imbi-api 2.11.6__tar.gz → 2.12.2__tar.gz

{imbi_api-2.11.6 → imbi_api-2.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-api
-Version: 2.11.6
+Version: 2.12.2
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -20,7 +20,7 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,sentry,server]==2.11.6
+Requires-Dist: imbi-common[databases,llm,sentry,server]==2.12.2
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: mcp>=1.26.0
@@ -42,13 +42,6 @@ Requires-Dist: opentelemetry-instrumentation-asyncio; extra == 'otel'
 Requires-Dist: opentelemetry-instrumentation-fastapi; extra == 'otel'
 Requires-Dist: opentelemetry-instrumentation-httpx; extra == 'otel'
 Requires-Dist: opentelemetry-instrumentation-jinja2; extra == 'otel'
-Provides-Extra: plugins
-Requires-Dist: imbi-plugin-aws>=2.1.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-github>=2.1.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-logzio>=2.1.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-oidc>=2.1.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-pagerduty>=2.1.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-sonarqube>=2.1.0; extra == 'plugins'
 Provides-Extra: sentry
 Requires-Dist: sentry-sdk; extra == 'sentry'
 Description-Content-Type: text/markdown

imbi_api-2.12.2/docs/adr/0016-delegated-execution-for-scheduled-jobs.md

@@ -0,0 +1,261 @@
+# ADR 0016: Delegated Execution for Scheduled Jobs
+
+Date: 2026-06-29
+
+## Status
+
+Accepted
+
+Implementation is phased; the full design lives in
+[`imbi/docs/imbi-scheduler-functional-spec.md`](https://github.com/AWeber-Imbi/imbi/blob/main/docs/imbi-scheduler-functional-spec.md).
+This ADR records the `imbi-api`-side decision only — the new delegation
+primitive and the migration of the in-process scheduled loops off the API
+process. The standalone `imbi-scheduler` service itself is a separate repo and
+not in scope for this ADR log.
+
+## Context
+
+Imbi has grown to need general-purpose scheduled execution, and the platform
+has accumulated scheduling-like behavior in an ad-hoc way:
+
+1. **No general scheduler exists.** There is no APScheduler, cron daemon, job
+   registry, or recurring-job domain model anywhere in the stack. The graph
+   vlabel set (`imbi_common/graph/schemata.toml`) has no `Schedule`/`Job`/
+   `Task`/`Trigger` label. `pg_cron` is preloaded and `CREATE EXTENSION`'d but
+   unused.
+
+2. **The only existing "scheduled" job is hand-rolled.** `imbi_api/scoring/
+   queue.py:451-510` (`run_daily_tick`) is a polling loop on `asyncio.sleep`
+   that fires once per UTC day at `DAILY_TICK_HOUR_UTC=6`, using a Valkey
+   `SETNX` 25h-TTL lock keyed `imbi:score-recompute:daily:<date>` for
+   cross-worker single-firing, then enqueues every project for
+   `scheduled_recompute`. It is hardcoded to one task and not generalizable.
+   Three more in-process consumer loops (commit-sync, PR-sync,
+   identity-sweeper) are wired through `lifespans.py` and run inside the API
+   process.
+
+3. **`imbi-automations` is a one-shot CLI, not a scheduler.** It runs workflow
+   TOMLs across projects when invoked manually (`just run <workflow>`); it has
+   no recurring-execution capability. The missing piece is a trigger layer.
+
+4. **Planned features need scheduling.** Dynamic blueprint-field
+   recalculation (e.g. `min(date) where foo = bar` over an applied blueprint
+   field) requires periodic re-evaluation. There is no mechanism to schedule
+   that today.
+
+The platform has decided to introduce a **standalone `imbi-scheduler` service**
+(APScheduler 4.x, owning its own job store and run history) that triggers
+`imbi-api` REST calls on schedules. See the functional spec for that service's
+design; this ADR covers what `imbi-api` must provide for it to work.
+
+The hard requirement that drives this ADR: scheduled jobs must be able to
+**execute as the scheduling user** — i.e. with that user's identity and
+permissions, including resource-level `CAN_ACCESS` ACLs — and also as the
+scheduler's own service account for system jobs.
+
+The blocker: **`imbi-api` has no impersonation or delegation primitive.**
+`AuthContext` (`auth/permissions.py:43-86`) is always the principal that
+presented the token. Service accounts cannot use resource-level ACLs
+(`permissions.py:907-913` — the `CAN_ACCESS` fallback is `auth.user`-only),
+and admin bypass is `User`-only (`permissions.py:745`). There is no "act on
+behalf of" path, no `act`/`azp` claim, and no consent model. So "run as a user"
+cannot be satisfied by any existing mechanism.
+
+## Decision
+
+Add a **delegated-execution primitive** to `imbi-api` based on OAuth2 token
+exchange (RFC 8693), plus a **consent model**, so the scheduler can obtain
+short-lived JWTs scoped to a target user. The scheduler holds no user
+secrets.
+
+### 1. Token-exchange grant
+
+Add a branch to `POST /auth/token` (`endpoints/auth.py:325-499`) for:
