interloper-api 0.16.0__tar.gz → 0.18.0__tar.gz

{interloper_api-0.16.0 → interloper_api-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: interloper-api
-Version: 0.16.0
+Version: 0.18.0
 Summary: Interloper FastAPI routes
 Author: Guillaume Onfroy
 Author-email: Guillaume Onfroy <guillaume@digitlcloud.com>

{interloper_api-0.16.0 → interloper_api-0.18.0}/pyproject.toml

@@ -3,7 +3,7 @@
 # ###############
 [project]
 name = "interloper-api"
-version = "0.16.0"
+version = "0.18.0"
 description = "Interloper FastAPI routes"
 readme = "README.md"
 authors = [{ name = "Guillaume Onfroy", email = "guillaume@digitlcloud.com" }]

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/app.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from typing import Any
 
 from fastapi import APIRouter, FastAPI
@@ -27,6 +28,8 @@ from interloper_api.routes import (
 )
 from interloper_api.routes import catalog as catalog_routes
 
+logger = logging.getLogger(__name__)
+
 
 def create_app(
     store: Store | None = None,
@@ -91,7 +94,10 @@ def create_app(
 
         api.include_router(agent_routes.router, prefix="/agent", tags=["agent"])
     except ImportError:
-        pass
+        logger.warning(
+            "Agent routes not mounted: the 'agent' extra is not installed "
+            "(install interloper-api[agent]); /agent endpoints will return 404."
+        )
 
     @api.get("/health")
     def health() -> dict[str, str]:

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/dependencies.py

@@ -217,6 +217,40 @@ def get_org_id(
 # -- RBAC dependencies -------------------------------------------------------
 
 
+def authorize_org_member(
+    user: Profile,
+    org_id: UUID,
+    store: Store,
+    *,
+    minimum: str = "viewer",
+    detail: str = "Not found",
+) -> None:
+    """Authorize access to a resource owned by ``org_id`` by membership.
+
+    Unlike the ``require_*`` dependencies, which bind to the session's *active*
+    organisation, this checks the user's role in the resource's organisation —
+    so ID-addressed endpoints work for members of the owning org regardless of
+    which org is currently selected. Non-members get a 404 carrying the same
+    ``detail`` as a missing resource, so IDs don't act as an existence oracle;
+    members with an insufficient role get a 403.
+
+    Args:
+        user: The authenticated user.
+        org_id: The organisation that owns the resource.
+        store: The Store instance.
+        minimum: Minimum role required (``viewer``, ``editor``, ``admin``).
+        detail: 404 detail, matching the route's missing-resource message.
+
+    Raises:
+        HTTPException: 404 if not a member, 403 if the role is insufficient.
+    """
+    role = store.get_user_role(user.id, org_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail=detail)
+    if _ROLE_RANK.get(role, -1) < _ROLE_RANK[minimum]:
+        raise HTTPException(status_code=403, detail=f"Requires {minimum} role or higher")
+
+
 def _check_role(
     minimum: str,
     user: Profile,

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/assets.py

@@ -12,7 +12,14 @@ from interloper_db.models import Asset, AssetResource, Destination, DestinationR
 from pydantic import BaseModel
 from sqlmodel import Session, select
 
-from interloper_api.dependencies import get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import (
+    authorize_org_member,
+    get_current_user,
+    get_org_id,
+    get_store,
+    require_editor,
+    require_viewer,
+)
 
 router = APIRouter()
 
@@ -116,6 +123,30 @@ def _dest_to_response(dest: Destination) -> DestinationResponse:
     )
 
 
+def _load_authorized_asset(asset_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> Asset:
+    """Load an asset and authorize the user by membership in its org.
+
+    Args:
+        asset_id: The asset UUID.
+        user: The authenticated user.
+        store: The Store instance.
+        minimum: Minimum role required in the asset's organisation.
+
+    Returns:
+        The Asset row.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        asset = store.get_asset(asset_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
+    authorize_org_member(user, asset.org_id, store, minimum=minimum, detail=f"Asset {asset_id} not found")
+    return asset
+
+
 def _asset_to_response(asset: Asset) -> AssetResponse:
     """Convert a DB Asset to an AssetResponse."""
     return AssetResponse(
@@ -183,14 +214,11 @@ def list_dependencies(
 @router.get("/{asset_id}")
 def get_asset(
     asset_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> AssetResponse:
-    """Get a single asset by ID."""
-    try:
-        asset = store.get_asset(asset_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
+    """Get a single asset by ID. Authorized by membership in the asset's org."""
+    asset = _load_authorized_asset(asset_id, user, store)
     return _asset_to_response(asset)
 
