imbi-api 2.9.3__tar.gz → 2.11.0__tar.gz

{imbi_api-2.9.3 → imbi_api-2.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-api
-Version: 2.9.3
+Version: 2.11.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -20,7 +20,7 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,sentry,server]==2.9.2
+Requires-Dist: imbi-common[databases,llm,sentry,server]==2.11.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: mcp>=1.26.0
@@ -43,11 +43,12 @@ Requires-Dist: opentelemetry-instrumentation-fastapi; extra == 'otel'
 Requires-Dist: opentelemetry-instrumentation-httpx; extra == 'otel'
 Requires-Dist: opentelemetry-instrumentation-jinja2; extra == 'otel'
 Provides-Extra: plugins
-Requires-Dist: imbi-plugin-aws>=1.0.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-github>=1.0.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-logzio>=1.0.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-oidc>=1.0.0; extra == 'plugins'
-Requires-Dist: imbi-plugin-sonarqube>=0.0.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-aws>=2.1.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-github>=2.1.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-logzio>=2.1.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-oidc>=2.1.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-pagerduty>=2.1.0; extra == 'plugins'
+Requires-Dist: imbi-plugin-sonarqube>=2.1.0; extra == 'plugins'
 Provides-Extra: sentry
 Requires-Dist: sentry-sdk; extra == 'sentry'
 Description-Content-Type: text/markdown

{imbi_api-2.9.3 → imbi_api-2.11.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.9.3"
+version = "2.11.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,sentry,server]==2.9.2",
+  "imbi-common[databases,llm,sentry,server]==2.11.0",
   "jinja2",
   "jsonpatch>=1.33",
   "mcp>=1.26.0",
@@ -58,11 +58,12 @@ otel = [
   "opentelemetry-instrumentation-jinja2",
 ]
 plugins = [
-  "imbi-plugin-aws>=1.0.0",
-  "imbi-plugin-github>=1.0.0",
-  "imbi-plugin-logzio>=1.0.0",
-  "imbi-plugin-oidc>=1.0.0",
-  "imbi-plugin-sonarqube>=0.0.0",
+  "imbi-plugin-aws>=2.1.0",
+  "imbi-plugin-github>=2.1.0",
+  "imbi-plugin-logzio>=2.1.0",
+  "imbi-plugin-oidc>=2.1.0",
+  "imbi-plugin-pagerduty>=2.1.0",
+  "imbi-plugin-sonarqube>=2.1.0"
 ]
 sentry = ["sentry-sdk"]
 

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/backfill_embeddings.py

@@ -45,10 +45,13 @@ _NODE_TYPES: list[type[models.Node]] = [
 ]
 
 # GraphModel types that have Embeddable fields but are not Node subclasses.
-# match() still works via model_construct fallback; _auto_embed accepts any
-# GraphModel even though its type annotation says Node.
+# match() still works via model_construct fallback; _auto_embed embeds any
+# GraphModel that declares Embeddable fields.
 _GRAPH_MODEL_TYPES: list[type[models.GraphModel]] = [
     models.Document,
+    models.Release,
+    models.Comment,
+    models.Component,
 ]
 
 _DEFAULT_CONCURRENCY = 4

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/commit_sync/queue.py

@@ -13,10 +13,12 @@ import asyncio
 import logging
 import os
 import socket
+import time
 import typing
 from collections import abc
 
 from imbi_common import graph
+from imbi_common.plugins.errors import PluginRateLimited
 from valkey import asyncio as valkey
 
 from imbi_api.commit_sync.service import (
@@ -33,6 +35,18 @@ DEBOUNCE_PREFIX = 'imbi:commit-sync:debounce'
 DEBOUNCE_SECONDS = 10
 MAX_DELIVERIES = 3
 CLAIM_IDLE_MS = 120_000
+# A GitHub rate-limit reset can be an hour out -- farther than the
+# plugin's per-call wait cap -- so the plugin raises PluginRateLimited
+# instead of failing the job.  The worker records the resume time here and
+# every worker honors it before reading, so one exhausted token pauses the
+# whole consumer (the backfill runs against a single token) until GitHub
+# resumes, rather than burning MAX_DELIVERIES and dead-lettering the work.
+PAUSE_KEY = 'imbi:commit-sync:paused-until'
+# Longest single sleep while paused; bounded so a *stop* signal is honored
+# promptly and a long reset is re-checked rather than slept through blind.
+PAUSE_POLL_CAP_SECONDS = 30
+# Cushion on the pause key's TTL so it outlives the resume time it carries.
+PAUSE_KEY_BUFFER_SECONDS = 5
 