+
+```
+grant_type        = urn:ietf:params:oauth:grant-type:token-exchange
+subject_token     = <scheduler SA client-credential JWT>   (or client_id+secret)
+requested_subject = <target user email>
+scope             = <scope covered by a Consent>
+```
+
+`imbi-api` validates that (a) the scheduler SA is authenticated and holds the
+new `auth:delegate` permission, (b) a non-expired, non-revoked `Consent`
+exists for `(user, 'imbi-scheduler', scope ⊇ requested)`, and (c) the target
+user is active. It then mints a short-lived access JWT via
+`imbi_common.auth.core.create_access_token` carrying:
+
+```
+sub          = <target user email>
+auth_method  = 'token_exchange'
+act          = { client_id: <scheduler SA> }   # RFC 8693 `act` claim
+azp          = <scheduler SA slug>
+scope        = <granted scope>
+jti          = new; TokenMetadata node ISSUED_TO the user, linked to the SA
+```
+
+### 2. Consent model
+
+Add a **`Consent`** graph node recording that a user authorized the scheduler
+to act on their behalf for a scope. `Consent` is recorded under the **user's
+own** authenticated session (the scheduler passes the user's JWT through when
+creating a schedule), so `imbi-api` attributes consent to the real user — the
+scheduler never records consent on a user's behalf:
+
+```
+Consent:
+  user_email, actor_sa ('imbi-scheduler'), scope,
+  created_at, expires_at?, revoked_at?
+```
+
+Endpoints: `POST /consents` (records under caller identity), `GET /consents`,
+`DELETE /consents/{id}` (revoke). v1 uses one broad scope (`imbi-api:*`) per
+user; finer per-resource-type scopes are a deferred refinement.
+
+### 3. `AuthContext.actor`
+
+`AuthContext` gains an `actor: ServiceAccount | None` field populated when
+`auth_method == 'token_exchange'`. Permission resolution uses the **user's**
+permissions (including `CAN_ACCESS` resource ACLs — the whole point of
+delegation). `principal_name` remains the user; a new `actor_name` property
+returns the scheduler SA. Audit/`requested_by`-style attribution records
+`"{user} on behalf of {actor}"`. The `act`/`azp` claim is verified on every
+request, not only at exchange.
+
+### 4. New permission & service account
+
+Seed a new `auth:delegate` permission. Provision an `imbi-scheduler` service
+account (`POST /service-accounts`) with a client credential
+(`POST /service-accounts/{slug}/client-credentials`) whose role grants
+`auth:delegate` plus the global permissions each system job needs (resource
+ACLs are user-only, so system jobs require global perms — document the set
+per migrated task). System jobs authenticate directly with the SA's
+client-credential JWT (refreshed proactively, the
+`imbi-automations/clients/imbi.py:_AuthManager` pattern); user jobs exchange
+for a delegated token at fire time.
+
+### 5. Migrate the score-recompute daily tick
+
+Externalize the trigger of `run_daily_tick` to the scheduler; **keep the
+worker/queue logic in `imbi-api`** (the `imbi:score-recompute` Valkey-stream
+consumer stays). Concretely: expose (or reuse) an HTTP trigger —
+`POST /api/scoring/recompute-all` guarded by a new
+`scoring:trigger-scheduled` (or `scoring:recompute`) permission — that
+enqueues every project with reason `scheduled_recompute`. Remove
+`run_daily_tick` and its task from `score_worker_hook`
+(`lifespans.py:202-237`); keep `consume_recompute`. The scheduler seeds a
+system schedule `0 6 * * *` → `POST /api/scoring/recompute-all`. The Valkey
+per-date `SETNX` dedupe lock is no longer needed (APScheduler's shared data
+store guarantees single firing across replicas); the existing per-project
+debounce + idempotency in `enqueue_recompute` remains as a backstop.
+
+The remaining in-process loops (identity-token sweeper, commit/PR-sync pause
+sweeps) are assessed per-task as follow-ups; only score recompute is in the
+first cut.
+
+## Alternatives Considered
+
+### A. Per-user API keys stored by the scheduler
+
+Users mint `ik_…` API keys and register them with the scheduler, which stores
+them encrypted and replays them at fire time. **Rejected:** the scheduler
+becomes a custodian of long-lived user secrets; keys don't expire unless
+rotated; revocation is manual and scattered; and it conflates "a credential
+the user happened to create" with "an authorization to act." Token exchange
+keeps secrets server-side and makes consent an explicit, revocable record.
+
+### B. Run everything as a service account with `requested_by` attribution only
+
+Every job runs as the scheduler SA; the originating user is recorded as
+`requested_by`/`actor` for audit only, not as the security principal.
+**Rejected for user jobs:** this does not satisfy "execute as them." The job
+would run with the SA's global permissions and could not pass resource-level
+`CAN_ACCESS` checks, so a user-scheduled job targeting a resource they can
+access but the SA cannot would 403. This remains the model for **system**
+jobs, where it is correct.
+
+### C. `pg_cron` driving DB-side jobs
+
+The Postgres image already loads `pg_cron`. **Rejected as the primary
+engine:** it can only run SQL, not call arbitrary `imbi-api` endpoints or
+speak the auth/delegation flow, and it couples scheduling to the database
+process. It may still be useful for pure-SQL maintenance later, but it is not
+the general scheduler. The standalone APScheduler service is the engine.
+
+### D. Build the scheduler inside `imbi-api` (in-process)
+
+Add APScheduler to `imbi-api` and run schedules as a lifespan loop, reusing
+the existing auth context directly. **Rejected:** the platform has
+explicitly chosen a standalone scheduler repo (separable deploy/scaling,
+independent failure domain, and a clean home for run-history that does not
+belong in the graph). The delegation primitive is precisely what lets a
+separate service run as a user safely.
+
+## Consequences
+
+### Positive
+
+- **True run-as-user.** Delegated JWTs run with the user's full permissions,
+  including resource ACLs that service accounts cannot use — the capability
+  that did not exist before.
+- **No stored user secrets.** The scheduler stores a `consent_id`, not user
+  tokens or passwords. The decisive security advantage over per-user keys.
+- **Explicit, revocable authorization.** Consent is a first-class, auditable
+  graph node; revoking a schedule or consent stops future exchanges.
+- **Short-lived, revocable delegated tokens** with `jti`-tracked
+  `TokenMetadata`, reusing the existing revocation machinery.
+- **General scheduler replaces a hand-rolled loop.** The score daily tick
+  becomes one cron entry; future scheduled work (dynamic field recalculation,
+  `imbi-automations` triggers) has a home.
+- **Attribution is honest.** `actor_name` + `principal_name` make "who caused
+  this and on whose behalf" explicit in logs and audit.
+
+### Negative
+
+- **New grant type + `AuthContext.actor` + `Consent` model is real surface
+  area** in `imbi-api`: auth is the most security-sensitive part of the
+  system, and this touches `authenticate_jwt`, token issuance, and the
+  permissions module. Requires thorough tests (consent required, scope
+  checked, short-lived, revocable, `act`/`azp` verified on every request).
+- **Two systems must agree on consent lifecycle.** The scheduler stores
+  `consent_id`; `imbi-api` owns the `Consent` node. A revoked/consent or
+  deleted schedule must suppress firings (the scheduler re-checks consent
+  before each exchange and treats a failed exchange as a `skipped` run).
+- **System jobs need global permissions.** Because resource ACLs are
+  user-only, every system job's SA role must hold the global permission for
+  the endpoint it calls. This widens the scheduler SA's blast radius; it is
+  mitigated by scoping the role to exactly the trigger endpoints and by
+  preferring delegated (user) jobs where the action is user-scoped.
+- **Migration moves a working path.** The score daily tick works today; moving
+  it introduces a transitional risk. Mitigated by keeping per-day idempotency
+  so a double-fire is harmless even before APScheduler's single-firing
+  guarantee applies.
+
+### Risks Accepted
+
+- **Broad v1 consent scope (`imbi-api:*`).** A consenting user authorizes the
+  scheduler to call any `imbi-api` endpoint as them. Acceptable for an
+  internal, admin-curated platform for v1; finer scopes are an explicit
+  follow-up (functional spec §15).
+- **Delegated token lifetime (5–15 min).** Chosen short; a job making many
+  calls reuses the token until expiry then re-exchanges. Not a refresh-token
+  family for v1.
+- **Target-path allow-listing deferred.** v1 allows arbitrary `imbi-api`
+  method+path as a job target. If abuse becomes a concern, restrict to an
+  allow-list per scope (functional spec §12).
+
+## References
+
+- [`imbi/docs/imbi-scheduler-functional-spec.md`](https://github.com/AWeber-Imbi/imbi/blob/main/docs/imbi-scheduler-functional-spec.md)
+  — Full scheduler service design, data model, REST API, and phased plan.
+- ADR 0002: Authentication and Authorization Architecture (the auth system
+  this extends — JWTs, service accounts, API keys, permission model).
+- [RFC 8693: OAuth 2.0 Token Exchange](https://datatracker.ietf.org/doc/html/rfc8693)
+  — `act`/`azp` claims and the token-exchange grant type.
+- `imbi_api/auth/permissions.py:43-86,306-417,907-913` — `AuthContext`,
+  `authenticate_jwt`, and the user-only `CAN_ACCESS` fallback that motivates
+  delegation.
+- `imbi_api/scoring/queue.py:451-510` and `imbi_api/lifespans.py:202-237` —
+  the `run_daily_tick` loop being externalized.
+- `imbi-automations/src/imbi_automations/clients/imbi.py:87-180` — the
+  `_AuthManager` reference pattern for SA client-credential refresh.

{imbi_api-2.11.6 → imbi_api-2.12.2}/docs/adr.md

@@ -285,6 +285,37 @@ Replaces hand-coded per-plugin entity routers (e.g., `aws_accounts.py`) with a g
 
 ---
 
+### Operations & Integrations
+
+#### [ADR 0015: CycloneDX 1.7 as the SBoM Standard](adr/0015-cyclonedx-1.7-sbom-standard.md)
+
+*Date: 2026-05-27 | Status: Accepted*
+
+Standardizes the SBoM spec version accepted on `PUT .../releases/{id}/sbom` and the recommended producer for build CI.
+
+**Key Decisions:**
+
+- Accept CycloneDX 1.7 on the wire (1.5/1.6 silently drop fields Imbi reads)
+- Single recommended producer that covers the polyglot service population and emits the per-component metadata needed for `ReleaseComponentEdge` `scope`/`groups`
+
+---
+
+#### [ADR 0016: Delegated Execution for Scheduled Jobs](adr/0016-delegated-execution-for-scheduled-jobs.md)
+
+*Date: 2026-06-29 | Status: Accepted*
+
+Adds an OAuth2 token-exchange (RFC 8693) delegation primitive plus a `Consent` model so the standalone `imbi-scheduler` service can run scheduled jobs as a user, and externalizes the score-recompute daily tick off the API process.
+
+**Key Decisions:**
+
+- New `urn:ietf:params:oauth:grant-type:token-exchange` grant minting short-lived JWTs with `sub=<user>` and an `act`/`azp` claim naming the scheduler SA
+- `Consent` graph node recorded under the user's own session; scheduler stores no user secrets
+- `AuthContext.actor` field + `actor_name`; permission resolution uses the user's permissions (including user-only `CAN_ACCESS` ACLs)
+- New `auth:delegate` permission and `imbi-scheduler` service account; system jobs use the SA directly
+- Score-recompute daily tick (`run_daily_tick`) moves to a scheduler-owned cron; the Valkey-stream consumer stays in `imbi-api`
+
+---
+
 ## ADR Format
 
