databricks-tellr-app 0.4.3.dev5__tar.gz → 0.4.3.dev7__tar.gz

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev5
+Version: 0.4.3.dev7
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/databricks_tellr_app.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-tellr-app
-Version: 0.4.3.dev5
+Version: 0.4.3.dev7
 Summary: Tellr application package for Databricks Apps
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databricks-tellr-app"
-version = "0.4.3.dev5"
+version = "0.4.3.dev7"
 description = "Tellr application package for Databricks Apps"
 readme = "README.md"
 requires-python = ">=3.10"

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/api/routes/images.py

@@ -1,4 +1,5 @@
 """Image upload and management API endpoints."""
+import base64
 import logging
 import os
 from typing import List, Optional
@@ -20,7 +21,7 @@ router = APIRouter(prefix="/api/images", tags=["images"])
 
 class ImageResponse(BaseModel):
     """Response schema for image metadata."""
-    id: int
+    id: str  # Opaque token (SDR-4437 F-TM-7) — the internal int PK is never exposed.
     filename: str
     original_filename: str
     mime_type: str
@@ -46,7 +47,7 @@ class ImageListResponse(BaseModel):
 
 class ImageDataResponse(BaseModel):
     """Response containing image base64 data."""
-    id: int
+    id: str  # Opaque token (SDR-4437 F-TM-7).
     mime_type: str
     base64_data: str
     data_uri: str  # Ready-to-use: "data:image/png;base64,..."
@@ -80,7 +81,7 @@ def _get_current_user() -> str:
 
 def _image_to_response(img: ImageAsset) -> ImageResponse:
     return ImageResponse(
-        id=img.id,
+        id=img.token,  # Expose the opaque token, never the enumerable int PK.
         filename=img.filename,
         original_filename=img.original_filename,
         mime_type=img.mime_type,
@@ -167,58 +168,75 @@ def list_images(
         )
 
 
-@router.get("/{image_id}", response_model=ImageResponse)
-def get_image(image_id: int, db: Session = Depends(get_db)):
-    """Get image metadata by ID."""
+def _deny_ephemeral_cross_user(image: ImageAsset) -> None:
+    """Defense-in-depth (SDR-4437 F-TM-7): chat-pasted ("ephemeral") images are
+    private to their uploader. Library images stay open-read. Raise 404 (not 403)
+    so a wrong caller cannot even confirm the image exists.
+    """
+    if image.category == "ephemeral" and image.uploaded_by != _get_current_user():
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+
+
+@router.get("/{token}", response_model=ImageResponse)
+def get_image(token: str, db: Session = Depends(get_db)):
+    """Get image metadata by opaque token."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,
         ).first()
         if not image:
             raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+        _deny_ephemeral_cross_user(image)
         return _image_to_response(image)
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Error getting image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error getting image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image",
         )
 
 
-@router.get("/{image_id}/data", response_model=ImageDataResponse)
-def get_image_data(image_id: int, db: Session = Depends(get_db)):
-    """Get full image as base64 data (for embedding in slides)."""
+@router.get("/{token}/data", response_model=ImageDataResponse)
+def get_image_data(token: str, db: Session = Depends(get_db)):
+    """Get full image as base64 data (for embedding in slides), keyed by token."""
     try:
-        b64_data, mime_type = image_service.get_image_base64(db, image_id)
+        image = db.query(ImageAsset).filter(
+            ImageAsset.token == token,
+            ImageAsset.is_active == True,
+        ).first()
+        if not image:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Image not found")
+        _deny_ephemeral_cross_user(image)
+        b64_data = base64.b64encode(image.image_data).decode("utf-8")
         return ImageDataResponse(
-            id=image_id,
-            mime_type=mime_type,
+            id=image.token,
+            mime_type=image.mime_type,
             base64_data=b64_data,
-            data_uri=f"data:{mime_type};base64,{b64_data}",
+            data_uri=f"data:{image.mime_type};base64,{b64_data}",
         )
-    except ValueError as e:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+    except HTTPException:
+        raise
     except Exception as e:
-        logger.error(f"Error getting image data {image_id}: {e}", exc_info=True)
+        logger.error(f"Error getting image data: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to get image data",
         )
 
