imbi-api 2.1.0__tar.gz → 2.5.2__tar.gz

{imbi_api-2.1.0 → imbi_api-2.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-api
-Version: 2.1.0
+Version: 2.5.2
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -19,7 +19,7 @@ Requires-Dist: authlib>=1.6.11
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,server]>=0.11.0
+Requires-Dist: imbi-common[databases,llm,sentry,server]>=2.5.5
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: nanoid>=2.0.0
@@ -29,6 +29,7 @@ Requires-Dist: pydantic[email]
 Requires-Dist: pyotp>=2.9.0
 Requires-Dist: python-multipart>=0.0.26
 Requires-Dist: qrcode>=8.0
+Requires-Dist: sentry-sdk>=2.48.0
 Requires-Dist: slowapi==0.1.9
 Requires-Dist: typer
 Requires-Dist: uvicorn

imbi_api-2.5.2/docs/restore-backup.md

@@ -0,0 +1,117 @@
+# How to Restore an Imbi Database Backup
+
+Restore a `pg_dump` backup of the Imbi database, including the Apache AGE graph.
+
+**Prerequisites**: AGE extension installed on the target PostgreSQL instance, target DB created and empty.
+
+---
+
+## 1. Prepare the Target Database
+
+AGE must be installed before restore. Connect to the target DB and run:
+
+```sql
+CREATE EXTENSION age;
+LOAD 'age';
+SET search_path = ag_catalog, "$user", public;
+```
+
+## 2. Restore the Dump
+
+```bash
+pg_restore -d imbi -Fc --no-owner --role=imbi imbi.dump
+```
+
+Or for plain SQL:
+
+```bash
+psql -d imbi -f imbi.sql
+```
+
+## 3. Verify Graph Catalog Integrity
+
+After restore, confirm all graph labels are registered:
+
+```sql
+-- Get the graph OID
+SELECT graphid FROM ag_catalog.ag_graph WHERE name = 'imbi';
+
+-- List registered labels (note the graphid from above)
+SELECT name, kind FROM ag_catalog.ag_label WHERE graph = <graphid> ORDER BY name;
+```
+
+## 4. Find Unregistered Labels
+
+Physical label tables may exist without `ag_catalog.ag_label` entries. This causes
+`DuplicateTable` errors when the application first accesses those labels.
+
+```sql
+SELECT tablename
+FROM pg_tables
+WHERE schemaname = 'imbi'
+  AND tablename NOT IN (
+    SELECT name FROM ag_catalog.ag_label WHERE graph = <graphid>
+  )
+ORDER BY tablename;
+```
+
+If this query returns rows, proceed to step 5. If empty, the restore is complete.
+
+## 5. Register Missing Labels
+
+For each missing label, determine its kind: vertex (`v`) or edge (`e`). In Imbi,
+edge labels are conventionally `ALL_CAPS` and vertex labels are `PascalCase`.
+
+Run this once, substituting the correct list and your `graphid`:
+
+```sql
+INSERT INTO ag_catalog.ag_label (name, graph, id, kind, relation, seq_name)
+SELECT
+    name,
+    <graphid>,
+    (SELECT max(id) FROM ag_catalog.ag_label WHERE graph = <graphid>)
+        + row_number() OVER (ORDER BY name),
+    CASE WHEN name ~ '^[A-Z][a-z]' THEN 'v' ELSE 'e' END,
+    'imbi."' || name || '"',
+    name || '_id_seq'
+FROM unnest(ARRAY[
+    -- paste the tablename list from step 4 here
+]) AS name;
+```
+
+## 6. Verify
+
+```sql
+-- All physical tables should now have catalog entries
+SELECT tablename
+FROM pg_tables
+WHERE schemaname = 'imbi'
+  AND tablename NOT IN (
+    SELECT name FROM ag_catalog.ag_label WHERE graph = <graphid>
+  );
+-- Expected: 0 rows
+```
+
+Restart the application and confirm no `DuplicateTable` errors occur.
+
+---
+
+## Troubleshooting
+
+**`DuplicateTable: relation "X" already exists`**
+The label table exists but is not in `ag_catalog.ag_label`. Run steps 4 and 5.
+
+**`ag_catalog` functions not found**
+The `age` extension is not loaded for the session. Run:
+
+```sql
+LOAD 'age';
+SET search_path = ag_catalog, "$user", public;
+```
+
+**Wrong `kind` assigned to a label**
+Update the catalog entry directly:
+
+```sql
+UPDATE ag_catalog.ag_label SET kind = 'e' WHERE name = 'LABEL_NAME' AND graph = <graphid>;
+```

