infrahub-server 1.4.9__tar.gz → 1.4.11__tar.gz

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: infrahub-server
-Version: 1.4.9
+Version: 1.4.11
 Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
 License: Apache-2.0
 Author: OpsMill
@@ -16,9 +16,10 @@ Requires-Dist: Jinja2 (>=3,<4)
 Requires-Dist: aio-pika (>=9.4,<9.5)
 Requires-Dist: aiodataloader (==0.4.0)
 Requires-Dist: asgi-correlation-id (==4.2.0)
-Requires-Dist: authlib (==1.3.2)
+Requires-Dist: authlib (==1.6.5)
 Requires-Dist: bcrypt (>=4.1,<4.2)
 Requires-Dist: boto3 (==1.34.129)
+Requires-Dist: cachetools-async (>=0.0.5,<0.0.6)
 Requires-Dist: copier (>=9.8.0,<10.0.0)
 Requires-Dist: dulwich (>=0.22.7,<0.23.0)
 Requires-Dist: email-validator (>=2.1,<2.2)
@@ -66,42 +67,41 @@ Description-Content-Type: text/markdown
 <h1 align="center">
   <a href=""><img src="docs/static/img/infrahub-hori.svg" alt="Infrahub" width="350"></a>
 </h1>
-<h3 align="center">Simplify Infrastructure Automation</h2>
 
 <p align="center">
 <a href="https://www.linkedin.com/company/opsmill">
-<img src="https://img.shields.io/badge/linkedin-blue?logo=linkedin"/>
+<img src="https://img.shields.io/badge/linkedin-blue?logo=LinkedIn"/>
 </a>
 <a href="https://discord.gg/opsmill">
 <img src="https://img.shields.io/badge/Discord-7289DA?&logo=discord&logoColor=white"/>
 </a>
 </p>
 
-Infrahub from [OpsMill](https://opsmill.com) is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run. Infrahub offers a central hub to manage the data, templates and playbooks that powers your infrastructure by combining the version control and branch management capabilities similar to Git with the flexible data model and UI of a graph database.
+Infrahub is a graph-based data management platform with built-in version control, CI workflows, peer review, and API access. It's purpose-built to power network, data center, and cloud automation.
 
-If you just want to try Infrahub out, you can use our [Infrahub Sandbox](https://sandbox.infrahub.app/) to get started.
+## The data foundation for modern automation
 
-![infrahub screenshot](docs/docs/media/infrahub-readme.gif)
+Infrahub provides a single platform that unifies infrastructure data with business logic, enforces consistency, and integrates with automation tools and AI workflows.
 
-## Why Use Infrahub?
+With Infrahub as the data foundation in your automation stack, you can move faster, reduce risk, and deliver infrastructure as a reliable service.
 
-**Unified Source of Truth** - Infrahub is a single source of truth for all your infrastructure and network data. It provides a unified view of your infrastructure, allowing you to manage your infrastructure in a more efficient and effective way. Infrahub allows unidirectional and bi-directional [data synchronization](https://docs.infrahub.app/sync/sync/) between other internal systems and Infrahub. The data can be accessed via WebUI, API and SDK, along with SSO and RBAC for access control.
+## Top ways to use Infrahub
 
-**Flexible Schema** - Infrahub provides a flexible schema for your infrastructure data and related business information, allowing you to define your own data model and customize it to your needs. Get started quickly with our [schema library](https://github.com/opsmill/schema-library) or build your own.
+### Unify infrastructure data
 
-**Version Control** - Infrahub provides a version control system for your infrastructure data, allowing you to track changes and revert to previous versions if needed. Immutable history of all changes to the data and artifacts is maintained, allowing you to audit and review changes to your infrastructure.
+Sync network and infrastructure device, service, and policy data into a unified source of truth, with rich metadata and robust UI and API access.
 