 
-@router.put("/{image_id}", response_model=ImageResponse)
+@router.put("/{token}", response_model=ImageResponse)
 def update_image(
-    image_id: int,
+    token: str,
     request: ImageUpdateRequest,
     db: Session = Depends(get_db),
 ):
     """Update image metadata (tags, description, category)."""
     try:
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,
         ).first()
         if not image:
@@ -246,20 +264,20 @@ def update_image(
         raise
     except Exception as e:
         db.rollback()
-        logger.error(f"Error updating image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error updating image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to update image",
         )
 
 
-@router.delete("/{image_id}", status_code=status.HTTP_204_NO_CONTENT)
-def delete_image(image_id: int, db: Session = Depends(get_db)):
+@router.delete("/{token}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_image(token: str, db: Session = Depends(get_db)):
     """Soft-delete an image."""
     try:
         user = _get_current_user()
         image = db.query(ImageAsset).filter(
-            ImageAsset.id == image_id,
+            ImageAsset.token == token,
             ImageAsset.is_active == True,  # noqa: E712
         ).first()
         if not image:
@@ -270,14 +288,14 @@ def delete_image(image_id: int, db: Session = Depends(get_db)):
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="You don't have permission to modify this image",
             )
-        image_service.delete_image(db, image_id, user)
+        image_service.delete_image(db, token, user)
     except HTTPException:
         raise
     except ValueError as e:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
     except Exception as e:
         db.rollback()
-        logger.error(f"Error deleting image {image_id}: {e}", exc_info=True)
+        logger.error(f"Error deleting image: {e}", exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
             detail="Failed to delete image",

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/api/schemas/requests.py

@@ -74,9 +74,9 @@ class ChatRequest(BaseModel):
         default=None,
         description="Optional context containing the slides to edit",
     )
-    image_ids: Optional[list[int]] = Field(
+    image_ids: Optional[list[str]] = Field(
         default=None,
-        description="IDs of images attached to this message (from upload or paste)",
+        description="Opaque tokens of images attached to this message (SDR-4437 F-TM-7)",
     )
     agent_config: Optional[dict] = Field(
         default=None,

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/api/services/chat_service.py

@@ -345,7 +345,7 @@ class ChatService:
         session_id: str,
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
-        image_ids: Optional[List[int]] = None,
+        image_ids: Optional[List[str]] = None,
     ) -> Dict[str, Any]:
         """Send a message to the agent and get response.
 
@@ -828,7 +828,7 @@ class ChatService:
         message: str,
         slide_context: Optional[Dict[str, Any]] = None,
         request_id: Optional[str] = None,
-        image_ids: Optional[List[int]] = None,
+        image_ids: Optional[List[str]] = None,
         is_first_message_override: Optional[bool] = None,
     ) -> Generator[StreamEvent, None, None]:
         """Send a message and yield streaming events.
@@ -1993,27 +1993,30 @@ class ChatService:
         
         return ([], None)
 
-    def _inject_image_context(self, message: str, image_ids: List[int]) -> str:
-        """Append image metadata to user message so the agent knows about attached images."""
+    def _inject_image_context(self, message: str, image_ids: List[str]) -> str:
+        """Append image metadata to user message so the agent knows about attached images.
+
+        ``image_ids`` are opaque image tokens (SDR-4437 F-TM-7), not int PKs.
+        """
         from src.core.database import get_db_session
         from src.services import image_service
 
         image_descriptions = []
         with get_db_session() as db:
-            for img_id in image_ids:
+            for img_token in image_ids:
                 try:
                     img = db.query(image_service.ImageAsset).filter(
-                        image_service.ImageAsset.id == img_id,
+                        image_service.ImageAsset.token == img_token,
                         image_service.ImageAsset.is_active == True,
                     ).first()
                     if img:
                         image_descriptions.append(
-                            f'- Image ID {img.id}: "{img.original_filename}" '
+                            f'- Image ID {img.token}: "{img.original_filename}" '
                             f'({img.description or "no description"}). '
-                            f'Use: <img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />'
+                            f'Use: <img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />'
                         )
                 except Exception as e:
-                    logger.warning(f"Failed to load image {img_id} for context injection: {e}")
+                    logger.warning(f"Failed to load image {img_token} for context injection: {e}")
 
         if not image_descriptions:
             return message

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/core/database.py

@@ -524,6 +524,14 @@ def _run_migrations(engine, schema: str | None = None):
         # --- image_assets.tags: json → jsonb (PostgreSQL) for native @> queries ---
         _migrate_image_assets_tags_json_to_jsonb(conn, schema, _qual, is_sqlite)
 
+        # --- image_assets.token: unguessable external id + backfill (SDR-4437 F-TM-7) ---
+        _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite)
+
+        # --- stored decks: rewrite {{image:<int-id>}} -> {{image:<token>}} placeholders
+        # --- (SDR-4437 F-TM-7). Runs AFTER the token backfill so every image has one. ---
+        _migrate_rewrite_deck_image_placeholders(
+            conn, inspector, schema, _qual, is_sqlite
+        )
         # --- agent_config: style precedence in the DB, for the raw-SQL writers no
         # --- Python-side bind hook can see (PostgreSQL only; no-op on SQLite) ---
         _migrate_agent_config_precedence_trigger(
@@ -1058,6 +1066,156 @@ def _ensure_llm_judge_backend_default(
         )
 
 
+def _migrate_image_assets_add_token(conn, inspector, schema, _qual, is_sqlite) -> None:
+    """Add the unguessable ``token`` column to image_assets and backfill (SDR-4437 F-TM-7).
+
+    The int PK is enumerable, so image reads now key on an opaque token. Fresh
+    installs get the column via create_all(); existing tables need this ALTER +
+    per-row backfill. Idempotent: gated on the column's absence.
+    """
+    import secrets
+
+    from sqlalchemy import text
+
+    table = "image_assets"
+    try:
+        cols = {c["name"] for c in inspector.get_columns(table, schema=schema)}
+    except Exception:
+        return
+    if not cols or "token" in cols:
+        return
+
+    q = _qual(table)
+    logger.info(f"Migration: adding token column to {table} (SDR-4437 F-TM-7)")
+    # Add nullable first so the ALTER succeeds on a populated table.
+    conn.execute(text(f"ALTER TABLE {q} ADD COLUMN token VARCHAR(64)"))
+
+    # Backfill every existing row with a distinct unguessable token.
+    row_ids = [r[0] for r in conn.execute(text(f"SELECT id FROM {q} WHERE token IS NULL")).fetchall()]
+    for row_id in row_ids:
+        conn.execute(
+            text(f"UPDATE {q} SET token = :tok WHERE id = :id"),
+            {"tok": secrets.token_urlsafe(32), "id": row_id},
+        )
+
+    # Enforce uniqueness (and non-null on PostgreSQL, now that every row has a token).
+    conn.execute(text(
+        f"CREATE UNIQUE INDEX IF NOT EXISTS ix_image_assets_token ON {q} (token)"
+    ))
+    if not is_sqlite:
+        conn.execute(text(f"ALTER TABLE {q} ALTER COLUMN token SET NOT NULL"))
+
+
+#: Persistent (table, column) pairs whose stored text can carry an
+#: ``{{image:<id>}}`` placeholder — the same field set ``substitute_deck_dict_images``
+#: resolves at render time, but at their storage sites:
+#:   * ``session_slide_decks.deck_json``  — the serialized deck dict (slides[].html,
+#:     top-level css, in-dict html_content),
+#:   * ``session_slide_decks.html_content`` — the separate full knitted HTML column,
+#:   * ``slide_deck_versions.deck_json``  — savepoint snapshots, so a restored older
+#:     version renders too.
+#: All three are declared ``Column(Text)`` and no json/jsonb migration touches them,
+#: so they are plain ``TEXT`` on BOTH SQLite and PostgreSQL/Lakebase — ``replace()``
+#: applies directly with no jsonb cast. (Transient scratch such as
+#: ``chat_requests.result_json`` is deliberately excluded — it is not persisted deck
+#: state.)
+_DECK_PLACEHOLDER_COLUMNS: tuple[tuple[str, str], ...] = (
+    ("session_slide_decks", "deck_json"),
+    ("session_slide_decks", "html_content"),
+    ("slide_deck_versions", "deck_json"),
+)
+
+
+def _migrate_rewrite_deck_image_placeholders(conn, inspector, schema, _qual, is_sqlite) -> None:
+    """Rewrite stored deck ``{{image:<int-id>}}`` placeholders to ``{{image:<token>}}`` (SDR-4437 F-TM-7).
+
+    PR #237 switched the external image identifier from the enumerable int PK to
+    an unguessable token, and ``substitute_image_placeholders`` now resolves
+    ``{{image:<token>}}``. Decks saved BEFORE that change have ``{{image:<int-id>}}``
+    baked into their stored HTML/JSON, so their embedded images would stop
+    rendering. This one-time, idempotent migration rewrites those placeholders in
