dirigent-core 0.27.0__tar.gz → 0.28.0__tar.gz

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirigent-core
-Version: 0.27.0
+Version: 0.28.0
 Summary: Dirigent engine core: schema, configuration, and plugin host.
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
@@ -12,12 +12,13 @@ Requires-Dist: argon2-cffi>=25.1.0
 Requires-Dist: asyncpg>=0.31.0
 Requires-Dist: cronsim>=2.7
 Requires-Dist: cryptography>=46.0.5
-Requires-Dist: dirigent-client==0.27.0
-Requires-Dist: dirigent-common==0.27.0
-Requires-Dist: dirigent-plugin==0.27.0
+Requires-Dist: dirigent-client==0.28.0
+Requires-Dist: dirigent-common==0.28.0
+Requires-Dist: dirigent-plugin==0.28.0
 Requires-Dist: jsonschema>=4.26.0
 Requires-Dist: opentelemetry-api>=1.44.0
 Requires-Dist: pydantic-settings>=2.15.0
+Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: pyyaml>=6.0.3
 Requires-Dist: sqlalchemy[asyncio]>=2.1.3
 Requires-Dist: structlog>=25.5.0

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-core"
-version = "0.27.0"
+version = "0.28.0"
 description = "Dirigent engine core: schema, configuration, and plugin host."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -17,12 +17,13 @@ dependencies = [
     "asyncpg>=0.31.0",
     "cronsim>=2.7",
     "cryptography>=46.0.5",
-    "dirigent-client==0.27.0",
-    "dirigent-common==0.27.0",
-    "dirigent-plugin==0.27.0",
+    "dirigent-client==0.28.0",
+    "dirigent-common==0.28.0",
+    "dirigent-plugin==0.28.0",
     "jsonschema>=4.26.0",
     "opentelemetry-api>=1.44.0",
     "pydantic-settings>=2.15.0",
+    "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",
     "sqlalchemy[asyncio]>=2.1.3",
     "structlog>=25.5.0",

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-core"
-version = "0.27.0"
+version = "0.28.0"
 description = "Dirigent engine core: schema, configuration, and plugin host."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -17,12 +17,13 @@ dependencies = [
     "asyncpg>=0.31.0",
     "cronsim>=2.7",
     "cryptography>=46.0.5",
-    "dirigent-client==0.27.0",
-    "dirigent-common==0.27.0",
-    "dirigent-plugin==0.27.0",
+    "dirigent-client==0.28.0",
+    "dirigent-common==0.28.0",
+    "dirigent-plugin==0.28.0",
     "jsonschema>=4.26.0",
     "opentelemetry-api>=1.44.0",
     "pydantic-settings>=2.15.0",
+    "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",
     "sqlalchemy[asyncio]>=2.1.3",
     "structlog>=25.5.0",

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/src/dirigent_core/alembic/versions/0001_baseline_schema.py