-**CI Pipeline and Validation** - Infrahub provides a CI pipeline and validation system for your infrastructure data, allowing you to ensure that your infrastructure is always in a valid state. Infrahub was designed with infrastructure-as-code workflows in mind, removing fragility and complexity of combining together multiple tools and projects to achieve the same goal.
+### Automate at scale
 
-## Infrahub Use Cases
+Generate, validate, and deploy configurations with unified data. Support full lifecycle management—provisioning, upgrades, decommissioning—across vendors and sites.
 
-**Service Catalog** - Infrahub acts as the underlying system to provide infrastructure-as-a-service, allowing you to manage your services and lifecycle them as the services evolve.
+### Enable self-service
 
-**Infrastructure Automation** - Provide infrastructure and network automation workflows with Infrahub rendering configurations and artifacts via Jinja2 and python,then passing to deployment tools such as [Nornir](https://www.opsmill.com/simplifying-network-automation-workflows-with-infrahub-nornir-and-jinja2/), [Ansible](https://docs.infrahub.app/ansible), Terraform, or vendor-specific tools.
+Expose automation through catalogs and APIs so application, platform, and ops teams can request infrastructure directly. Speed time to delivery, reduce errors, and make infrastructure more responsive to the business.
 
-**Inventory Management** - Infrahub serves as a centralized inventory system for your infrastructure, allowing you to manage your inventory and track changes to your infrastructure. It provides a WebUI and API for other teams to self-service the information needed to allow the organization to operate.
+### Build an AIOps knowledge graph
 
-**DCIM and IPAM** - Infrahub provides centralized DCIM and IPAM systems for your infrastructure, capable of handling complex cases such as overlapping IP addresses and VLANs, automation-friendly, branch-aware allocation of resources via Infrahub's [Resource Manager](https://docs.infrahub.app/python-sdk/guides/resource-manager), and more.
+Model dependencies and relationships across infrastructure. Provide the data foundation for AI-driven reasoning, troubleshooting, and predictive operations.
 
 ## Quick Start
 

infrahub_server-1.4.11/README.md

@@ -0,0 +1,74 @@
+<h1 align="center">
+  <a href=""><img src="docs/static/img/infrahub-hori.svg" alt="Infrahub" width="350"></a>
+</h1>
+
+<p align="center">
+<a href="https://www.linkedin.com/company/opsmill">
+<img src="https://img.shields.io/badge/linkedin-blue?logo=LinkedIn"/>
+</a>
+<a href="https://discord.gg/opsmill">
+<img src="https://img.shields.io/badge/Discord-7289DA?&logo=discord&logoColor=white"/>
+</a>
+</p>
+
+Infrahub is a graph-based data management platform with built-in version control, CI workflows, peer review, and API access. It's purpose-built to power network, data center, and cloud automation.
+
+## The data foundation for modern automation
+
+Infrahub provides a single platform that unifies infrastructure data with business logic, enforces consistency, and integrates with automation tools and AI workflows.
+
+With Infrahub as the data foundation in your automation stack, you can move faster, reduce risk, and deliver infrastructure as a reliable service.
+
+## Top ways to use Infrahub
+
+### Unify infrastructure data
+
+Sync network and infrastructure device, service, and policy data into a unified source of truth, with rich metadata and robust UI and API access.
+
+### Automate at scale
+
+Generate, validate, and deploy configurations with unified data. Support full lifecycle management—provisioning, upgrades, decommissioning—across vendors and sites.
+
+### Enable self-service
+
+Expose automation through catalogs and APIs so application, platform, and ops teams can request infrastructure directly. Speed time to delivery, reduce errors, and make infrastructure more responsive to the business.
+
+### Build an AIOps knowledge graph
+
+Model dependencies and relationships across infrastructure. Provide the data foundation for AI-driven reasoning, troubleshooting, and predictive operations.
+
+## Quick Start
+
+[Infrahub Sandbox](https://sandbox.infrahub.app/) - Instantly login to the UI of a demo environment of Infrahub with sample data pre-loaded.
+
+[Getting Started Environment & Tutorial](https://opsmill.instruqt.com/pages/labs) - It spins up an instance of Infrahub on our cloud, provides a browser, terminal, code editor and walks you through the basic concepts:
+
+- Branching and version control
+- Flexible schema
+- Unified storage
+
+For longer term tests, you can deploy a local instance of Infrahub by referring to our guide: [Installing Infrahub](https://docs.infrahub.app/guides/installation)
+
+## Documentation
+
+If you'd like to learn more about Infrahub, please refer to the following resources:
+
+- [Infrahub Overview](https://docs.infrahub.app/getting-started/overview)
+- [Infrahub Documentation](https://docs.infrahub.app/)
+- [FAQ](https://docs.infrahub.app/faq/)
+
+## Support and Community
+
+If you need help, support for the community version of Infrahub is provided on [![Join our Discord server](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/opsmill) or via [filing an issue on GitHub](https://github.com/opsmill/infrahub/issues).
+
+## Contributing
+
+To help our community with the creation of contributions, please view our [CONTRIBUTING](./CONTRIBUTING.md) page.
+
+<a  href="https://github.com/opsmill/infrahub/graphs/contributors">
+<img  src="https://contrib.rocks/image?repo=opsmill/infrahub" />
+</a>
+
+## Security
+
+[View our SECURITY](https://github.com/opsmill/infrahub?tab=security-ov-file) policy to find the latest information.