+    place, using the ``id -> token`` map that ``_migrate_image_assets_add_token``
+    (which runs just before this) has guaranteed exists on every image row.
+
+    The string work stays IN THE DATABASE — Python only drives a per-``(id, token)``
+    loop of set-based ``replace()`` UPDATEs, exactly like the token backfill drives
+    its loop. Deck blobs are never pulled into the app to be regexed.
+
+    Correctness / performance:
+
+    - **Per-image sequential loop, not a join.** A single
+      ``UPDATE ... FROM image_assets`` applies only ONE arbitrary matched row per
+      target row, so a deck referencing two images would be half-rewritten. The
+      sequential per-image ``replace()`` accumulates correctly across multi-image
+      decks. ``regexp_replace`` can't express it either — the replacement is a
+      per-match lookup into ``image_assets``, not a fixed template.
+    - **Prefix-safe.** The literal ``{{image:5}}`` (closing braces included) never
+      matches inside ``{{image:51}}``, so there is no id-prefix collision.
+    - **Idempotent + cheap.** The ``LIKE`` guard means once the int placeholders are
+      gone (first run) re-runs match nothing; unreferenced or hard-deleted ids are
+      simply never touched. Cost is O(images) set-based UPDATEs, fine at startup.
+    - **No jsonb cast.** Every target column (:data:`_DECK_PLACEHOLDER_COLUMNS`) is
+      ``TEXT`` on both backends, so ``replace()`` applies directly. Tokens are
+      ``[A-Za-z0-9_-]`` (JSON-safe), so text-level replacement inside a JSON blob
+      cannot corrupt its structure.
+    - **Soft-deleted images included** (no ``is_active`` filter) — a deck may still
+      reference an image that was later soft-deleted, and it must keep resolving.
+
+    A no-op when ``image_assets`` (or its ``token`` column) or every target table is
+    absent on a given deploy.
+    """
+    from sqlalchemy import text
+
+    # image_assets + its token column must exist (guaranteed by the prior migration
+    # on any live deploy; guarded so this can be exercised standalone).
+    try:
+        image_cols = {c["name"] for c in inspector.get_columns("image_assets", schema=schema)}
+    except Exception:
+        return
+    if "token" not in image_cols:
+        return
+
+    # Only rewrite target tables/columns that actually exist on this deploy.
+    live_targets: list[tuple[str, str]] = []
+    for table_name, column_name in _DECK_PLACEHOLDER_COLUMNS:
+        try:
+            cols = {c["name"] for c in inspector.get_columns(table_name, schema=schema)}
+        except Exception:
+            continue
+        if column_name in cols:
+            live_targets.append((table_name, column_name))
+    if not live_targets:
+        return
+
+    rows = conn.execute(
+        text(f"SELECT id, token FROM {_qual('image_assets')} WHERE token IS NOT NULL")
+    ).fetchall()
+    if not rows:
+        return
+
+    logger.info(
+        "Migration: rewriting {{image:<id>}} deck placeholders to tokens for "
+        "%d images across %d columns (SDR-4437 F-TM-7)",
+        len(rows),
+        len(live_targets),
+    )
+    for image_id, token in rows:
+        old = f"{{{{image:{image_id}}}}}"
+        new = f"{{{{image:{token}}}}}"
+        for table_name, column_name in live_targets:
+            q = _qual(table_name)
+            # Identifiers come from the hardcoded _DECK_PLACEHOLDER_COLUMNS; the
+            # placeholder literals are bound parameters. The LIKE guard makes rows
+            # without this id (and every row on a re-run) a no-op.
+            conn.execute(
+                text(
+                    f"UPDATE {q} SET {column_name} = replace({column_name}, :old, :new) "
+                    f"WHERE {column_name} LIKE :pattern"
+                ),
+                {"old": old, "new": new, "pattern": f"%{old}%"},
+            )
+
+
 #: The one place the precedence rule is written in SQL. ``$$``-quoted so the body
 #: needs no escaping, and named after the rule rather than the tables, since both
 #: ``agent_config`` columns share it.