 LOGGER = logging.getLogger(__name__)
 
@@ -106,6 +120,20 @@ async def _process_message(db: graph.Graph, fields: dict[str, str]) -> None:
             error=str(exc),
         )
         return
+    except PluginRateLimited:
+        # Transient: GitHub's rate limit is exhausted.  Keep the job queued
+        # (the consumer pauses until the reset and retries) instead of
+        # marking it failed -- the failure path would dead-letter it before
+        # the limit clears.  _handle_entries sets the pause from the
+        # re-raised exception's retry_at.
+        LOGGER.warning(
+            'commit-sync rate-limited for %s; left queued until GitHub resets',
+            project_id,
+        )
+        await set_status(
+            db, project_id, status='queued', requested_by=requested_by
+        )
+        raise
     except Exception:
         # Persist a generic, user-safe message; the polling endpoint
         # exposes this status, so keep raw exception detail in logs only.
@@ -145,6 +173,30 @@ def _decode_fields(
     }
 
 
+async def _paused_remaining(client: valkey.Valkey) -> float:
+    """Seconds left on the global rate-limit pause, ``0.0`` when clear."""
+    try:
+        raw = await client.get(PAUSE_KEY)
+    except Exception:  # noqa: BLE001
+        return 0.0
+    if raw is None:
+        return 0.0
+    try:
+        until = float(raw.decode() if isinstance(raw, bytes) else raw)
+    except ValueError:
+        return 0.0
+    return max(0.0, until - time.time())
+
+
+async def _pause_until(client: valkey.Valkey, retry_at: float) -> None:
+    """Record the resume time so every worker backs off until *retry_at*."""
+    ttl = max(1, int(retry_at - time.time()) + PAUSE_KEY_BUFFER_SECONDS)
+    try:
+        await client.set(PAUSE_KEY, str(retry_at), ex=ttl)
+    except Exception:
+        LOGGER.exception('failed to set commit-sync pause marker')
+
+
 async def _claim_stale(
     client: valkey.Valkey,
     consumer: str,
@@ -215,6 +267,19 @@ async def _handle_entries(
             continue
         try:
             await _process_message(db, fields)
+        except PluginRateLimited as exc:
+            # Don't ack, don't dead-letter: leave the job pending and pause
+            # every worker until GitHub resets.  Stop the batch -- its
+            # siblings hit the same token -- and let the next reclaim drain
+            # it once the pause clears.
+            await _pause_until(client, exc.retry_at)
+            LOGGER.warning(
+                'commit-sync paused ~%.0fs (GitHub rate limit); %d job(s) '
+                'left queued',
+                max(0.0, exc.retry_at - time.time()),
+                len(entries),
+            )
+            return
         except Exception:
             LOGGER.exception('commit-sync failed for %s', fields)
             continue
@@ -236,6 +301,10 @@ async def consume_commit_sync(
     await ensure_group(client)
     LOGGER.info('Commit-sync consumer loop running (consumer=%s)', consumer)
     while stop is None or not stop.is_set():
+        paused = await _paused_remaining(client)
+        if paused > 0:
+            await asyncio.sleep(min(paused, PAUSE_POLL_CAP_SECONDS))
+            continue
         stale = await _claim_stale(client, consumer)
         if stale:
             try:
@@ -244,6 +313,10 @@ async def consume_commit_sync(
                 LOGGER.exception('commit-sync stale-entry handling failed')
                 await asyncio.sleep(1)
                 continue
+        # Stale handling may have just paused us; don't read new work into
+        # a guaranteed re-throttle -- loop back and honor the pause.
+        if await _paused_remaining(client) > 0:
+            continue
         try:
             response = await client.xreadgroup(
                 GROUP,

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/commit_sync/service.py

@@ -25,6 +25,7 @@ from imbi_common.plugins.base import PluginContext, ServicePlugin
 from imbi_common.plugins.errors import PluginNotFoundError
 from imbi_common.plugins.registry import RegistryEntry, get_plugin
 
+from imbi_api.identity import attribution
 from imbi_api.plugins import parse_options
 from imbi_api.plugins.credentials import get_plugin_credentials
 