{imbi_api-2.1.0 → imbi_api-2.5.2}/mkdocs.yml

@@ -63,6 +63,7 @@ markdown_extensions:
 nav:
   - Home: index.md
   - Configuration: configuration.md
+  - Restore Backup: restore-backup.md
   - Architecture Decision Records:
       - Overview: adr.md
       - 0001 Record Architecture Decisions: adr/0001-record-architecture-decisions.md

{imbi_api-2.1.0 → imbi_api-2.5.2}/pyproject.toml

@@ -1,10 +1,6 @@
-[build-system]
-requires = ["build", "hatchling", "wheel"]
-build-backend = "hatchling.build"
-
 [project]
 name = "imbi-api"
-version = "2.1.0"
+version = "2.5.2"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -31,7 +27,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,server]>=0.11.0",
+  "imbi-common[databases,llm,sentry,server]>=2.5.5",
   "jinja2",
   "jsonpatch>=1.33",
   "nanoid>=2.0.0",
@@ -40,6 +36,7 @@ dependencies = [
   "pyotp>=2.9.0",
   "python-multipart>=0.0.26",
   "qrcode>=8.0",
+  "sentry-sdk>=2.48.0",
   "slowapi==0.1.9",  # Pin: alpha quality, API may change
   "typer",
   "uvicorn",
@@ -47,6 +44,9 @@ dependencies = [
 ]
 license-file = "LICENSE"
 
+[project.scripts]
+imbi-api = "imbi_api.entrypoint:main"
+
 [project.optional-dependencies]
 otel = [
   "opentelemetry-distro",
@@ -57,8 +57,36 @@ otel = [
 ]
 sentry = ["sentry-sdk"]
 
-[project.scripts]
-imbi-api = "imbi_api.entrypoint:main"
+[dependency-groups]
+dev = [
+  "basedpyright",
+  "build",
+  "coverage[toml]",
+  "httpx",
+  "mypy",
+  "pre-commit",
+  "pytest",
+  "pytest-cov",
+  "ruff",
+  "watchfiles"
+]
+docs = [
+  "griffe-pydantic",
+  "mkdocs>=1.5,<2",
+  "mkdocs-material>9.5,<10",
+  "mkdocstrings-python-xref>=1.6,<2",
+  "mkdocstrings[python]"
+]
+plugins = [
+  "imbi-plugin-aws>=1.0.0",
+  "imbi-plugin-github>=1.0.0",
+  "imbi-plugin-logzio>=1.0.0",
+  "imbi-plugin-oidc>=1.0.0",
+]
+
+[build-system]
+requires = ["build", "hatchling", "wheel"]
+build-backend = "hatchling.build"
 
 [tool.coverage.html]
 directory = "build/coverage"
@@ -126,6 +154,7 @@ reportAttributeAccessIssue = "none"
 reportCallIssue = "none"
 reportMissingParameterType = "none"
 reportMissingTypeArgument = "none"
+reportMissingTypeStubs = "none"
 reportOptionalMemberAccess = "none"
 reportOptionalSubscript = "none"
 reportPrivateUsage = "none"
@@ -138,12 +167,12 @@ reportUnusedFunction = "none"
 extraPaths = ["src", "."]
 
 [tool.pytest.ini_options]
-testpaths = ["tests"]
 addopts = [
   "--cov=src/imbi_api",
   "--cov-report=xml:build/coverage.xml",
   "--cov-report=term",
 ]
+testpaths = ["tests"]
 
 [tool.ruff]
 line-length = 79
@@ -191,33 +220,9 @@ max-complexity = 15
 [tool.ruff.lint.per-file-ignores]
 "tests/**/*.py" = ["S"]
 
