imbi-api 2.9.2__tar.gz → 2.10.0__tar.gz

{imbi_api-2.9.2 → imbi_api-2.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-api
-Version: 2.9.2
+Version: 2.10.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -20,7 +20,7 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,sentry,server]==2.9.2
+Requires-Dist: imbi-common[databases,llm,sentry,server]==2.10.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: mcp>=1.26.0

{imbi_api-2.9.2 → imbi_api-2.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.9.2"
+version = "2.10.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,sentry,server]==2.9.2",
+  "imbi-common[databases,llm,sentry,server]==2.10.0",
   "jinja2",
   "jsonpatch>=1.33",
   "mcp>=1.26.0",

{imbi_api-2.9.2 → imbi_api-2.10.0}/src/imbi_api/commit_sync/service.py

@@ -13,6 +13,7 @@ node so the UI can poll it without a dedicated status store.
 
 from __future__ import annotations
 
+import asyncio
 import datetime
 import logging
 import typing
@@ -24,6 +25,8 @@ from imbi_common.plugins.base import PluginContext, ServicePlugin
 from imbi_common.plugins.errors import PluginNotFoundError
 from imbi_common.plugins.registry import RegistryEntry, get_plugin
 
+from imbi_api import models
+from imbi_api.identity import repository as identity_repository
 from imbi_api.plugins import parse_options
 from imbi_api.plugins.credentials import get_plugin_credentials
 
@@ -33,6 +36,12 @@ _COMMIT_SYNC_SLUG = 'github-commit-sync'
 # Persisted error strings are truncated so a noisy upstream message can't
 # bloat the Project node.
 _MAX_ERROR_LEN = 500
+# Apache AGE aborts a SET with "Entity failed to be updated: <n>"
+# (heap_update -> TM_Updated) when another transaction updates the same
+# Project vertex concurrently. The worker's authoritative status writes
+# retry the transient conflict so they still land under contention.
+_STATUS_WRITE_RETRIES = 3
+_STATUS_RETRY_BACKOFF = 0.05
 
 SyncState = typing.Literal['idle', 'queued', 'running', 'success', 'failed']
 
@@ -130,6 +139,61 @@ async def _resolve_plugin(
     )
 
 
+def _identity_plugin_slugs(service_plugins: list[ServicePlugin]) -> list[str]:
+    """Return connected plugin slugs registered as identity plugins."""
+    slugs: list[str] = []
+    for plugin in service_plugins:
+        try:
+            entry = get_plugin(plugin.slug)
+        except PluginNotFoundError:
+            continue
+        if entry.manifest.plugin_type == 'identity':
+            slugs.append(plugin.slug)
+    return slugs
+
+
+def _make_user_resolver(
+    db: graph.Graph, service_plugins: list[ServicePlugin]
+) -> abc.Callable[[str], abc.Awaitable[str | None]] | None:
+    """Build the ``PluginContext.resolve_user_by_identity`` resolver.
+
+    Maps an external identity *subject* (a GitHub numeric user id) to the
+    matching Imbi user's email by querying the graph directly -- no HTTP,
+    since this runs inside imbi-api on a background backfill.  Connected
+    plugins are filtered to identity plugins; ``None`` is returned when
+    none qualify so the action skips the lookups entirely.  A subject
+    resolving to two different users across plugins is treated as
+    unresolved (logged), never mis-attributed.
+    """
+    identity_slugs = _identity_plugin_slugs(service_plugins)
+    if not identity_slugs:
+        return None
+
+    async def _resolve(subject: str) -> str | None:
+        emails: set[str] = set()
+        for slug in identity_slugs:
+            user_id = await identity_repository.find_user_by_subject(
+                db, slug, subject
+            )
+            if user_id is None:
+                continue
+            users = await db.match(models.User, {'id': user_id})
+            if users:
+                emails.add(users[0].email)
+        if len(emails) > 1:
+            LOGGER.error(
+                'Identity subject %r resolved to multiple Imbi users via '
+                'plugins %r: %r — leaving unattributed',
+                subject,
+                identity_slugs,
+                sorted(emails),
+            )
+            return None
+        return next(iter(emails), None)
+
+    return _resolve
+
+
 async def _build_context(
     db: graph.Graph,
     org_slug: str,
@@ -167,6 +231,9 @@ async def _build_context(
         project_type_slugs=project_type_slugs,
         third_party_service_slug=resolved.tps_slug or None,
         service_connections=service_connections,
+        resolve_user_by_identity=_make_user_resolver(
+            db, resolved.service_plugins
+        ),
     )
 
 
@@ -210,6 +277,11 @@ def _now_iso() -> str:
     return datetime.datetime.now(datetime.UTC).isoformat()
 