@@ -174,6 +175,9 @@ async def _build_context(
         project_type_slugs=project_type_slugs,
         third_party_service_slug=resolved.tps_slug or None,
         service_connections=service_connections,
+        resolve_user_by_identity=attribution.make_user_resolver(
+            db, resolved.service_plugins
+        ),
     )
 
 

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/domain/models.py

@@ -55,6 +55,7 @@ __all__ = [
     'ServiceApplicationSecrets',
     'Session',
     'TOTPSecret',
+    'TeamMembership',
     'ThirdPartyService',
     'ThirdPartyServiceCreate',
     'ThirdPartyServiceResponse',
@@ -224,6 +225,15 @@ class OrgMembership(pydantic.BaseModel):
     role: str
 
 
+class TeamMembership(pydantic.BaseModel):
+    """Team membership for API responses."""
+
+    model_config = pydantic.ConfigDict(extra='ignore')
+    team_name: str
+    team_slug: str
+    organization_slug: str
+
+
 class Role(models.Node):  # type: ignore[misc]
     """Role for grouping permissions."""
 
@@ -445,12 +455,14 @@ class CurrentUserResponse(UserResponse):
     """Response model for the authenticated user's own profile.
 
     Extends ``UserResponse`` with the caller's effective permission set
-    so the UI can gate features in a single request. Only exposed via
+    and team memberships so the UI can gate features and offer
+    membership-scoped filters in a single request. Only exposed via
     ``GET /users/me`` — the per-email endpoint deliberately omits
     permissions to avoid disclosing one user's grants to another.
     """
 
     permissions: list[str] = []
+    teams: list[TeamMembership] = []
 
 
 class PasswordChangeRequest(pydantic.BaseModel):
@@ -919,6 +931,41 @@ class PluginAssignmentResponse(pydantic.BaseModel):
     # card on the project settings page (and the admin TPS page) so
     # the UI doesn't surface a button that the API will 400 on.
     supports_deployment_sync: bool = False
+    # Set on lifecycle plugins whose ``on_project_updated`` is a safe
+    # upsert -- gates the "Sync lifecycle" controls on the project
+    # settings page (and the admin TPS page), which push current Imbi
+    # state to the remote on demand.
+    supports_lifecycle_sync: bool = False
+    # Parent third-party service (``ThirdPartyService -[:HAS_PLUGIN]->
+    # Plugin``) so the UI can show which service powers the tab.
+    service_name: str | None = None
+    service_icon: str | None = None
+
+
+class LifecycleSyncError(pydantic.BaseModel):
+    """One non-fatal failure encountered during a lifecycle sync."""
+
+    project_id: str
+    detail: str
+
+
+class LifecycleSyncSummary(pydantic.BaseModel):
+    """Aggregate outcome of a lifecycle push-sync run.
+
+    A sync re-dispatches each project's ``on_project_updated`` -- an
+    upsert that creates the remote when missing and updates it
+    otherwise -- so the per-project outcome is the plugin's
+    ``LifecycleResult.status``: ``synced`` counts ``ok`` results,
+    ``skipped`` counts ``skipped`` (e.g. an unmapped team), and
+    ``failed`` counts ``failed`` results plus dispatches that raised
+    (each captured in ``errors``).
+    """
+
+    projects: int = 0
+    synced: int = 0
+    skipped: int = 0
+    failed: int = 0
+    errors: list[LifecycleSyncError] = []
 
 
 # -- Configuration / Logs response models ---------------------------------

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/domain/scoring.py

@@ -58,7 +58,12 @@ class PolicyCreate(pydantic.BaseModel):
     slug: str
     description: str | None = None
     category: typing.Literal[
-        'attribute', 'presence', 'link_presence', 'age', 'analysis_result'
+        'attribute',
+        'presence',
+        'link_presence',
+        'age',
+        'analysis_result',
+        'deployment_status',
     ] = 'attribute'
     weight: int = pydantic.Field(ge=0, le=100)
     enabled: bool = True
@@ -67,6 +72,7 @@ class PolicyCreate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     present_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     missing_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     value_score_map: dict[str, int] | None = None
@@ -85,6 +91,7 @@ class PolicyUpdate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     weight: int | None = pydantic.Field(default=None, ge=0, le=100)
     enabled: bool | None = None
     priority: int | None = None

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/endpoints/_helpers.py

@@ -405,6 +405,7 @@ async def persist_service_writeback(
                 slug,
                 writeback.identifier,
                 writeback.canonical_url,
+                writeback.webhook_secret_enc,
             )
             await merge_project_links(
                 db, ctx.project_id, add=writeback.dashboard_links
@@ -432,9 +433,26 @@ async def _merge_exists_in(
     tps_slug: str,
     identifier: str,
     canonical_url: str,
+    webhook_secret_enc: str | None = None,
 ) -> None:
-    """Upsert the ``EXISTS_IN`` edge for ``(project, service)``."""
-    query: typing.LiteralString = """
+    """Upsert the ``EXISTS_IN`` edge for ``(project, service)``.
+
+    ``webhook_secret_enc`` is an opaque, already-encrypted secret (the
+    plugin encrypts it; this never decrypts or re-encrypts it) stored on
+    the edge alongside ``identifier`` for a gateway to read back at
+    webhook-delivery time. When ``None`` the ``SET`` omits it, so an
+    existing edge's secret is left untouched.
+    """
+    # Conditionally append the secret to the SET clause so a writeback
+    # without one cannot null out a previously-stored secret. Both
+    # branches are string literals, keeping the query a ``LiteralString``.
+    secret_set: typing.LiteralString = (
+        ',\n        ei.webhook_secret_enc = {webhook_secret_enc}'
+        if webhook_secret_enc is not None
+        else ''
+    )
+    query: typing.LiteralString = (
+        """
     MATCH (p:Project {{id: {project_id}}})
           -[:OWNED_BY]->(:Team)
           -[:BELONGS_TO]->(o:Organization {{slug: {org_slug}}})
@@ -442,20 +460,22 @@ async def _merge_exists_in(
           -[:BELONGS_TO]->(o)
     MERGE (p)-[ei:EXISTS_IN]->(tps)
     SET ei.identifier = {identifier},
-        ei.canonical_url = {canonical_url}
+        ei.canonical_url = {canonical_url}"""
+        + secret_set
+        + """
     RETURN ei.identifier AS identifier
     """
-    await db.execute(
-        query,
-        {
-            'org_slug': org_slug,
-            'project_id': project_id,
-            'tps_slug': tps_slug,
-            'identifier': identifier,
-            'canonical_url': canonical_url,
-        },
-        ['identifier'],
     )
+    params: dict[str, typing.Any] = {
+        'org_slug': org_slug,
+        'project_id': project_id,
+        'tps_slug': tps_slug,
+        'identifier': identifier,
+        'canonical_url': canonical_url,
+    }
+    if webhook_secret_enc is not None:
+        params['webhook_secret_enc'] = webhook_secret_enc
+    await db.execute(query, params, ['identifier'])
 
 
 async def _delete_exists_in(

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/endpoints/admin_plugins.py

@@ -163,6 +163,9 @@ def _serialize(
         'supports_deployment_sync': bool(
             getattr(entry.manifest, 'supports_deployment_sync', False)
         ),
+        'supports_lifecycle_sync': bool(
+            getattr(entry.manifest, 'supports_lifecycle_sync', False)
+        ),
         'options': [o.model_dump() for o in entry.manifest.options],
         'credentials': [c.model_dump() for c in entry.manifest.credentials],
         'vertex_labels': [
@@ -198,6 +201,7 @@ def _placeholder(package_name: str) -> dict[str, typing.Any]:
         'docs_url': None,
         'supported_tabs': [],
         'supports_deployment_sync': False,
+        'supports_lifecycle_sync': False,
         'options': [],
         'credentials': [],
         'vertex_labels': [],

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/endpoints/comments.py

@@ -1,6 +1,6 @@
-"""Page-level threaded comments on project documents.
+"""Page-level threaded comments on documents.
 