-[dependency-groups]
-dev = [
-  "basedpyright",
-  "build",
-  "coverage[toml]",
-  "httpx",
-  "mypy",
-  "pre-commit",
-  "pytest",
-  "pytest-cov",
-  "ruff",
-  "watchfiles"
-]
-docs = [
-  "griffe-pydantic",
-  "mkdocs>=1.5,<2",
-  "mkdocs-material>9.5,<10",
-  "mkdocstrings-python-xref>=1.6,<2",
-  "mkdocstrings[python]"
-]
-plugins = [
-  "imbi-plugin-aws>=1.0.0",
-  "imbi-plugin-github>=1.0.0",
-  "imbi-plugin-logzio>=1.0.0",
-  "imbi-plugin-oidc>=1.0.0",
-]
-
 [[tool.uv.index]]
 url = "https://pypi.org/simple"
 default = true
+
+[tool.uv.sources]
+imbi-plugin-github = { path = "../imbi-plugin-github", editable = true }

{imbi_api-2.1.0 → imbi_api-2.5.2}/src/imbi_api/app.py

@@ -3,7 +3,7 @@ import logging
 import fastapi
 from fastapi import responses
 from fastapi.middleware import cors
-from imbi_common import access_log, graph, lifespan, valkey
+from imbi_common import access_log, graph, lifespan, sentry, valkey
 from imbi_common.plugins.errors import PluginCredentialsMissing
 from uvicorn.middleware import proxy_headers
 
@@ -17,6 +17,7 @@ def create_app() -> fastapi.FastAPI:
     app = fastapi.FastAPI(
         title='Imbi',
         lifespan=lifespan.Lifespan(
+            sentry.sentry_lifespan,
             lifespans.clickhouse_hook,
             graph.graph_lifespan,
             lifespans.email_hook,

{imbi_api-2.1.0 → imbi_api-2.5.2}/src/imbi_api/auth/permissions.py

@@ -21,6 +21,13 @@ LOGGER = logging.getLogger(__name__)
 oauth2_scheme = security.HTTPBearer(auto_error=False)
 
 
+class IdentityInfo(pydantic.BaseModel):
+    """A single third-party identity connection for an authenticated user."""
+
+    plugin_slug: str
+    subject: str
+
+
 class AuthContext(pydantic.BaseModel):
     """Authentication context for the current request."""
 
@@ -29,6 +36,14 @@ class AuthContext(pydantic.BaseModel):
     session_id: str | None = None
     auth_method: typing.Literal['jwt', 'api_key', 'client_credentials']
     permissions: set[str] = pydantic.Field(default_factory=set)
+    identities: list[IdentityInfo] = pydantic.Field(default_factory=list)
+
+    def identity_for(self, plugin_slug: str) -> str | None:
+        """Return the subject for the given plugin_slug, or None."""
+        for i in self.identities:
+            if i.plugin_slug == plugin_slug:
+                return i.subject
+        return None
 
     @property
     def principal_name(self) -> str:
@@ -134,6 +149,47 @@ async def load_principal_permissions(
     return set()
 
 
+async def _load_user_identities(
+    db: graph.Graph,
+    user_id: str,
+) -> list[IdentityInfo]:
+    """Return active third-party identity connections for the user.
+
+    Identity enrichment is auxiliary — authentication has already
+    succeeded by the time this runs.  A failure here (DB hiccup,
+    AGType parse error) must not turn a valid token into a 5xx, so
+    all exceptions are caught, logged, and treated as "no identities".
+    """
+    query: typing.LiteralString = """
+    MATCH (u:User {{id: {user_id}}})-[:HAS_IDENTITY]->(c:IdentityConnection)
+    WHERE c.status = 'active'
+    OPTIONAL MATCH (c)-[:USES_PLUGIN]->(p:Plugin)
+    RETURN p.plugin_slug AS plugin_slug, c.subject AS subject
+    """
+    try:
+        records = await db.execute(
+            query,
+            {'user_id': user_id},
+            ['plugin_slug', 'subject'],
+        )
+        result: list[IdentityInfo] = []
+        for row in records:
+            plugin_slug = graph.parse_agtype(row['plugin_slug'])
+            subject = graph.parse_agtype(row['subject'])
+            if plugin_slug and subject:
+                result.append(
+                    IdentityInfo(plugin_slug=plugin_slug, subject=subject)
+                )
+        return result
+    except Exception:  # noqa: BLE001
+        LOGGER.warning(
+            'Failed to load identity connections for user_id=%s',
+            user_id,
+            exc_info=True,
+        )
+        return []
+
+
 async def authenticate_jwt(
     db: graph.Graph,
     token: str,
@@ -237,15 +293,44 @@ async def authenticate_jwt(
 