 
+def _is_write_conflict(exc: Exception) -> bool:
+    """True if *exc* is AGE's concurrent-update conflict (TM_Updated)."""
+    return 'failed to be updated' in str(exc)
+
+
 async def set_status(
     db: graph.Graph,
     project_id: str,
@@ -219,8 +291,17 @@ async def set_status(
     commits: int = 0,
     tags: int = 0,
     error: str = '',
+    retry: bool = True,
 ) -> None:
-    """Persist last-sync state on the ``Project`` node (best-effort)."""
+    """Persist last-sync state on the ``Project`` node (best-effort).
+
+    *retry* re-attempts the write when AGE reports a transient concurrent
+    update, so the worker's authoritative transitions (running -> success/
+    failed) still land if a webhook touches the project mid-write. The
+    enqueue endpoint passes ``retry=False`` for its optimistic ``queued``
+    write: dropping that on conflict is correct, since the worker's newer
+    ``running`` write must win rather than be clobbered back to ``queued``.
+    """
     query: typing.LiteralString = """
     MATCH (p:Project {{id: {project_id}}})
     SET p.commit_sync_status = {status},
@@ -231,26 +312,39 @@ async def set_status(
         p.commit_sync_error = {error}
     RETURN p.id AS id
     """
-    try:
-        await db.execute(
-            query,
-            {
-                'project_id': project_id,
-                'status': status,
-                'at': _now_iso(),
-                'by': requested_by,
-                'commits': commits,
-                'tags': tags,
-                'error': error[:_MAX_ERROR_LEN],
-            },
-            ['id'],
-        )
-    except Exception:  # noqa: BLE001
-        LOGGER.warning(
-            'Failed to persist commit-sync status for project %s',
-            project_id,
-            exc_info=True,
-        )
+    params = {
+        'project_id': project_id,
+        'status': status,
+        'at': _now_iso(),
+        'by': requested_by,
+        'commits': commits,
+        'tags': tags,
+        'error': error[:_MAX_ERROR_LEN],
+    }
+    attempts = _STATUS_WRITE_RETRIES if retry else 1
+    for attempt in range(attempts):
+        try:
+            await db.execute(query, params, ['id'])
+            return
+        except Exception as exc:  # noqa: BLE001
+            conflict = _is_write_conflict(exc)
+            if retry and conflict and attempt + 1 < attempts:
+                await asyncio.sleep(_STATUS_RETRY_BACKOFF * (attempt + 1))
+                continue
+            if conflict:
+                LOGGER.debug(
+                    'commit-sync status write for %s lost a concurrent '
+                    'update (status=%s); leaving the newer state in place',
+                    project_id,
+                    status,
+                )
+            else:
+                LOGGER.warning(
+                    'Failed to persist commit-sync status for project %s',
+                    project_id,
+                    exc_info=True,
+                )
+            return
 
 
 def _opt_str(value: object) -> str | None:
@@ -277,7 +371,7 @@ async def read_status(db: graph.Graph, project_id: str) -> CommitSyncStatus:
     MATCH (p:Project {{id: {project_id}}})
     RETURN p.commit_sync_status AS status,
            p.commit_sync_at AS at,
-           p.commit_sync_by AS by,
+           p.commit_sync_by AS requested_by,
            p.commit_sync_commits AS commits,
            p.commit_sync_tags AS tags,
            p.commit_sync_error AS error
@@ -285,7 +379,7 @@ async def read_status(db: graph.Graph, project_id: str) -> CommitSyncStatus:
     records = await db.execute(
         query,
         {'project_id': project_id},
-        ['status', 'at', 'by', 'commits', 'tags', 'error'],
+        ['status', 'at', 'requested_by', 'commits', 'tags', 'error'],
     )
     if not records:
         return CommitSyncStatus()
@@ -307,5 +401,5 @@ async def read_status(db: graph.Graph, project_id: str) -> CommitSyncStatus:
         commits_synced=_opt_int(graph.parse_agtype(row.get('commits'))),
         tags_synced=_opt_int(graph.parse_agtype(row.get('tags'))),
         error=_opt_str(graph.parse_agtype(row.get('error'))),
-        requested_by=_opt_str(graph.parse_agtype(row.get('by'))),
+        requested_by=_opt_str(graph.parse_agtype(row.get('requested_by'))),
     )

{imbi_api-2.9.2 → imbi_api-2.10.0}/src/imbi_api/domain/models.py

@@ -55,6 +55,7 @@ __all__ = [
     'ServiceApplicationSecrets',
     'Session',
     'TOTPSecret',
+    'TeamMembership',
     'ThirdPartyService',
     'ThirdPartyServiceCreate',
     'ThirdPartyServiceResponse',
@@ -224,6 +225,15 @@ class OrgMembership(pydantic.BaseModel):
     role: str
 
 
+class TeamMembership(pydantic.BaseModel):
+    """Team membership for API responses."""
+
+    model_config = pydantic.ConfigDict(extra='ignore')
+    team_name: str
+    team_slug: str
+    organization_slug: str
+
+
 class Role(models.Node):  # type: ignore[misc]
     """Role for grouping permissions."""
 