@@ -450,6 +450,7 @@ def upgrade() -> None:
         sa.Column("token_hash", sa.String(length=128), nullable=True),
         sa.Column("token_prefix", sa.String(length=16), nullable=True),
         sa.Column("signing_secret", sa.LargeBinary(), nullable=True),
+        sa.Column("secret_fingerprint", sa.String(length=16), nullable=True),
         sa.Column("signing_key_id", sa.String(length=64), nullable=True),
         sa.Column("paused", sa.Boolean(), server_default=sa.false(), nullable=False),
         sa.Column("accepted", sa.Integer(), server_default=sa.text("0"), nullable=False),
@@ -524,6 +525,7 @@ def upgrade() -> None:
             sa.Enum(
                 "queued",
                 "running",
+                "paused",
                 "succeeded",
                 "completed_with_errors",
                 "failed",
@@ -550,6 +552,8 @@ def upgrade() -> None:
                 "user",
                 "pipeline",
                 "backfill",
+                "source",
+                "rerun",
                 name="trigger_kind",
                 native_enum=False,
                 length=32,
@@ -567,6 +571,7 @@ def upgrade() -> None:
         ),
         sa.Column("started_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("finished_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
+        sa.Column("paused_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("window_start", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("window_end", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column(
@@ -578,6 +583,18 @@ def upgrade() -> None:
         sa.Column(
             "schemas", sa.JSON().with_variant(postgresql.JSONB(astext_type=Text()), "postgresql"), nullable=False
         ),
+        sa.Column(
+            "stored_bytes",
+            sa.BigInteger().with_variant(sa.Integer(), "sqlite"),
+            server_default=sa.text("0"),
+            nullable=False,
+        ),
+        sa.Column(
+            "chain_stored_bytes",
+            sa.BigInteger().with_variant(sa.Integer(), "sqlite"),
+            server_default=sa.text("0"),
+            nullable=False,
+        ),
         sa.Column(
             "created_at",
             dirigent_core.types.UtcDateTime(timezone=True),
@@ -808,6 +825,19 @@ def upgrade() -> None:
         batch_op.create_index("ix_source_inputs_created_at", ["created_at"], unique=False)
         batch_op.create_index("ix_source_inputs_source_id_id", ["source_id", "id"], unique=False)
 
+    op.create_table(
+        "source_signatures",
+        sa.Column("source_id", sa.Uuid(), nullable=False),
+        sa.Column("signature", sa.String(length=64), nullable=False),
+        sa.Column("signed_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(
+            ["source_id"], ["sources.id"], name=op.f("fk_source_signatures_source_id_sources"), ondelete="CASCADE"
+        ),
+        sa.PrimaryKeyConstraint("source_id", "signature", name=op.f("pk_source_signatures")),
+    )
+    with op.batch_alter_table("source_signatures", schema=None) as batch_op:
+        batch_op.create_index("ix_source_signatures_signed_at", ["signed_at"], unique=False)
+
     op.create_table(
         "step_attempts",
         sa.Column("id", sa.Uuid(), nullable=False),
@@ -843,6 +873,7 @@ def upgrade() -> None:
         sa.Column("lease_token", sa.Uuid(), nullable=True),
         sa.Column("lease_expires_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("heartbeat_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
+        sa.Column("lease_recoveries", sa.Integer(), server_default=sa.text("0"), nullable=False),
         sa.Column(
             "remote_handle", sa.JSON().with_variant(postgresql.JSONB(astext_type=Text()), "postgresql"), nullable=True
         ),
@@ -999,6 +1030,10 @@ def downgrade() -> None:
         batch_op.drop_index("ix_step_attempts_lease_expires_at")
 
     op.drop_table("step_attempts")
+    with op.batch_alter_table("source_signatures", schema=None) as batch_op:
+        batch_op.drop_index("ix_source_signatures_signed_at")
+
+    op.drop_table("source_signatures")
     with op.batch_alter_table("source_inputs", schema=None) as batch_op:
         batch_op.drop_index("ix_source_inputs_source_id_id")
         batch_op.drop_index("ix_source_inputs_created_at")

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/src/dirigent_core/alerting.py

@@ -35,6 +35,8 @@ from dirigent_common import (
     compile_template,
     format_duration,
     render,
+    scrub,
+    secrets_of,
 )
 from dirigent_core.database import is_deadlock, session_scope
 from dirigent_core.engine.definition import load_definition
@@ -786,18 +788,20 @@ async def send_notification(
     has to be held anyway, because the fence below re-reads the row it writes.
     """
     moment = now or utcnow()
+    secrets: set[str] = set()
     try:
         notifier = services.host.notifiers.get(notification.notifier)
         if notifier is None:
             raise AlertError(NOTIFIER_NOT_ON_WORKER, notifier=repr(notification.notifier))
         connection = await session.get(Connection, notification.connection_id) if notification.connection_id else None
         config = notifier_config(services, notifier, connection)
+        secrets = secrets_of(config)
         await session.commit()
         await notifier.send(_message(notification), config)
     except Exception as error:
         if not await _holds_lease(session, notification, owner, lease_token):
             return False
-        return await _record_failure(session, services, notification, error, moment)
+        return await _record_failure(session, services, notification, error, moment, secrets)
     if not await _holds_lease(session, notification, owner, lease_token):
         return False
     notification.status = NotificationStatus.SENT
@@ -896,9 +900,10 @@ async def _record_failure(
     notification: Notification,
     error: Exception,
     moment: datetime,
+    secrets: set[str],
 ) -> bool:
     """Schedule another delivery, or record that this one is never going to arrive."""
-    message = f"{type(error).__name__}: {error}"
+    message = scrub(f"{type(error).__name__}: {error}", secrets)
     notification.error = message
     notification.lease_owner = None
     notification.lease_token = None