     # Load permissions
     perms = await load_principal_permissions(db, 'User', 'email', subject)
+    identities = await _load_user_identities(db, user.id)
 
     return AuthContext(
         user=user,
         session_id=jti,
         auth_method='jwt',
         permissions=perms,
+        identities=identities,
     )
 
 
+async def _stamp_api_key_last_used(db: graph.Graph, key_id: str) -> None:
+    """Set last_used on the APIKey node identified by key_id.
+
+    AGE's cypher() wrapper requires a RETURN clause to properly
+    finalize a write operation — omitting it causes an internal
+    "Entity failed to be updated" error. Failures are logged and
+    swallowed: the stamp is best-effort and must not fail authentication.
+    """
+    now = datetime.datetime.now(datetime.UTC).isoformat()
+    query: typing.LiteralString = (
+        'MATCH (k:APIKey {{key_id: {key_id}}})'
+        ' SET k.last_used = {now} RETURN k'
+    )
+    try:
+        await db.execute(
+            query,
+            {'key_id': key_id, 'now': now},
+            columns=['k'],
+        )
+    except Exception:  # noqa: BLE001
+        LOGGER.warning(
+            'Failed to stamp last_used for API key %s',
+            key_id,
+            exc_info=True,
+        )
+
+
 async def authenticate_api_key(
     db: graph.Graph,
     key: str,
@@ -349,11 +434,7 @@ async def authenticate_api_key(
         filtered = all_perms.intersection(set(scopes)) if scopes else all_perms
 
         # Update last_used only after all validation passes
-        now = datetime.datetime.now(datetime.UTC).isoformat()
-        update_query = (
-            'MATCH (k:APIKey {{key_id: {key_id}}}) SET k.last_used = {now}'
-        )
-        await db.execute(update_query, {'key_id': key_id, 'now': now})
+        await _stamp_api_key_last_used(db, key_id)
 
         return AuthContext(
             service_account=sa,
@@ -372,19 +453,17 @@ async def authenticate_api_key(
         db, 'User', 'email', user.email
     )
     filtered = all_perms.intersection(set(scopes)) if scopes else all_perms
+    identities = await _load_user_identities(db, user.id)
 
     # Update last_used only after all validation passes
-    now = datetime.datetime.now(datetime.UTC).isoformat()
-    update_query = (
-        'MATCH (k:APIKey {{key_id: {key_id}}}) SET k.last_used = {now}'
-    )
-    await db.execute(update_query, {'key_id': key_id, 'now': now})
+    await _stamp_api_key_last_used(db, key_id)
 
     return AuthContext(
         user=user,
         session_id=key_id,
         auth_method='api_key',
         permissions=filtered,
+        identities=identities,
     )
 
 

{imbi_api-2.1.0 → imbi_api-2.5.2}/src/imbi_api/auth/seed.py

@@ -365,6 +365,13 @@ STANDARD_PERMISSIONS: list[tuple[str, str, str, str]] = [
         'deployment:write',
         'Trigger deployments and promotions via plugins',
     ),
+    # Vector search
+    (
+        'search:read',
+        'search',
+        'read',
+        'Search nodes by semantic similarity',
+    ),
     # Identity plugin connections
     (
         'me:identities:manage',
@@ -436,6 +443,7 @@ DEFAULT_ROLES: list[tuple[str, str, str, int, list[str], bool]] = [
             'document:delete',
             'document_template:read',
             'me:identities:manage',
+            'search:read',
         ],
         False,
     ),
@@ -456,6 +464,7 @@ DEFAULT_ROLES: list[tuple[str, str, str, int, list[str], bool]] = [
             'project:read',
             'project_type:read',
             'role:read',
+            'search:read',
             'tag:read',
             'team:read',
             'third_party_service:read',
@@ -478,6 +487,7 @@ DEFAULT_ROLES: list[tuple[str, str, str, int, list[str], bool]] = [
             'project:read',
             'project_type:read',
             'organization:read',
+            'search:read',
             'team:read',
             'third_party_service:read',
             'user:read',