-Comments hang off a project ``Document`` via a ``CommentThread`` vertex
+Comments hang off a ``Document`` via a ``CommentThread`` vertex
 (``ON_DOCUMENT`` edge) containing one or more ``Comment`` vertices
 (``IN_THREAD`` edge). The root comment is the oldest comment in a thread;
 replies follow in ``created_at`` order.
@@ -39,7 +39,7 @@ _COMMENT_EVENT_TYPE: typing.LiteralString = 'document-comment'
 
 async def _emit_comment_event(
     *,
-    project_id: str,
+    project_id: str | None,
     document_id: str,
     thread_id: str,
     comment_id: str,
@@ -59,7 +59,7 @@ async def _emit_comment_event(
             [
                 [
                     nanoid.generate(),
-                    project_id,
+                    project_id or '',
                     datetime.datetime.now(datetime.UTC),
                     _COMMENT_EVENT_TYPE,
                     'internal',
@@ -265,22 +265,40 @@ _COMMENTS_TAIL: typing.LiteralString = """
     RETURN t, d, comments
 """
 
-# Document-ownership join used by every query to scope to project -> org.
+# Document-ownership join used by every query to scope the document to
+# the organization through whichever vertex it is attached to (project,
+# project type, or user). When ``{project_id}`` is non-null the document
+# must additionally be attached to that project — this keeps the
+# project-scoped comment routes from resolving another project's
+# document.
 _DOC_JOIN: typing.LiteralString = """
     MATCH (d:Document {{id: {document_id}}})
-          -[:ATTACHED_TO]->(:Project {{id: {project_id}}})
+    OPTIONAL MATCH (d)-[:ATTACHED_TO]->(p:Project)
           -[:OWNED_BY]->(:Team)
           -[:BELONGS_TO]->(:Organization {{slug: {org_slug}}})
+    OPTIONAL MATCH (d)-[:ATTACHED_TO]->(pt:ProjectType)
+          -[:BELONGS_TO]->(:Organization {{slug: {org_slug}}})
+    OPTIONAL MATCH (d)-[:ATTACHED_TO]->(u:User)
+          -[:MEMBER_OF]->(:Organization {{slug: {org_slug}}})
+    WITH d, p, pt, u
+    WHERE ({project_id} IS NULL
+           AND (p IS NOT NULL OR pt IS NOT NULL OR u IS NOT NULL))
+       OR (p IS NOT NULL AND p.id = {project_id})
+    WITH DISTINCT d
 """
 
 
 async def _verify_document(
     db: graph.Pool,
     org_slug: str,
-    project_id: str,
+    project_id: str | None,
     document_id: str,
 ) -> None:
-    """Raise 404 unless the document belongs to the project -> org."""
+    """Raise 404 unless the document belongs to the org.
+
+    When ``project_id`` is provided the document must be attached to
+    that project.
+    """
     query: str = _DOC_JOIN + 'RETURN d.id AS id'
     records = await db.execute(
         query,
@@ -301,7 +319,7 @@ async def _verify_document(
 async def _fetch_thread(
     db: graph.Pool,
     org_slug: str,
-    project_id: str,
+    project_id: str | None,
     document_id: str,
     thread_id: str,
 ) -> dict[str, typing.Any] | None:
@@ -332,7 +350,7 @@ async def _fetch_thread(
 async def _fetch_comment(
     db: graph.Pool,
     org_slug: str,
-    project_id: str,
+    project_id: str | None,
     document_id: str,
     thread_id: str,
     comment_id: str,
@@ -366,13 +384,13 @@ async def _fetch_comment(
 @comments_router.get('', response_model=CommentThreadListResponse)
 async def list_comment_threads(
     org_slug: str,
-    project_id: str,
     document_id: str,
     db: graph.Pool,
     _auth: typing.Annotated[
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('document:read')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """List every comment thread on a document, comments oldest-first."""
     await _verify_document(db, org_slug, project_id, document_id)
@@ -402,7 +420,6 @@ async def list_comment_threads(
 )
 async def create_comment_thread(
     org_slug: str,
-    project_id: str,
     document_id: str,
     data: CommentThreadCreate,
     db: graph.Pool,
@@ -410,6 +427,7 @@ async def create_comment_thread(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:create')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """Create a thread, its ``ON_DOCUMENT`` edge, and the root comment."""
     await _verify_document(db, org_slug, project_id, document_id)
@@ -511,7 +529,6 @@ async def create_comment_thread(
 )
 async def create_reply(
     org_slug: str,
-    project_id: str,
     document_id: str,
     thread_id: str,
     data: CommentBodyCreate,
@@ -520,6 +537,7 @@ async def create_reply(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:create')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """Add a reply comment to an existing thread."""
     now = datetime.datetime.now(datetime.UTC)
@@ -582,7 +600,6 @@ async def create_reply(
 @comments_router.patch('/{thread_id}', response_model=CommentThreadResponse)
 async def patch_comment_thread(
     org_slug: str,
-    project_id: str,
     document_id: str,
     thread_id: str,
     operations: list[json_patch.PatchOperation],
@@ -591,6 +608,7 @@ async def patch_comment_thread(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:write')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """Resolve or reopen a thread via JSON Patch (only ``/resolved``)."""
     existing = await _fetch_thread(
@@ -659,7 +677,6 @@ async def patch_comment_thread(
 )
 async def patch_comment(
     org_slug: str,
-    project_id: str,
     document_id: str,
     thread_id: str,
     comment_id: str,
@@ -669,6 +686,7 @@ async def patch_comment(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:write')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """Edit a comment via JSON Patch (only ``/body`` and ``/mentions``).
 