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/database/models/image.py

@@ -1,4 +1,5 @@
 """Image asset model — metadata and binary data stored together in Lakebase."""
+import secrets
 from datetime import datetime
 
 from sqlalchemy import Boolean, Column, DateTime, Integer, JSON, LargeBinary, String, Text
@@ -10,6 +11,17 @@ from src.core.database import Base
 _TagsColumn = JSON().with_variant(JSONB(), "postgresql")
 
 
+def _new_image_token() -> str:
+    """Unguessable external identifier (SDR-4437 F-TM-7).
+
+    The autoincrement int PK is enumerable, so it is never exposed. This
+    opaque token is the only identifier that leaves the server — it is what
+    the API returns, what chat sends in ``image_ids``, and what goes in
+    ``{{image:...}}`` slide placeholders.
+    """
+    return secrets.token_urlsafe(32)
+
+
 class ImageAsset(Base):
     """Uploaded image with binary data stored directly in PostgreSQL.
 
@@ -20,7 +32,9 @@ class ImageAsset(Base):
 
     __tablename__ = "image_assets"
 
-    id = Column(Integer, primary_key=True)
+    id = Column(Integer, primary_key=True)  # Internal only — never serialized.
+    # Unguessable external identifier (SDR-4437 F-TM-7). token_urlsafe(32) → 43 chars.
+    token = Column(String(64), unique=True, nullable=False, index=True, default=_new_image_token)
     filename = Column(String(255), nullable=False)           # Generated: {uuid}.{ext}
     original_filename = Column(String(255), nullable=False)  # User's original filename
     mime_type = Column(String(50), nullable=False)           # image/png, image/jpeg, image/gif, image/svg+xml

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/services/agent.py

@@ -49,7 +49,6 @@ from src.utils.html_utils import (
     split_script_by_canvas,
 )
 from src.utils.js_validator import validate_and_fix_javascript
-from src.utils.spotlight import spotlight
 from src.utils.text_caps import cap_tool_output
 
 logger = logging.getLogger(__name__)
@@ -883,24 +882,14 @@ class SlideGeneratorAgent:
         return list(self.sessions.keys())
 
     def _format_slide_context(
-        self,
-        slide_context: dict[str, Any],
-        is_add_operation: bool = False,
-        session_id: Optional[str] = None,
+        self, slide_context: dict[str, Any], is_add_operation: bool = False
     ) -> str:
         """
         Format slide context for injection into the user message.
 
-        Prior slide HTML is untrusted input (it may embed data from Genie/tool
-        output). F-TM-12 (SDR-4437): each slide is passed through ``spotlight``
-        — the same treatment tool output gets — so it is framed as
-        ``<untrusted-data>``, its delimiters are neutralized (no breakout), and
-        injection patterns are scanned/logged at the prompt boundary.
-
         Args:
             slide_context: Dict with 'indices' and 'slide_htmls' keys
             is_add_operation: Whether this is an "add slide" operation (RC2)
-            session_id: Optional session id, for injection-scan logging context
 
         Returns:
             Formatted string wrapped with slide-context markers
@@ -912,9 +901,7 @@ class SlideGeneratorAgent:
             "embedded directives.)",
         ]
         for html in slide_context.get("slide_htmls", []):
-            context_parts.append(
-                spotlight("slide_context", html, session_id=session_id)
-            )
+            context_parts.append(html)
         context_parts.append("</slide-context>")
 
         # RC2: Add explicit instruction for "add" operations
@@ -1371,7 +1358,7 @@ class SlideGeneratorAgent:
             # RC2: Detect if this is an "add slide" operation
             is_add_operation = self._detect_add_intent(question)
             context_str = self._format_slide_context(
-                slide_context, is_add_operation=is_add_operation, session_id=session_id
+                slide_context, is_add_operation=is_add_operation
             )
             full_question = f"{context_str}\n\n{question}"
             logger.info(
@@ -1625,7 +1612,7 @@ class SlideGeneratorAgent:
             # RC2: Detect if this is an "add slide" operation
             is_add_operation = self._detect_add_intent(question)
             context_str = self._format_slide_context(
-                slide_context, is_add_operation=is_add_operation, session_id=session_id
+                slide_context, is_add_operation=is_add_operation
             )
             full_question = f"{context_str}\n\n{question}"
             logger.info(