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/backend/infrahub/api/oauth2.py

@@ -11,14 +11,16 @@ from opentelemetry import trace
 
 from infrahub import config, models
 from infrahub.api.dependencies import get_db
-from infrahub.auth import get_groups_from_provider, signin_sso_account
-from infrahub.exceptions import GatewayError, ProcessingError
+from infrahub.auth import (
+    get_groups_from_provider,
+    signin_sso_account,
+    validate_auth_response,
+)
+from infrahub.exceptions import ProcessingError
 from infrahub.log import get_logger
 from infrahub.message_bus.types import KVTTL
 
 if TYPE_CHECKING:
-    import httpx
-
     from infrahub.database import InfrahubDatabase
     from infrahub.services import InfrahubServices
 
@@ -95,7 +97,7 @@ async def token(
     }
 
     token_response = await service.http.post(provider.token_url, data=token_data)
-    _validate_response(response=token_response)
+    validate_auth_response(response=token_response, provider_type="OAuth 2.0")
 
     with trace.get_tracer(__name__).start_as_current_span("sso_token_request") as span:
         span.set_attribute("token_request_data", ujson.dumps(token_response.json()))
@@ -107,12 +109,17 @@ async def token(
     else:
         userinfo_response = await service.http.post(provider.userinfo_url, headers=headers)
 
-    _validate_response(response=userinfo_response)
+    validate_auth_response(response=userinfo_response, provider_type="OAuth 2.0")
     user_info = userinfo_response.json()
     sso_groups = user_info.get("groups", []) or await get_groups_from_provider(
         provider=provider, service=service, payload=payload, user_info=user_info
     )
 
+    log.info(
+        "SSO user authenticated",
+        body={"user_name": user_info.get("name"), "groups": sso_groups},
+    )
+
     if not sso_groups and config.SETTINGS.security.sso_user_default_group:
         sso_groups = [config.SETTINGS.security.sso_user_default_group]
 
@@ -134,16 +141,3 @@ async def token(
     return models.UserTokenWithUrl(
         access_token=user_token.access_token, refresh_token=user_token.refresh_token, final_url=stored_final_url
     )
-
-
-def _validate_response(response: httpx.Response) -> None:
-    if 200 <= response.status_code <= 299:
-        return
-
-    log.error(
-        "Invalid response from the OAuth provider",
-        url=response.url,
-        status_code=response.status_code,
-        body=response.json(),
-    )
-    raise GatewayError(message="Invalid response from Authentication provider")

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/backend/infrahub/api/oidc.py