@@ -445,12 +455,14 @@ class CurrentUserResponse(UserResponse):
     """Response model for the authenticated user's own profile.
 
     Extends ``UserResponse`` with the caller's effective permission set
-    so the UI can gate features in a single request. Only exposed via
+    and team memberships so the UI can gate features and offer
+    membership-scoped filters in a single request. Only exposed via
     ``GET /users/me`` — the per-email endpoint deliberately omits
     permissions to avoid disclosing one user's grants to another.
     """
 
     permissions: list[str] = []
+    teams: list[TeamMembership] = []
 
 
 class PasswordChangeRequest(pydantic.BaseModel):

{imbi_api-2.9.2 → imbi_api-2.10.0}/src/imbi_api/domain/scoring.py

@@ -58,7 +58,12 @@ class PolicyCreate(pydantic.BaseModel):
     slug: str
     description: str | None = None
     category: typing.Literal[
-        'attribute', 'presence', 'link_presence', 'age', 'analysis_result'
+        'attribute',
+        'presence',
+        'link_presence',
+        'age',
+        'analysis_result',
+        'deployment_status',
     ] = 'attribute'
     weight: int = pydantic.Field(ge=0, le=100)
     enabled: bool = True
@@ -67,6 +72,7 @@ class PolicyCreate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     present_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     missing_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     value_score_map: dict[str, int] | None = None
@@ -85,6 +91,7 @@ class PolicyUpdate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     weight: int | None = pydantic.Field(default=None, ge=0, le=100)
     enabled: bool | None = None
     priority: int | None = None

{imbi_api-2.9.2 → imbi_api-2.10.0}/src/imbi_api/endpoints/dashboard.py

@@ -37,8 +37,11 @@ class DatastoreStatus(pydantic.BaseModel):
     status: typing.Literal['ok', 'error']
     latency_ms: float | None = None
     # Bytes on disk (Postgres/ClickHouse) or resident memory (Valkey,
-    # which is in-memory). ``None`` when the size probe failed.
+    # which is in-memory). ``None`` when the size probe failed. For
+    # ClickHouse this is the Imbi application database; ``total_bytes``
+    # carries the whole-server footprint (incl. ``system.*``).
     size_bytes: int | None = None
+    total_bytes: int | None = None
     detail: str | None = None
 
 
@@ -134,13 +137,19 @@ async def _check_postgres(db: graph.Graph) -> DatastoreStatus:
 
 
 async def _check_clickhouse() -> DatastoreStatus:
-    """Probe ClickHouse and read total on-disk size of active parts."""
+    """Probe ClickHouse for the app-database and whole-server disk size.
+
+    ``size`` is the active-part footprint of the connected (Imbi)
+    database; ``total`` spans every database, including ``system.*``.
+    """
     start = time.perf_counter()
     try:
         rows = await asyncio.wait_for(
             clickhouse.query(
-                'SELECT sum(bytes_on_disk) AS size FROM system.parts'
-                " WHERE active AND database != 'system'"
+                'SELECT'
+                ' sumIf(bytes_on_disk, database = currentDatabase()) AS size,'
+                ' sum(bytes_on_disk) AS total'
+                ' FROM system.parts WHERE active'
             ),
             _CHECK_TIMEOUT,
         )
@@ -152,14 +161,16 @@ async def _check_clickhouse() -> DatastoreStatus:
             status='error',
             detail=str(err),
         )
-    raw = rows[0].get('size') if rows else None
-    size = int(raw) if raw is not None else None
+    row = rows[0] if rows else {}
+    size_raw = row.get('size')
+    total_raw = row.get('total')
     return DatastoreStatus(
         name='ClickHouse',
         role='Timeseries data',
         status='ok',
         latency_ms=_ms(start),
-        size_bytes=size,
+        size_bytes=int(size_raw) if size_raw is not None else None,
+        total_bytes=int(total_raw) if total_raw is not None else None,
     )
 
 

{imbi_api-2.9.2 → imbi_api-2.10.0}/src/imbi_api/endpoints/project_commit_sync.py

@@ -60,8 +60,15 @@ async def sync_commits_and_tags(
         valkey_client, org_slug, project_id, requested_by
     )
     if enqueued:
+        # Optimistic, best-effort: if the worker has already flipped the
+        # project to ``running``, that newer write must win -- so this one
+        # does not retry the concurrent-update conflict.
         await service.set_status(
-            db, project_id, status='queued', requested_by=requested_by
+            db,
+            project_id,
+            status='queued',
+            requested_by=requested_by,
+            retry=False,
         )
     return CommitSyncEnqueueResponse(enqueued=enqueued)