imbi_api-2.5.2/src/imbi_api/backfill_embeddings.py

@@ -0,0 +1,78 @@
+"""One-shot backfill: generate embeddings for all existing nodes.
+
+Run with:
+    uv run python -m imbi_api.backfill_embeddings
+
+Iterates every embeddable node type and calls _auto_embed for each
+instance that doesn't already have embeddings (or re-embeds if the
+stored vectors are stale).
+"""
+
+import asyncio
+import logging
+
+from imbi_common import graph, models
+from imbi_common.graph.client import (
+    _embeddable_fields,  # type: ignore[attr-defined]
+)
+
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s %(levelname)-8s %(name)s: %(message)s',
+)
+LOGGER = logging.getLogger('backfill_embeddings')
+
+# Node subclasses — _auto_embed is called normally.
+_NODE_TYPES: list[type[models.Node]] = [
+    models.Organization,
+    models.Blueprint,
+    models.Team,
+    models.Environment,
+    models.ProjectType,
+    models.ThirdPartyService,
+    models.Tag,
+    models.LinkDefinition,
+    models.DocumentTemplate,
+    models.Project,
+]
+
+# GraphModel types that have Embeddable fields but are not Node subclasses.
+# match() still works via model_construct fallback; _auto_embed accepts any
+# GraphModel even though its type annotation says Node.
+_GRAPH_MODEL_TYPES: list[type[models.GraphModel]] = [
+    models.Document,
+]
+
+
+async def _embed_type(
+    db: graph.Graph,
+    node_type: type[models.GraphModel],
+) -> int:
+    nodes = await db.match(node_type)  # type: ignore[arg-type]
+    count = 0
+    for node in nodes:
+        if not _embeddable_fields(node):  # type: ignore[arg-type]
+            continue
+        await db._auto_embed(node)  # type: ignore[arg-type]
+        count += 1
+    return count
+
+
+async def run() -> None:
+    db = graph.Graph()
+    await db.open()
+    try:
+        total = 0
+        for node_type in [*_NODE_TYPES, *_GRAPH_MODEL_TYPES]:
+            label = node_type.__name__
+            LOGGER.info('Embedding %s nodes...', label)
+            n = await _embed_type(db, node_type)
+            LOGGER.info('  %s: %d nodes embedded', label, n)
+            total += n
+        LOGGER.info('Done. Total nodes embedded: %d', total)
+    finally:
+        await db.close()
+
+
+if __name__ == '__main__':
+    asyncio.run(run())

{imbi_api-2.1.0 → imbi_api-2.5.2}/src/imbi_api/domain/models.py

@@ -858,10 +858,17 @@ class PluginAssignmentCreate(pydantic.BaseModel):
     """Request model for assigning a plugin to a project-type or project."""
 
     plugin_id: str
-    tab: typing.Literal['configuration', 'logs', 'deployment']
+    tab: typing.Literal['configuration', 'logs', 'deployment', 'lifecycle']
     default: bool = False
     options: dict[str, typing.Any] = pydantic.Field(default_factory=dict)
     identity_plugin_id: str | None = None
+    # Per-env workflow-input overrides keyed by env slug.  Merged into
+    # the deploy / promote dispatch payload at trigger time.  Sibling
+    # to ``options`` (which is plugin-level) because the axis is the
+    # *environment* being deployed into, not the plugin's own config.
+    env_payloads: dict[str, dict[str, typing.Any]] = pydantic.Field(
+        default_factory=dict,
+    )
 
 
 class PluginAssignmentResponse(pydantic.BaseModel):
@@ -870,17 +877,25 @@ class PluginAssignmentResponse(pydantic.BaseModel):
     plugin_id: str
     plugin_slug: str
     label: str
-    tab: typing.Literal['configuration', 'logs', 'deployment']
+    tab: typing.Literal['configuration', 'logs', 'deployment', 'lifecycle']
     default: bool
     options: dict[str, typing.Any] = {}
     source: typing.Literal['project', 'project_type', 'merged'] = (
         'project_type'
     )
     identity_plugin_id: str | None = None
+    env_payloads: dict[str, dict[str, typing.Any]] = pydantic.Field(
+        default_factory=dict,
+    )
     # Pulled from the plugin manifest so the UI can hide affordances
     # (e.g. the histogram strip on the Logs tab) for plugins whose
     # underlying API does not support them.
     supports_histogram: bool = False
+    # Set on deployment plugins that implement
+    # ``list_recent_deployments`` -- gates the "Resync deployments"
+    # card on the project settings page (and the admin TPS page) so
+    # the UI doesn't surface a button that the API will 400 on.
+    supports_deployment_sync: bool = False
 
 
 # -- Configuration / Logs response models ---------------------------------