 
@@ -198,10 +226,11 @@ def get_asset(
 def update_asset(
     asset_id: UUID,
     body: AssetUpdateRequest,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> AssetResponse:
     """Update an asset's configuration, resources, or destinations."""
+    _load_authorized_asset(asset_id, user, store, minimum="editor")
     try:
         asset = store.update_asset(
             asset_id,
@@ -218,10 +247,11 @@ def update_asset(
 @router.delete("/{asset_id}")
 def delete_asset(
     asset_id: UUID,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Delete a standalone asset."""
+    _load_authorized_asset(asset_id, user, store, minimum="editor")
     try:
         store.delete_asset(asset_id)
     except NotFoundError:
@@ -238,10 +268,14 @@ def delete_asset(
 def add_dependency(
     asset_id: UUID,
     body: AddDependencyRequest,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> DependencyResponse:
-    """Add a dependency between two assets."""
+    """Add a dependency between two assets. Both must belong to the same org."""
+    asset = _load_authorized_asset(asset_id, user, store, minimum="editor")
+    upstream = _load_authorized_asset(body.upstream_asset_id, user, store, minimum="editor")
+    if upstream.org_id != asset.org_id:
+        raise HTTPException(status_code=404, detail=f"Asset {body.upstream_asset_id} not found")
     try:
         dep = store.add_dependency(asset_id, body.upstream_asset_id, body.param_name)
     except NotFoundError as e:
@@ -256,10 +290,11 @@ def add_dependency(
 def remove_dependency(
     asset_id: UUID,
     upstream_asset_id: UUID,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> None:
     """Remove an asset dependency."""
+    _load_authorized_asset(asset_id, user, store, minimum="editor")
     try:
         store.remove_dependency(asset_id, upstream_asset_id)
     except NotFoundError as e:
@@ -272,11 +307,11 @@ def remove_dependency(
 @router.get("/{asset_id}/partition-row-counts")
 def get_partition_row_counts(
     asset_id: UUID,
-    user: Profile = Depends(require_viewer),
-    org_id: UUID = Depends(get_org_id),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> PartitionRowCountsResponse:
     """Get row counts grouped by partition for an asset."""
+    _load_authorized_asset(asset_id, user, store)
     try:
         il_asset = store.load_asset(asset_id)
     except NotFoundError as e:

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/backfills.py

@@ -11,7 +11,7 @@ from interloper_db import Profile, Store
 from interloper_db.models import Backfill
 from pydantic import BaseModel
 
-from interloper_api.dependencies import get_org_id, get_store, require_viewer
+from interloper_api.dependencies import authorize_org_member, get_current_user, get_org_id, get_store, require_viewer
 
 router = APIRouter()
 
@@ -76,12 +76,13 @@ def list_backfills(
 @router.get("/{backfill_id}")
 def get_backfill(
     backfill_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> BackfillResponse:
-    """Get a single backfill by ID."""
+    """Get a single backfill by ID. Authorized by membership in the backfill's org."""
     try:
         backfill = store.get_backfill(backfill_id)
     except NotFoundError:
         raise HTTPException(status_code=404, detail=f"Backfill {backfill_id} not found")
+    authorize_org_member(user, backfill.org_id, store, detail=f"Backfill {backfill_id} not found")
     return _backfill_to_response(backfill)

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/destinations.py

@@ -7,11 +7,18 @@ from uuid import UUID
 
 from fastapi import APIRouter, Depends, HTTPException
 from interloper.errors import NotFoundError
-from interloper_db import Store
+from interloper_db import Profile, Store
 from interloper_db.models import Destination, DestinationResource
 from pydantic import BaseModel
 
-from interloper_api.dependencies import get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import (
+    authorize_org_member,
+    get_current_user,
+    get_org_id,
+    get_store,
+    require_editor,
+    require_viewer,
+)
 
 router = APIRouter()
 
@@ -87,14 +94,29 @@ def create_destination(
     return _to_response(dest)
 