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/src/dirigent_core/artifacts.py

@@ -11,7 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from dirigent_common import JsonMap
 from dirigent_core.errors import DomainError
-from dirigent_core.messages import OBJECT_MISSING
+from dirigent_core.messages import OBJECT_ALTERED, OBJECT_MISSING
 from dirigent_core.models import ArtifactRef, StepAttempt
 from dirigent_core.storage import Storage, StorageError, join_uri, parse_uri
 
@@ -41,6 +41,21 @@ class ObjectMissing(DomainError):
         )
 
 
+class ArtifactAltered(DomainError):
+    """The object in storage is not the one this row recorded when it was written."""
+
+    status = 500
+    message = OBJECT_ALTERED
+
+    def __init__(self, reference: ArtifactRef) -> None:
+        """Name the object, and the run and attempt whose row recorded something else."""
+        super().__init__(
+            uri=reference.uri or "",
+            run=str(reference.run_id),
+            attempt=str(reference.step_attempt_id) if reference.step_attempt_id else NO_ATTEMPT,
+        )
+
+
 def canonical_json(value: object) -> bytes:
     """Serialize a value the one way the engine hashes and stores it."""
     return json.dumps(value, sort_keys=True, separators=(",", ":"), default=str).encode()
@@ -137,14 +152,39 @@ async def _present_uri(storage: Storage, reference: ArtifactRef) -> str:
     where one that opened the stream first would break mid-body with the status already sent.
     """
     uri = reference.uri or ""
-    if await storage.stat(uri) is None:
+    found = await storage.stat(uri)
+    if found is None:
         raise ObjectMissing(reference)
+    if reference.size_bytes is not None and found.size != reference.size_bytes:
+        raise ArtifactAltered(reference)
     return uri
 
 
+async def _verified(chunks: AsyncGenerator[bytes], reference: ArtifactRef) -> AsyncGenerator[bytes]:
+    """Pass a stored object through, and fail at its end if it is not what the row recorded.
+
+    A stream's status has gone by then, so what this can do is end the response as an error
+    rather than a complete body. A row with no digest has nothing to check against.
+    """
+    hashed = hashlib.sha256()
+    async for chunk in chunks:
+        hashed.update(chunk)
+        yield chunk
+    if reference.digest is not None and f"sha256:{hashed.hexdigest()}" != reference.digest:
+        raise ArtifactAltered(reference)
+
+
+async def _read_verified(storage: Storage, reference: ArtifactRef) -> bytes:
+    """Read a whole stored object, refusing one that is not what the row recorded."""
+    payload = await storage.read_bytes(await _present_uri(storage, reference))
+    if reference.digest is not None and digest_of(payload) != reference.digest:
+        raise ArtifactAltered(reference)
+    return payload
+
+
 async def open_artifact(storage: Storage, reference: ArtifactRef) -> AsyncGenerator[bytes]:
-    """Open the stored object a row names for streaming, refusing before the first byte."""
-    return storage.open_read(await _present_uri(storage, reference))
+    """Open the stored object a row names for streaming, refusing what it can before the first byte."""
+    return _verified(storage.open_read(await _present_uri(storage, reference)), reference)
 