@@ -13,14 +13,16 @@ from pydantic import BaseModel, HttpUrl
 
 from infrahub import config, models
 from infrahub.api.dependencies import get_db
-from infrahub.auth import get_groups_from_provider, signin_sso_account
-from infrahub.exceptions import GatewayError, ProcessingError
+from infrahub.auth import (
+    get_groups_from_provider,
+    signin_sso_account,
+    validate_auth_response,
+)
+from infrahub.exceptions import ProcessingError
 from infrahub.log import get_logger
 from infrahub.message_bus.types import KVTTL
 
 if TYPE_CHECKING:
-    import httpx
-
     from infrahub.database import InfrahubDatabase
     from infrahub.services import InfrahubServices
 
@@ -69,7 +71,7 @@ async def authorize(request: Request, provider_name: str, final_url: str | None
     service: InfrahubServices = request.app.state.service
 
     response = await service.http.get(url=provider.discovery_url)
-    _validate_response(response=response)
+    validate_auth_response(response=response, provider_type="OIDC")
     oidc_config = OIDCDiscoveryConfig(**response.json())
 
     with trace.get_tracer(__name__).start_as_current_span("sso_oauth2_client_configuration") as span:
@@ -129,12 +131,12 @@ async def token(
     }
 
     discovery_response = await service.http.get(url=provider.discovery_url)
-    _validate_response(response=discovery_response)
+    validate_auth_response(response=discovery_response, provider_type="OIDC")
 
     oidc_config = OIDCDiscoveryConfig(**discovery_response.json())
 
     token_response = await service.http.post(str(oidc_config.token_endpoint), data=token_data)
-    _validate_response(response=token_response)
+    validate_auth_response(response=token_response, provider_type="OIDC")
 
     with trace.get_tracer(__name__).start_as_current_span("sso_token_request") as span:
         span.set_attribute("token_request_data", ujson.dumps(token_response.json()))
@@ -147,7 +149,7 @@ async def token(
     else:
         userinfo_response = await service.http.post(str(oidc_config.userinfo_endpoint), headers=headers)
 
-    _validate_response(response=userinfo_response)
+    validate_auth_response(response=userinfo_response, provider_type="OIDC")
     user_info: dict[str, Any] = userinfo_response.json()
     sso_groups = (
         user_info.get("groups")
@@ -157,6 +159,11 @@ async def token(
         or await get_groups_from_provider(provider=provider, service=service, payload=payload, user_info=user_info)
     )
 
+    log.info(
+        "SSO user authenticated",
+        body={"user_name": user_info.get("name"), "groups": sso_groups},
+    )
+
     if not sso_groups and config.SETTINGS.security.sso_user_default_group:
         sso_groups = [config.SETTINGS.security.sso_user_default_group]
 
@@ -180,19 +187,6 @@ async def token(
     )
 
 
-def _validate_response(response: httpx.Response) -> None:
-    if 200 <= response.status_code <= 299:
-        return
-
-    log.error(
-        "Invalid response from the OIDC provider",
-        url=response.url,
-        status_code=response.status_code,
-        body=response.json(),
-    )
-    raise GatewayError(message="Invalid response from Authentication provider")
-
-
 async def _get_id_token_groups(
     oidc_config: OIDCDiscoveryConfig, service: InfrahubServices, payload: dict[str, Any], client_id: str
 ) -> list[str]:

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/backend/infrahub/artifacts/models.py

@@ -25,7 +25,8 @@ class CheckArtifactCreate(BaseModel):
     target_kind: str = Field(..., description="The kind of the target object for this artifact")
     target_name: str = Field(..., description="Name of the artifact target")
     artifact_id: str | None = Field(default=None, description="The id of the artifact if it previously existed")
-    query: str = Field(..., description="The name of the query to use when collecting data")
+    query: str = Field(..., description="The name of the query to use when collecting data")  # Deprecated
+    query_id: str = Field(..., description="The id of the query to use when collecting data")
     timeout: int = Field(..., description="Timeout for requests used to generate this artifact")
     variables: dict = Field(..., description="Input variables when generating the artifact")
     validator_id: str = Field(..., description="The ID of the validator")