 
+def _authorize_destination(destination_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> None:
+    """Authorize the user by membership in the destination's org.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        dest = store.get_destination(destination_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Destination {destination_id} not found")
+    authorize_org_member(user, dest.org_id, store, minimum=minimum, detail=f"Destination {destination_id} not found")
+
+
 @router.put("/{destination_id}")
 def update_destination(
     destination_id: UUID,
     body: DestinationCreateRequest,
-    user: object = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> DestinationResponse:
     """Update a destination."""
+    _authorize_destination(destination_id, user, store, minimum="editor")
     try:
         dest = store.update_destination(
             destination_id,
@@ -110,9 +132,10 @@ def update_destination(
 @router.delete("/{destination_id}")
 def delete_destination(
     destination_id: UUID,
-    user: object = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Delete a destination."""
+    _authorize_destination(destination_id, user, store, minimum="editor")
     store.delete_destination(destination_id)
     return {"status": "deleted"}

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/external/__init__.py

@@ -36,6 +36,7 @@ def handle_error(error: Exception, context: str) -> None:
 
 # Import and register sub-routers after helpers are defined.
 from interloper_api.routes.external.amazon_ads import sub_router as amazon_ads_router  # noqa: E402
+from interloper_api.routes.external.criteo import sub_router as criteo_router  # noqa: E402
 from interloper_api.routes.external.facebook_ads import sub_router as facebook_ads_router  # noqa: E402
 from interloper_api.routes.external.google_ads import sub_router as google_ads_router  # noqa: E402
 from interloper_api.routes.external.google_cloud import sub_router as google_cloud_router  # noqa: E402
@@ -45,6 +46,7 @@ from interloper_api.routes.external.snapchat_ads import sub_router as snapchat_a
 from interloper_api.routes.external.tiktok_ads import sub_router as tiktok_ads_router  # noqa: E402
 
 router.include_router(amazon_ads_router)
+router.include_router(criteo_router)
 router.include_router(facebook_ads_router)
 router.include_router(google_ads_router)
 router.include_router(google_cloud_router)

interloper_api-0.18.0/src/interloper_api/routes/external/criteo.py

@@ -0,0 +1,68 @@
+"""Criteo external API routes."""
+
+from __future__ import annotations
+
+import httpx
+from fastapi import APIRouter, Depends
+from interloper_db import Profile
+from pydantic import BaseModel
+
+from interloper_api.dependencies import require_viewer
+from interloper_api.routes.external import handle_error
+
+sub_router = APIRouter()
+
+_BASE_URL = "https://api.criteo.com"
+_TOKEN_URL = f"{_BASE_URL}/oauth2/token"
+_ADVERTISERS_URL = f"{_BASE_URL}/2025-04/advertisers/me"
+
+
+class CriteoConnectionRequest(BaseModel):
+    """Criteo connection credentials (matches CriteoConnection fields)."""
+
+    client_id: str
+    client_secret: str
+    refresh_token: str
+
+
+async def _get_access_token(client: httpx.AsyncClient, body: CriteoConnectionRequest) -> str:
+    """Exchange the refresh token for an access token."""
+    resp = await client.post(
+        _TOKEN_URL,
+        data={
+            "grant_type": "refresh_token",
+            "client_id": body.client_id,
+            "client_secret": body.client_secret,
+            "refresh_token": body.refresh_token,
+        },
+    )
+    resp.raise_for_status()
+    return resp.json()["access_token"]
+
+
+async def _list_advertisers(client: httpx.AsyncClient, body: CriteoConnectionRequest) -> list[dict[str, str]]:
+    """List the advertisers the connection can access, sorted by name."""
+    token = await _get_access_token(client, body)
+    resp = await client.get(_ADVERTISERS_URL, headers={"Authorization": f"Bearer {token}"})
+    resp.raise_for_status()
+
+    advertisers = resp.json().get("data", [])
+    results = [
+        {"id": a["id"], "name": a.get("attributes", {}).get("advertiserName") or a["id"]}
+        for a in advertisers
+    ]
+    return sorted(results, key=lambda a: a["name"].lower())
+
+
+@sub_router.post("/criteo/advertisers")
+async def criteo_advertisers(
+    body: CriteoConnectionRequest,
+    _user: Profile = Depends(require_viewer),
+) -> list[dict[str, str]]:
+    """Fetch the Criteo advertisers accessible by the connection."""
+    try:
+        async with httpx.AsyncClient(timeout=30) as client:
+            return await _list_advertisers(client, body)
+    except Exception as exc:
+        handle_error(exc, "fetching Criteo advertisers")
+        return []

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/jobs.py

@@ -11,7 +11,14 @@ from interloper_db import Profile, Store
 from interloper_db.models import Job
 from pydantic import BaseModel
 
-from interloper_api.dependencies import get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import (
+    authorize_org_member,
+    get_current_user,
+    get_org_id,
+    get_store,
+    require_editor,
+    require_viewer,
+)
 
 router = APIRouter()
 
@@ -62,6 +69,30 @@ class BackfillRequest(BaseModel):
     fail_fast: bool = False
 
 
+def _load_authorized_job(job_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> Job:
+    """Load a job and authorize the user by membership in its org.
+
+    Args:
+        job_id: The job UUID.
+        user: The authenticated user.
+        store: The Store instance.
+        minimum: Minimum role required in the job's organisation.
+
+    Returns:
+        The Job row.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        job = store.get_job(job_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    authorize_org_member(user, job.org_id, store, minimum=minimum, detail=f"Job {job_id} not found")
+    return job
+
+
 def _job_to_response(job: Job) -> JobResponse:
     """Convert a DB Job to a JobResponse.
 
@@ -102,14 +133,11 @@ def list_jobs(
 @router.get("/{job_id}")
 def get_job(
     job_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> JobResponse:
-    """Get a single job by ID."""
-    try:
-        job = store.get_job(job_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    """Get a single job by ID. Authorized by membership in the job's org."""
+    job = _load_authorized_job(job_id, user, store)
     return _job_to_response(job)
 
 
@@ -139,10 +167,11 @@ def create_job(
 def update_job(
     job_id: UUID,
     body: JobCreateRequest,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> JobResponse:
     """Update an existing job."""
+    _load_authorized_job(job_id, user, store, minimum="editor")
     try:
         job = store.update_job(
             job_id,
@@ -163,10 +192,11 @@ def update_job(
 @router.delete("/{job_id}")
 def delete_job(
     job_id: UUID,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Delete a job."""
+    _load_authorized_job(job_id, user, store, minimum="editor")
     store.delete_job(job_id)
     return {"status": "deleted"}
 
@@ -175,14 +205,11 @@ def delete_job(
 def queue_run(
     job_id: UUID,
     body: RunRequest | None = None,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Queue a single run for a job."""
-    try:
-        job = store.get_job(job_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    job = _load_authorized_job(job_id, user, store, minimum="editor")
 
     run = store.create_run(
         job.org_id,
@@ -196,14 +223,11 @@ def queue_run(
 def queue_backfill(
     job_id: UUID,
     body: BackfillRequest,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Queue a backfill for a job."""
-    try:
-        job = store.get_job(job_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
+    job = _load_authorized_job(job_id, user, store, minimum="editor")
 
     backfill = store.create_backfill(
         job.org_id,

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/oauth.py

@@ -24,10 +24,13 @@ import os
 from typing import Any
 
 import httpx
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from interloper.oauth import OAuthProvider, providers
+from interloper_db import Profile
 from pydantic import BaseModel
 
+from interloper_api.dependencies import get_current_user
+
 logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/oauth", tags=["oauth"])
@@ -77,8 +80,10 @@ async def _exchange(
         code: The authorization code.
 
     Returns:
-        The token response, with ``client_id`` / ``client_secret`` injected
-        so they can be stored alongside the tokens.
+        The provider's raw token response (e.g. ``refresh_token``). The app
+        credentials are *not* injected: they are the in-house per-provider
+        values resolved from env at runtime, so the secret never leaves the
+        server.
     """
     logical_values = {
         "grant_type": "authorization_code",
@@ -103,10 +108,7 @@ async def _exchange(
         resp = await client.post(spec.token_url, json=params, headers=headers)
     resp.raise_for_status()
 
-    result = resp.json()
-    result["client_id"] = cfg.client_id
-    result["client_secret"] = cfg.client_secret
-    return result
+    return resp.json()
 
 
 # ---------------------------------------------------------------------------
@@ -155,11 +157,16 @@ def list_providers() -> list[ProviderInfo]:
 
 
 @router.post("/{provider}")
-async def exchange_token(provider: str, body: TokenExchangeRequest) -> dict[str, Any]:
-    """Exchange an authorization code for tokens.
+async def exchange_token(
+    provider: str,
+    body: TokenExchangeRequest,
+    _user: Profile = Depends(get_current_user),
+) -> dict[str, Any]:
+    """Exchange an authorization code for tokens. Requires authentication.
 
-    The response includes ``client_id`` and ``client_secret`` so they
-    can be stored alongside the tokens in the connection data.
+    Returns only the provider's token response (e.g. ``refresh_token``); the
+    in-house app credentials are never included — connections resolve them
+    from env at runtime.
     """
     spec = providers().get(provider)
     if spec is None:

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/organisations.py

@@ -240,6 +240,9 @@ def cancel_invitation(
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Cancel a pending invitation. Requires admin role."""
+    invitations = store.list_invitations(org_id)
+    if not any(inv.id == invitation_id for inv in invitations):
+        raise HTTPException(status_code=404, detail="Invitation not found")
     if not store.delete_invitation(invitation_id):
         raise HTTPException(status_code=404, detail="Invitation not found")
 

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/resources.py

@@ -8,9 +8,18 @@ from uuid import UUID
 from fastapi import APIRouter, Depends, HTTPException
 from interloper.errors import NotFoundError
 from interloper_db import Profile, Store
+from interloper_db.models import Resource
 from pydantic import BaseModel
 
-from interloper_api.dependencies import get_catalog, get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import (
+    authorize_org_member,
+    get_catalog,
+    get_current_user,
+    get_org_id,
+    get_store,
+    require_editor,
+    require_viewer,
+)
 
 router = APIRouter()
 
@@ -49,6 +58,30 @@ class ResourceDetailResponse(ResourceResponse):
     data: dict[str, Any] = {}
 
 
+def _load_authorized_resource(resource_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> Resource:
+    """Load a resource and authorize the user by membership in its org.
+
+    Args:
+        resource_id: The resource UUID.
+        user: The authenticated user.
+        store: The Store instance.
+        minimum: Minimum role required in the resource's organisation.
+
+    Returns:
+        The Resource row.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        resource = store.load_resource(resource_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Resource {resource_id} not found")
+    authorize_org_member(user, resource.org_id, store, minimum=minimum, detail=f"Resource {resource_id} not found")
+    return resource
+
+
 @router.get("/kinds")
 def list_resource_kinds(
     catalog: dict[str, Any] = Depends(get_catalog),
@@ -90,14 +123,14 @@ def list_resources(
 @router.get("/{resource_id}")
 def get_resource(
     resource_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> ResourceDetailResponse:
-    """Get a single resource by ID, including its data payload."""
-    try:
-        r = store.load_resource(resource_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Resource {resource_id} not found")
+    """Get a single resource by ID, including its data payload.
+
+    Authorized by membership in the resource's org.
+    """
+    r = _load_authorized_resource(resource_id, user, store)
 
     return ResourceDetailResponse(
         id=r.id,
@@ -144,10 +177,11 @@ def create_resource(
 def update_resource(
     resource_id: UUID,
     body: ResourceCreateRequest,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> ResourceResponse:
     """Update an existing resource."""
+    _load_authorized_resource(resource_id, user, store, minimum="editor")
     try:
         resource = store.update_resource(
             resource_id,
@@ -174,9 +208,10 @@ def update_resource(
 @router.delete("/{resource_id}")
 def delete_resource(
     resource_id: UUID,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Delete a resource."""
+    _load_authorized_resource(resource_id, user, store, minimum="editor")
     store.delete_resource(resource_id)
     return {"status": "deleted"}

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/runs.py

@@ -12,7 +12,7 @@ from interloper_db import Profile, Store
 from interloper_db.models import Event, Run
 from pydantic import BaseModel
 
-from interloper_api.dependencies import get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import authorize_org_member, get_current_user, get_org_id, get_store, require_viewer
 
 router = APIRouter()
 
@@ -100,6 +100,30 @@ def _run_to_response(run: Run) -> RunResponse:
     )
 
 
+def _load_authorized_run(run_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> Run:
+    """Load a run and authorize the user by membership in its org.
+
+    Args:
+        run_id: The run UUID.
+        user: The authenticated user.
+        store: The Store instance.
+        minimum: Minimum role required in the run's organisation.
+
+    Returns:
+        The Run row.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        run = store.get_run(run_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Run {run_id} not found")
+    authorize_org_member(user, run.org_id, store, minimum=minimum, detail=f"Run {run_id} not found")
+    return run
+
+
 def _event_to_response(event: Event) -> EventResponse:
     """Convert a DB Event to an EventResponse.
 
@@ -158,24 +182,22 @@ def list_runs(
 @router.get("/{run_id}")
 def get_run(
     run_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> RunResponse:
-    """Get a single run by ID."""
-    try:
-        run = store.get_run(run_id)
-    except NotFoundError:
-        raise HTTPException(status_code=404, detail=f"Run {run_id} not found")
+    """Get a single run by ID. Authorized by membership in the run's org."""
+    run = _load_authorized_run(run_id, user, store)
     return _run_to_response(run)
 
 
 @router.get("/{run_id}/asset-executions")
 def list_asset_executions(
     run_id: UUID,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> list[AssetExecutionResponse]:
     """List asset executions for a run."""
+    _load_authorized_run(run_id, user, store)
     rows = store.list_asset_executions(run_id)
     return [
         AssetExecutionResponse(
@@ -196,7 +218,7 @@ def list_asset_executions(
 def retry_run(
     run_id: UUID,
     body: RetryRequest | None = None,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Queue a retry of a failed run.
@@ -205,6 +227,7 @@ def retry_run(
     ``scope="all"`` the whole DAG re-runs; with ``scope="failed"`` only the
     previously failed/cancelled assets re-run.
     """
+    _load_authorized_run(run_id, user, store, minimum="editor")
     scope = body.scope if body else "all"
     try:
         run = store.retry_run(run_id, scope=scope)
@@ -222,7 +245,7 @@ def list_run_events(
     limit: int = 100,
     offset: int = 0,
     asset_id: UUID | None = None,
-    user: Profile = Depends(require_viewer),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> list[EventResponse]:
     """List events for a run, oldest first.
@@ -234,6 +257,7 @@ def list_run_events(
     through every event — including the terminal/outcome events
     (``asset_completed``, ``asset_failed``, ``run_failed``, …) that sort last.
     """
+    _load_authorized_run(run_id, user, store)
     limit = max(1, min(limit, MAX_EVENTS_PAGE_SIZE))
     offset = max(0, offset)
     total = store.count_events(run_id=run_id, asset_id=asset_id)

{interloper_api-0.16.0 → interloper_api-0.18.0}/src/interloper_api/routes/sources.py

@@ -13,7 +13,14 @@ from pydantic import BaseModel
 from sqlalchemy.orm import selectinload
 from sqlmodel import Session, select
 
-from interloper_api.dependencies import get_org_id, get_store, require_editor, require_viewer
+from interloper_api.dependencies import (
+    authorize_org_member,
+    get_current_user,
+    get_org_id,
+    get_store,
+    require_editor,
+    require_viewer,
+)
 
 router = APIRouter()
 
@@ -152,15 +159,29 @@ def create_source(
     return _load_source_for_response(source.id)
 
 
+def _authorize_source(source_id: UUID, user: Profile, store: Store, *, minimum: str = "viewer") -> None:
+    """Authorize the user by membership in the source's org.
+
+    Raises:
+        HTTPException: 404 if missing or the user is not a member of the
+            owning org, 403 if the role is insufficient.
+    """
+    try:
+        source = store.get_source(source_id)
+    except NotFoundError:
+        raise HTTPException(status_code=404, detail=f"Source {source_id} not found")
+    authorize_org_member(user, source.org_id, store, minimum=minimum, detail=f"Source {source_id} not found")
+
+
 @router.put("/{source_id}")
 def update_source(
     source_id: UUID,
     body: SourceCreateRequest,
-    user: Profile = Depends(require_editor),
-    org_id: UUID = Depends(get_org_id),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> SourceResponse:
     """Update a source."""
+    _authorize_source(source_id, user, store, minimum="editor")
     try:
         store.update_source(
             source_id,
@@ -179,9 +200,10 @@ def update_source(
 @router.delete("/{source_id}")
 def delete_source(
     source_id: UUID,
-    user: Profile = Depends(require_editor),
+    user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
     """Delete a source. Assets cascade via FK."""
+    _authorize_source(source_id, user, store, minimum="editor")
     store.delete_source(source_id)
     return {"status": "deleted"}