 
 async def load_document(storage: Storage, reference: ArtifactRef) -> str:
@@ -154,7 +194,7 @@ async def load_document(storage: Storage, reference: ArtifactRef) -> str:
         return inlined if isinstance(inlined, str) else ""
     if reference.uri is None:
         return ""
-    return (await storage.read_bytes(await _present_uri(storage, reference))).decode()
+    return (await _read_verified(storage, reference)).decode()
 
 
 async def load_artifact(session: AsyncSession, storage: Storage, artifact_id: UUID) -> JsonMap | None:
@@ -166,6 +206,6 @@ async def load_artifact(session: AsyncSession, storage: Storage, artifact_id: UU
         return reference.inline_value
     if reference.uri is None:
         return None
-    payload = await storage.read_bytes(await _present_uri(storage, reference))
+    payload = await _read_verified(storage, reference)
     loaded: JsonMap = json.loads(payload)
     return loaded

{dirigent_core-0.27.0 → dirigent_core-0.28.0}/src/dirigent_core/auth.py

@@ -251,6 +251,15 @@ async def create_user(
     return user
 
 
+async def create_fixture_admin(session: AsyncSession, username: str, password: str) -> User:
+    """Create the admin of a throwaway instance, whose fixed password need not meet the length rule."""
+    user = User(username=username, password_hash=_hasher.hash(password), role=UserRole.ADMIN)
+    session.add(user)
+    await session.flush()
+    _logger.info("fixture admin created", username=username)
+    return user
+
+
 async def reset_password(session: AsyncSession, user: User, password: str) -> User:
     """Replace an account's password without its old one, ending every session it holds and no API token."""
     user.password_hash = hash_password(password)
@@ -467,6 +476,28 @@ async def resolve_token(session: AsyncSession, secret: str, *, now: datetime | N
     )
 
 
+async def principal_stands(session: AsyncSession, principal: Principal, *, now: datetime | None = None) -> bool:
+    """Say whether what authenticated a principal would still authenticate it, in one indexed read.
+
+    What a long-lived response asks on every poll, inside that poll's own transaction, so the
+    credential it was opened with is held to the same rule a new request is.
+    """
+    moment = now or utcnow()
+    if principal.token_id is None:
+        statement = sa.select(User.active).where(User.id == principal.user_id)
+    else:
+        statement = (
+            sa.select(User.active)
+            .join(ApiToken, ApiToken.user_id == User.id)
+            .where(
+                ApiToken.id == principal.token_id,
+                ApiToken.revoked_at.is_(None),
+                sa.or_(ApiToken.expires_at.is_(None), ApiToken.expires_at > moment),
+            )
+        )
+    return (await session.execute(statement)).scalar_one_or_none() is True
+
+
 async def list_tokens(
     session: AsyncSession,
     *,
@@ -503,23 +534,22 @@ async def list_tokens(
     ]
 
 
-async def revoke_token(session: AsyncSession, *, user_id: UUID, name: str) -> bool:
-    """Revoke one account's live tokens of a given name, reporting whether anything was revoked.
+async def revoke_token(session: AsyncSession, token_id: UUID) -> bool:
+    """Revoke one live API token by its id, reporting whether there was one to revoke.
 
-    A name is unique only within an account, so the owner is part of what is revoked.
+    A browser session shares the table and is not reached from here.
     """
     statement = sa.select(ApiToken).where(
+        ApiToken.id == token_id,
+        ApiToken.kind == TokenKind.API,
         ApiToken.revoked_at.is_(None),
-        ApiToken.user_id == user_id,
-        ApiToken.name == name,
     )
-    rows = await session.execute(statement)
-    revoked = 0
-    for token in rows.scalars():
-        token.revoked_at = utcnow()
-        revoked += 1
+    token = (await session.execute(statement)).scalar_one_or_none()
+    if token is None:
+        return False
+    token.revoked_at = utcnow()
     await session.flush()
-    return revoked > 0
+    return True
 
 
 async def revoke_session(session: AsyncSession, secret: str) -> None: