dirigent-server 0.18.4__tar.gz → 0.20.0__tar.gz

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.4
 Name: dirigent-server
-Version: 0.18.4
+Version: 0.20.0
 Summary: Dirigent FastAPI server: the REST API, its authentication, and the health probes.
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 License-File: THIRD_PARTY_NOTICES.md
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: dirigent-client==0.18.4
-Requires-Dist: dirigent-common==0.18.4
-Requires-Dist: dirigent-core==0.18.4
-Requires-Dist: dirigent-examples==0.18.4
+Requires-Dist: dirigent-client==0.20.0
+Requires-Dist: dirigent-common==0.20.0
+Requires-Dist: dirigent-core==0.20.0
+Requires-Dist: dirigent-examples==0.20.0
 Requires-Dist: fastapi>=0.141.1
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-server"
-version = "0.18.4"
+version = "0.20.0"
 description = "Dirigent FastAPI server: the REST API, its authentication, and the health probes."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -14,10 +14,10 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-client==0.18.4",
-    "dirigent-common==0.18.4",
-    "dirigent-core==0.18.4",
-    "dirigent-examples==0.18.4",
+    "dirigent-client==0.20.0",
+    "dirigent-common==0.20.0",
+    "dirigent-core==0.20.0",
+    "dirigent-examples==0.20.0",
     "fastapi>=0.141.1",
 ]
 

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-server"
-version = "0.18.4"
+version = "0.20.0"
 description = "Dirigent FastAPI server: the REST API, its authentication, and the health probes."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,10 +11,10 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-client==0.18.4",
-    "dirigent-common==0.18.4",
-    "dirigent-core==0.18.4",
-    "dirigent-examples==0.18.4",
+    "dirigent-client==0.20.0",
+    "dirigent-common==0.20.0",
+    "dirigent-core==0.20.0",
+    "dirigent-examples==0.20.0",
     "fastapi>=0.141.1",
 ]
 

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/src/dirigent_server/app.py

@@ -29,9 +29,14 @@ A generic pipeline orchestrator. Pipelines are data, composed from pluggable bui
 blocks and executed as a DAG on a durable engine.
 
 Every endpoint under `/api/v1` requires authentication: a bearer token for automation, or
-the session cookie `POST /api/v1/auth/login` sets for a browser. The probes under `/health`
-and this document itself are the only exceptions. `POST /hooks/{token}` is outside the
-versioned API and authenticates with its own per-trigger token.
+the session cookie `POST /api/v1/auth/login` sets for a browser. The probes under `/health`,
+this document itself, and the playground under `/api/v1/playground` are the exceptions.
+`POST /hooks/{token}` is outside the versioned API and authenticates with its own
+per-trigger token.
+
+The playground serves generated data and chosen behaviour to documents that need something
+to happen: it needs no credential, opens no database session, and reads no instance data.
+`DIRIGENT_PLAYGROUND_ENABLED=false` unmounts it.
 """
 
 _logger = get_logger("server")
@@ -99,7 +104,7 @@ def create_app(
     mount_ui_assets(app, resolved)
     app.include_router(health_router)
     app.include_router(build_hooks_router())
-    app.include_router(build_router(), prefix=resolved.api_prefix)
+    app.include_router(build_router(resolved), prefix=resolved.api_prefix)
     mount_ui_shell(app, resolved)
     instrument_fastapi(app)
     return app

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/src/dirigent_server/messages.py

@@ -97,3 +97,23 @@ TOO_MANY_TAILS = SERVER.define("too_many_tails", "you already have {maximum} str
 NO_ICON = SERVER.define("no_icon", "this bundle carries no icon")
 
 BAD_CURSOR = SERVER.define("bad_cursor", "{name}={after} is not a cursor this listing gave out")
+
+PLAYGROUND_BAD_KNOB = SERVER.define("playground_bad_knob", "{detail}")
+
+PLAYGROUND_HEADER_REFUSED = SERVER.define(
+    "playground_header_refused",
+    "the playground will not set {header} on itself: a header that plants a cookie, opens "
+    "this origin to another site, or weakens what a browser enforces here teaches nothing",
+)
+
+PLAYGROUND_OFF_INSTANCE = SERVER.define(
+    "playground_off_instance",
+    "{to} is not a path on this instance, and the playground redirects nowhere else: an "
+    "open redirect is a phishing tool wearing this instance's own domain",
+)
+
+PLAYGROUND_UNAUTHENTICATED = SERVER.define(
+    "playground_unauthenticated",
+    "this route wants a credential: the basic pair {username}/{username}, or the documented "
+    "bearer token. Both are public constants and guard nothing",
+)

{dirigent_server-0.18.4 → dirigent_server-0.20.0}/src/dirigent_server/routes/__init__.py

@@ -7,6 +7,7 @@ rather than as a person, so it is mounted at the application root instead.
 
 from fastapi import APIRouter, Depends
 
+from dirigent_core.config import Settings
 from dirigent_server.routes import (
     alerts,
     auth,
@@ -15,6 +16,7 @@ from dirigent_server.routes import (
     examples,
     hooks,
     pipelines,
+    playground,
     runs,
     schema,
     schemas,
@@ -43,13 +45,23 @@ TAGS: list[dict[str, str]] = [
     {"name": "users", "description": "Local accounts."},
     {"name": "system", "description": "What this instance is, and whether it is well."},
     {"name": "health", "description": "Liveness and readiness."},
+    {
+        "name": "playground",
+        "description": "Generated data and chosen behaviour, for examples and tests. No credential.",
+    },
 ]
 
 
-def build_router() -> APIRouter:
-    """Assemble the versioned API: the login route, then everything behind authentication."""
+def build_router(settings: Settings | None = None) -> APIRouter:
+    """Assemble the versioned API: the open routes, then everything behind authentication.
+
+    The playground is mounted only when the instance serves it, so turning it off is not a
+    route that refuses but a route that is not there.
+    """
     router = APIRouter(route_class=Transactional)
     router.include_router(auth.public_router)
+    if settings is None or settings.playground_enabled:
+        router.include_router(playground.router)
     guarded = APIRouter(dependencies=[Depends(require_principal)], route_class=Transactional)
     for module in (
         auth,