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/backend/infrahub/auth.py

@@ -3,27 +3,37 @@ from __future__ import annotations
 import uuid
 from datetime import datetime, timedelta, timezone
 from enum import Enum
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
 
 import bcrypt
 import jwt
 from pydantic import BaseModel
 
 from infrahub import config, models
-from infrahub.config import SecurityOAuth2Google, SecurityOAuth2Settings, SecurityOIDCGoogle, SecurityOIDCSettings
+from infrahub.config import (
+    SecurityOAuth2Google,
+    SecurityOAuth2Settings,
+    SecurityOIDCGoogle,
+    SecurityOIDCSettings,
+)
 from infrahub.core.account import validate_token
 from infrahub.core.constants import AccountStatus, InfrahubKind
 from infrahub.core.manager import NodeManager
 from infrahub.core.node import Node
 from infrahub.core.protocols import CoreAccount, CoreAccountGroup
 from infrahub.core.registry import registry
-from infrahub.exceptions import AuthorizationError, NodeNotFoundError
+from infrahub.exceptions import AuthorizationError, GatewayError, NodeNotFoundError
+from infrahub.log import get_logger
 
 if TYPE_CHECKING:
+    import httpx
+
     from infrahub.core.protocols import CoreGenericAccount
     from infrahub.database import InfrahubDatabase
     from infrahub.services import InfrahubServices
 
+log = get_logger()
+
 
 class AuthType(str, Enum):
     NONE = "none"
@@ -256,3 +266,127 @@ async def get_groups_from_provider(
                 return [membership["groupKey"]["id"] for membership in group_memberships["memberships"]]
 
     return []
+
+
+def safe_get_response_body(response: httpx.Response, raise_error_on_empty_body: bool = True) -> str | dict[str, Any]:
+    """Safely extract response body from HTTP response. If the response body cannot be JSON parsed or is empty,
+    it raises a GatewayError.
+
+    Args:
+        response: The HTTP response object
+        raise_error_on_empty_body: Whether to raise an error if the response body is empty
+
+    Returns:
+        The response body as JSON dict if possible, otherwise as text
+
+    Raises:
+        GatewayError: When the response body cannot be parsed or is empty
+    """
+    # Try to parse as JSON first
+    try:
+        return response.json()
+    except Exception as json_error:
+        try:
+            # Try to get as text
+            text_body = response.text
+            if not text_body.strip() and raise_error_on_empty_body:  # Check for empty or whitespace-only response
+                log.error(
+                    "Empty response body from authentication provider",
+                    url=str(response.url),
+                    status_code=response.status_code,
+                )
+                raise GatewayError(message="Authentication provider returned an empty response") from json_error
+        except Exception:
+            log.error(
+                "Unable to read response body from authentication provider",
+                url=str(response.url),
+                status_code=response.status_code,
+            )
+            raise GatewayError(message="Unable to read response from authentication provider") from json_error
+
+    # Here it means we got a text response but not JSON
+    return text_body
+
+
+def extract_auth_error_message(response_body: str | dict[str, Any], base_message: str) -> str:
+    """Extract error message from OAuth 2.0/OIDC provider response following RFC 6749.
+
+    Args:
+        response_body: The response body from the authentication provider
+        base_message: Base error message to use if no specific error is found
+
+    Returns:
+        Formatted error message with provider details if available
+    """
+    if not isinstance(response_body, dict):
+        return base_message
+
+    # RFC 6749 standard error response format
+    error_description = response_body.get("error_description")
+    error_code = response_body.get("error")
+
+    if error_description:
+        return f"{base_message}: {error_description}"
+    if error_code:
+        return f"{base_message}: {error_code}"
+
+    return base_message
+
+
+def validate_auth_response(response: httpx.Response, provider_type: str = "authentication") -> None:
+    """Validate HTTP response from OAuth 2.0/OIDC provider and raise appropriate errors.
+
+    Args:
+        response: The HTTP response from the authentication provider
+        provider_type: Type of provider for logging (e.g., "OAuth 2.0", "OIDC")
+
+    Raises:
+        GatewayError: When the response indicates an error or invalid state
+    """
+    # If the status code is successful, simply return
+    if 200 <= response.status_code <= 299:
+        # Verify that we can read the response body safely and it is not empty
+        safe_get_response_body(response)
+        return
+
+    # Prepare variables with default values for logging
+    response_body = safe_get_response_body(response, raise_error_on_empty_body=False)
+    log_message: str = f"Unexpected response from {provider_type} provider"
+    base_msg: str = "Unexpected response from authentication provider."
+
+    # Handle specific HTTP status codes with appropriate error messages
+    match response.status_code:
+        case 400:
+            log_message = f"Bad request to {provider_type} provider"
+            base_msg = "Bad request to authentication provider. Please try again later or contact your administrator."
+
+        case 401:
+            log_message = f"Unauthorized request to {provider_type} provider"
+            base_msg = (
+                "Unauthorized request to authentication provider. Please try again later or contact your administrator."
+            )
+
+        case 403:
+            log_message = f"Forbidden request to {provider_type} provider"
+            base_msg = (
+                "Access forbidden by authentication provider. Please try again later or contact your administrator."
+            )
+
+        case 404:
+            log_message = f"Resource not found for {provider_type} provider"
+            base_msg = (
+                "Authentication provider endpoint not found. Please try again later or contact your administrator."
+            )
+
+        case 429:
+            log_message = f"Rate limited by {provider_type} provider"
+            base_msg = "Rate limited by authentication provider. Please try again later."
+
+        case status_code if 500 <= status_code <= 599:
+            log_message = f"Server error from {provider_type} provider"
+            base_msg = "Authentication provider is experiencing server issues. Please try again later or contact your administrator."
+
+    # Print proper log and raise gateway error
+    log.error(log_message, url=str(response.url), status_code=response.status_code, body=response_body)
+    error_msg = extract_auth_error_message(response_body, base_msg)
+    raise GatewayError(message=error_msg)

{infrahub_server-1.4.9 → infrahub_server-1.4.11}/backend/infrahub/cli/db.py

@@ -54,6 +54,7 @@ from infrahub.log import get_logger
 
 from .constants import ERROR_BADGE, FAILED_BADGE, SUCCESS_BADGE
 from .db_commands.check_inheritance import check_inheritance
+from .db_commands.clean_duplicate_schema_fields import clean_duplicate_schema_fields
 from .patch import patch_app
 
 
@@ -200,6 +201,29 @@ async def check_inheritance_cmd(
     await dbdriver.close()
 
 
+@app.command(name="check-duplicate-schema-fields")
+async def check_duplicate_schema_fields_cmd(
+    ctx: typer.Context,
+    fix: bool = typer.Option(False, help="Fix the duplicate schema fields on the default branch."),
+    config_file: str = typer.Argument("infrahub.toml", envvar="INFRAHUB_CONFIG"),
+) -> None:
+    """Check for any duplicate schema attributes or relationships on the default branch"""
+    logging.getLogger("infrahub").setLevel(logging.WARNING)
+    logging.getLogger("neo4j").setLevel(logging.ERROR)
+    logging.getLogger("prefect").setLevel(logging.ERROR)
+
+    config.load_and_exit(config_file_name=config_file)
+
+    context: CliContext = ctx.obj
+    dbdriver = await context.init_db(retry=1)
+
+    success = await clean_duplicate_schema_fields(db=dbdriver, fix=fix)
+    if not success:
+        raise typer.Exit(code=1)
+
+    await dbdriver.close()
+
+
 @app.command(name="update-core-schema")
 async def update_core_schema_cmd(
     ctx: typer.Context,