exception as e:
             logger.warning(f"Failed to resolve image placeholder {{{{image:{image_token}}}}}: {e}")
@@ -53,32 +41,23 @@ def substitute_image_placeholders(
 _DECK_IMAGE_FIELDS = ("html_content", "css")
 
 
-def substitute_deck_dict_images(
-    deck_dict: dict, db: Session, *, requesting_user: Optional[str] = None
-) -> dict:
+def substitute_deck_dict_images(deck_dict: dict, db: Session) -> dict:
     """Substitute {{image:ID}} placeholders across a deck dict.
 
     Covers every field that can carry the placeholder: each slide's ``html``,
     the deck's ``html_content`` (full knitted HTML) and its top-level ``css``
     (backgrounds). Deck-level fields are resolved independently of the slides
     array, mirroring ``substitute_deck_dict_ds_assets`` — the css gap fixed
-    there existed here too. ``requesting_user`` is as for
-    ``substitute_image_placeholders``.
+    there existed here too.
     """
     if not deck_dict:
         return deck_dict
-    if requesting_user is None:
-        requesting_user = image_service.resolve_requesting_user()
     for slide in deck_dict.get("slides") or []:
         html = slide.get("html", "")
         if "{{image:" in html:
-            slide["html"] = substitute_image_placeholders(
-                html, db, requesting_user=requesting_user
-            )
+            slide["html"] = substitute_image_placeholders(html, db)
     for field in _DECK_IMAGE_FIELDS:
         value = deck_dict.get(field)
         if value and "{{image:" in value:
-            deck_dict[field] = substitute_image_placeholders(
-                value, db, requesting_user=requesting_user
-            )
+            deck_dict[field] = substitute_image_placeholders(value, db)
     return deck_dict