@@ -747,7 +765,6 @@ async def patch_comment(
 )
 async def acknowledge_comment(
     org_slug: str,
-    project_id: str,
     document_id: str,
     thread_id: str,
     comment_id: str,
@@ -756,6 +773,7 @@ async def acknowledge_comment(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:write')),
     ],
+    project_id: str | None = None,
 ) -> dict[str, typing.Any]:
     """Toggle the principal in the comment's ``acknowledged_by`` array."""
     existing = await _fetch_comment(
@@ -807,7 +825,6 @@ async def acknowledge_comment(
 @comments_router.delete('/{thread_id}/comments/{comment_id}', status_code=204)
 async def delete_comment(
     org_slug: str,
-    project_id: str,
     document_id: str,
     thread_id: str,
     comment_id: str,
@@ -816,6 +833,7 @@ async def delete_comment(
         permissions.AuthContext,
         fastapi.Depends(permissions.require_permission('comment:delete')),
     ],
+    project_id: str | None = None,
 ) -> None:
     """Delete a comment. Author-only. Deletes the thread if it was the
     root and no other comments remain.

{imbi_api-2.9.3 → imbi_api-2.11.0}/src/imbi_api/endpoints/dashboard.py

@@ -37,8 +37,11 @@ class DatastoreStatus(pydantic.BaseModel):
     status: typing.Literal['ok', 'error']
     latency_ms: float | None = None
     # Bytes on disk (Postgres/ClickHouse) or resident memory (Valkey,
-    # which is in-memory). ``None`` when the size probe failed.
+    # which is in-memory). ``None`` when the size probe failed. For
+    # ClickHouse this is the Imbi application database; ``total_bytes``
+    # carries the whole-server footprint (incl. ``system.*``).
     size_bytes: int | None = None
+    total_bytes: int | None = None
     detail: str | None = None
 
 
@@ -134,13 +137,19 @@ async def _check_postgres(db: graph.Graph) -> DatastoreStatus:
 
 
 async def _check_clickhouse() -> DatastoreStatus:
-    """Probe ClickHouse and read total on-disk size of active parts."""
+    """Probe ClickHouse for the app-database and whole-server disk size.
+
+    ``size`` is the active-part footprint of the connected (Imbi)
+    database; ``total`` spans every database, including ``system.*``.
+    """
     start = time.perf_counter()
     try:
         rows = await asyncio.wait_for(
             clickhouse.query(
-                'SELECT sum(bytes_on_disk) AS size FROM system.parts'
-                " WHERE active AND database != 'system'"
+                'SELECT'
+                ' sumIf(bytes_on_disk, database = currentDatabase()) AS size,'
+                ' sum(bytes_on_disk) AS total'
+                ' FROM system.parts WHERE active'
             ),
             _CHECK_TIMEOUT,
         )
@@ -152,14 +161,16 @@ async def _check_clickhouse() -> DatastoreStatus:
             status='error',
             detail=str(err),
         )
-    raw = rows[0].get('size') if rows else None
-    size = int(raw) if raw is not None else None
+    row = rows[0] if rows else {}
+    size_raw = row.get('size')
+    total_raw = row.get('total')
     return DatastoreStatus(
         name='ClickHouse',
         role='Timeseries data',
         status='ok',
         latency_ms=_ms(start),
-        size_bytes=size,
+        size_bytes=int(size_raw) if size_raw is not None else None,
+        total_bytes=int(total_raw) if total_raw is not None else None,
     )