 Our ADRs follow this structure:

{imbi_api-2.11.6 → imbi_api-2.12.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.11.6"
+version = "2.12.2"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,sentry,server]==2.11.6",
+  "imbi-common[databases,llm,sentry,server]==2.12.2",
   "jinja2",
   "jsonpatch>=1.33",
   "mcp>=1.26.0",
@@ -57,14 +57,6 @@ otel = [
   "opentelemetry-instrumentation-httpx",
   "opentelemetry-instrumentation-jinja2",
 ]
-plugins = [
-  "imbi-plugin-aws>=2.1.0",
-  "imbi-plugin-github>=2.1.0",
-  "imbi-plugin-logzio>=2.1.0",
-  "imbi-plugin-oidc>=2.1.0",
-  "imbi-plugin-pagerduty>=2.1.0",
-  "imbi-plugin-sonarqube>=2.1.0"
-]
 sentry = ["sentry-sdk"]
 
 [dependency-groups]
@@ -231,7 +223,7 @@ max-complexity = 15
 
 [tool.uv]
 exclude-newer = "7 days"
-exclude-newer-package = { "clickhouse-connect" = false, "imbi-common" = false, "imbi-plugin-aws" = false, "imbi-plugin-github" = false, "imbi-plugin-logzio" = false, "imbi-plugin-oidc" = false, "imbi-plugin-pagerduty" = false, "imbi-plugin-sentry" = false, "imbi-plugin-sonarqube" = false }
+exclude-newer-package = { "clickhouse-connect" = false, "imbi-common" = false }
 
 [[tool.uv.index]]
 url = "https://pypi.org/simple"