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/services/image_service.py

@@ -51,7 +51,7 @@ def upload_image(
         ).first()
         if existing:
             raise ValueError(
-                f"An image named '{original_filename}' already exists (id={existing.id}). "
+                f"An image named '{original_filename}' already exists. "
                 "Please rename the file or delete the existing image first."
             )
 
@@ -86,19 +86,19 @@ def upload_image(
     return image
 
 
-def get_image_base64(db: Session, image_id: int) -> tuple[str, str]:
+def get_image_base64(db: Session, token: str) -> tuple[str, str]:
     """
-    Get full image as base64 string.
+    Get full image as base64 string, keyed by the opaque token (SDR-4437 F-TM-7).
 
     Returns:
         Tuple of (base64_data, mime_type)
     """
     image = db.query(ImageAsset).filter(
-        ImageAsset.id == image_id,
+        ImageAsset.token == token,
         ImageAsset.is_active == True,
     ).first()
     if not image:
-        raise ValueError(f"Image {image_id} not found")
+        raise ValueError(f"Image {token} not found")
 
     b64 = base64.b64encode(image.image_data).decode("utf-8")
     return b64, image.mime_type
@@ -175,11 +175,11 @@ def search_images(
     ).all()
 
 
-def delete_image(db: Session, image_id: int, user: str) -> None:
-    """Soft-delete an image."""
-    image = db.query(ImageAsset).filter(ImageAsset.id == image_id).first()
+def delete_image(db: Session, token: str, user: str) -> None:
+    """Soft-delete an image, keyed by the opaque token (SDR-4437 F-TM-7)."""
+    image = db.query(ImageAsset).filter(ImageAsset.token == token).first()
     if not image:
-        raise ValueError(f"Image {image_id} not found")
+        raise ValueError(f"Image {token} not found")
 
     image.is_active = False
     image.updated_by = user

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/services/image_tools.py

@@ -53,13 +53,13 @@ def search_images(
         # Must build results inside session scope to avoid DetachedInstanceError
         results = [
             {
-                "id": img.id,
+                "id": img.token,  # Opaque token (SDR-4437 F-TM-7), never the int PK.
                 "filename": img.original_filename,
                 "description": img.description,
                 "tags": img.tags,
                 "category": img.category,
                 "mime_type": img.mime_type,
-                "usage": f'<img src="{{{{image:{img.id}}}}}" alt="{img.description or img.original_filename}" />',
+                "usage": f'<img src="{{{{image:{img.token}}}}}" alt="{img.description or img.original_filename}" />',
             }
             for img in images
         ]

{databricks_tellr_app-0.4.3.dev5 → databricks_tellr_app-0.4.3.dev7}/src/utils/image_utils.py

@@ -8,7 +8,8 @@ from src.services import image_service
 
 logger = logging.getLogger(__name__)
 
-IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:(\d+)\}\}")
+# Tokens are secrets.token_urlsafe(...) → [A-Za-z0-9_-] (SDR-4437 F-TM-7).
+IMAGE_PLACEHOLDER_PATTERN = re.compile(r"\{\{image:([A-Za-z0-9_-]+)\}\}")
 
 
 def substitute_image_placeholders(html: str, db: Session) -> str:
@@ -22,12 +23,12 @@ def substitute_image_placeholders(html: str, db: Session) -> str:
         return html
 
     def replace_match(match):
-        image_id = int(match.group(1))
+        image_token = match.group(1)
         try:
-            b64_data, mime_type = image_service.get_image_base64(db, image_id)
+            b64_data, mime_type = image_service.get_image_base64(db, image_token)
             return f"data:{mime_type};base64,{b64_data}"
         except Exception as e:
-            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_id}}}}}: {e}")
+            logger.warning(f"Failed to resolve image placeholder {{{{image:{image_token}}}}}: {e}")
             return match.group(0)  # Leave placeholder if image not found
 
     return IMAGE_PLACEHOLDER_PATTERN.sub(replace_match, html)