imbi_api-2.12.2/src/imbi_api/auth/login_providers.py

@@ -0,0 +1,205 @@
+"""Login-provider repository.
+
+Plugin Architecture v3: a login provider is an ``Integration`` whose
+plugin declares an ``identity`` capability with the ``login_capable``
+hint, and whose node carries a direct ``used_as_login=true`` property
+(set by the admin UI when promoting the Integration to a login
+provider). There is exactly one source now -- the legacy
+``ServiceApplication`` / hardcoded ``google``/``github``/``oidc`` rows
+and the separate ``:Plugin`` node lookup are both gone.
+
+A 30s in-memory TTL cache keeps the OAuth hot path off the graph.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+import typing
+
+import pydantic
+from imbi_common import graph
+from imbi_common.plugins import (
+    PluginNotFoundError,
+    decrypt_integration_credentials,
+    get_plugin,
+)
+
+from imbi_api import settings
+from imbi_api.plugins.assignments import (
+    capability_enabled,
+    hydrate_integration,
+)
+
+LOGGER = logging.getLogger(__name__)
+
+_CACHE_TTL_SECONDS = 30.0
+
+_provider_cache: dict[str, tuple[LoginApp, float]] = {}
+_list_cache: dict[bool, tuple[list[LoginApp], float]] = {}
+
+
+class LoginApp(pydantic.BaseModel):
+    """Flat view of a login-eligible Integration.
+
+    Combines the Integration's decrypted OAuth credentials with its
+    ``options`` (issuer URL, OAuth endpoints, etc.) so callers don't
+    need to re-query the graph or decrypt anything themselves.
+    """
+
+    model_config = pydantic.ConfigDict(extra='ignore')
+
+    slug: str
+    name: str
+    integration_id: str
+    #: The plugin's declared ``auth_type`` (``oauth2``, ``oidc``,
+    #: ``aws-iam-ic``, ...), or ``integration.options['oauth_app_type']``
+    #: when the plugin overrides it.
+    oauth_app_type: str
+    client_id: str | None = None
+    client_secret: str | None = None
+    issuer_url: str | None = None
+    allowed_domains: list[str] = pydantic.Field(default_factory=list)
+    scopes: list[str] = pydantic.Field(default_factory=list)
+    status: str = 'active'
+    authorization_endpoint: str | None = None
+    token_endpoint: str | None = None
+    revoke_endpoint: str | None = None
+    callback_url: str = ''
+
+
+def invalidate_cache(slug: str | None = None) -> None:
+    """Drop cached entries.
+
+    ``slug=None`` clears everything; otherwise only the slug + lists.
+    """
+    if slug is None:
+        _provider_cache.clear()
+    else:
+        _provider_cache.pop(slug, None)
+    _list_cache.clear()
+
+
+_LOGIN_INTEGRATIONS_QUERY: typing.LiteralString = """
+MATCH (i:Integration)
+WHERE i.used_as_login = true
+RETURN i
+ORDER BY i.slug
+"""
+
+_LOGIN_INTEGRATION_QUERY: typing.LiteralString = """
+MATCH (i:Integration {{slug: {slug}}})
+WHERE i.used_as_login = true
+RETURN i
+LIMIT 1
+"""
+
+
+def _integration_to_login_app(
+    integration: dict[str, typing.Any],
+) -> LoginApp | None:
+    """Materialize a ``LoginApp`` from a hydrated Integration, or
+    ``None`` when its plugin doesn't declare a login-capable identity
+    capability or the capability is disabled."""
+    plugin_slug = str(integration.get('plugin') or '')
+    try:
+        entry = get_plugin(plugin_slug)
+    except PluginNotFoundError:
+        return None
+    capability = entry.manifest.get_capability('identity')
+    if capability is None or not capability.hints.get('login_capable'):
+        return None
+    if not capability_enabled(integration, 'identity'):
+        return None
+
+    # An Integration with no stable ``id`` cannot back a login flow
+    # (``load_integration`` matches on ``id``); skip it rather than let a
+    # single malformed node 500 the whole login page.
+    integration_id = integration.get('id')
+    if not integration_id:
+        LOGGER.warning(
+            'Integration %r is marked used_as_login but has no id; skipping',
+            integration.get('slug'),
+        )
+        return None
+
+    options = typing.cast(
+        'dict[str, typing.Any]', integration.get('options') or {}
+    )
+    credentials = decrypt_integration_credentials(
+        typing.cast(
+            'dict[str, str]', integration.get('encrypted_credentials') or {}
+        )
+    )
+    slug = str(integration['slug'])
+    return LoginApp(
+        slug=slug,
+        name=str(integration.get('name') or slug),
+        integration_id=str(integration_id),
+        oauth_app_type=str(
+            options.get('oauth_app_type') or entry.manifest.auth_type
+        ),
+        client_id=credentials.get('client_id'),
+        client_secret=credentials.get('client_secret'),
+        issuer_url=options.get('issuer_url'),
+        allowed_domains=list(options.get('allowed_domains') or []),
+        scopes=list(options.get('scopes') or []),
+        status=str(integration.get('status') or 'active'),
+        authorization_endpoint=options.get('authorization_endpoint'),
+        token_endpoint=options.get('token_endpoint'),
+        revoke_endpoint=options.get('revoke_endpoint'),
+        callback_url=settings.oauth_callback_url(slug),
+    )
+
+
+async def list_login_apps(
+    db: graph.Graph,
+    *,
+    enabled_only: bool = False,
+) -> list[LoginApp]:
+    """Return every login-eligible Integration.
+
+    Cached per ``enabled_only`` for ``_CACHE_TTL_SECONDS``.
+    """
+    cached = _list_cache.get(enabled_only)
+    now = time.time()
+    if cached is not None and (now - cached[1]) < _CACHE_TTL_SECONDS:
+        return list(cached[0])
+
+    records = await db.execute(_LOGIN_INTEGRATIONS_QUERY, {}, ['i'])
+    apps: list[LoginApp] = []
+    for record in records:
+        props: typing.Any = graph.parse_agtype(record['i'])
+        if not isinstance(props, dict):
+            continue
+        typed_props = typing.cast('dict[str, typing.Any]', props)
+        login_app = _integration_to_login_app(hydrate_integration(typed_props))
+        if login_app is None:
+            continue
+        if enabled_only and login_app.status != 'active':
+            continue
+        apps.append(login_app)
+
+    _list_cache[enabled_only] = (list(apps), now)
+    return apps
+
+
+async def get_login_app(db: graph.Graph, slug: str) -> LoginApp | None:
+    """Look up a single login app by Integration slug."""
+    cached = _provider_cache.get(slug)
+    now = time.time()
+    if cached is not None and (now - cached[1]) < _CACHE_TTL_SECONDS:
+        return cached[0]
+
+    records = await db.execute(_LOGIN_INTEGRATION_QUERY, {'slug': slug}, ['i'])
+    if not records:
+        return None
+    props: typing.Any = graph.parse_agtype(records[0]['i'])
+    if not isinstance(props, dict):
+        return None
+    typed_props = typing.cast('dict[str, typing.Any]', props)
+    login_app = _integration_to_login_app(hydrate_integration(typed_props))
+    if login_app is None:
+        return None
+    _provider_cache[slug] = (login_app, now)
+    return login_app

{imbi_api-2.11.6 → imbi_api-2.12.2}/src/imbi_api/auth/models.py

@@ -53,7 +53,7 @@ class OAuthStateData(pydantic.BaseModel):
     * ``intent`` discriminates ``'login'`` from ``'identity'``.  Login
       flows still create the local user; identity flows persist an
       :class:`imbi_common.models.IdentityConnection` for the actor.
-    * ``plugin_id`` names the target identity plugin (or ``None`` for
+    * ``integration_id`` names the target Integration (or ``None`` for
       the legacy hardcoded login providers).
     * ``code_verifier`` carries the PKCE verifier through the redirect
       so we don't need server-side state for in-flight flows.
@@ -72,7 +72,7 @@ class OAuthStateData(pydantic.BaseModel):
     redirect_uri: str  # Where to redirect after auth
     timestamp: int  # Unix timestamp for expiry
     intent: typing.Literal['login', 'identity'] = 'login'
-    plugin_id: str | None = None
+    integration_id: str | None = None
     code_verifier: str | None = None
     return_to: str | None = None
     actor_user_id: str | None = None

{imbi_api-2.11.6 → imbi_api-2.12.2}/src/imbi_api/auth/oauth.py

@@ -13,7 +13,6 @@ from urllib import parse as urlparse
 import httpx
 import jwt
 from imbi_common import graph
-from imbi_common.auth import encryption
 from valkey import asyncio as valkey_module
 
 from imbi_api import settings
@@ -279,7 +278,7 @@ async def exchange_oauth_code(
     """Exchange OAuth authorization code for tokens.
 
     Args:
-        slug: ServiceApplication slug for the login provider
+        slug: Login-Integration slug
         code: Authorization code from provider
         redirect_uri: Redirect URI used in authorization request
         db: Graph database used to look up provider configuration
@@ -327,7 +326,7 @@ async def fetch_oauth_profile(
     """Fetch user profile from OAuth provider.
 
     Args:
-        slug: ServiceApplication slug for the login provider
+        slug: Login-Integration slug
         access_token: Access token from provider
         db: Graph database used to look up provider configuration
 
@@ -446,17 +445,6 @@ async def _load_active_login_app(
     return app
 
 
-def _decrypt_secret(app: login_providers.LoginApp) -> str:
-    """Decrypt the row's ``client_secret_encrypted`` value."""
-    if not app.client_secret_encrypted:
-        return ''
-    encryptor = encryption.TokenEncryption.get_instance()
-    secret = encryptor.decrypt(app.client_secret_encrypted)
-    if secret is None:
-        raise ValueError('Failed to decrypt OAuth client secret')
-    return secret
-
-
 async def _get_provider_config(
     slug: str, db: graph.Graph
 ) -> tuple[str, str, str]:
@@ -467,7 +455,11 @@ async def _get_provider_config(
     """
     app = await _load_active_login_app(slug, db)
     client_id = app.client_id or ''
-    client_secret = _decrypt_secret(app)
+    # LoginApp.client_secret is already plaintext -- Integration
+    # credentials are decrypted once when the login app is materialized
+    # (imbi_api.auth.login_providers), unlike the old ServiceApplication
+    # row which stored an encrypted value this module used to decrypt.
+    client_secret = app.client_secret or ''
     if app.oauth_app_type == 'google':
         return (
             'https://oauth2.googleapis.com/token',
@@ -480,7 +472,7 @@ async def _get_provider_config(
             client_id,
             client_secret,
         )
-    # oidc: prefer parent ThirdPartyService.token_endpoint, else discover
+    # oidc: prefer the Integration's configured token_endpoint, else discover
     if app.token_endpoint:
         return (app.token_endpoint, client_id, client_secret)
     if not app.issuer_url: