interloper-api 0.32.0__tar.gz → 0.33.0__tar.gz

{interloper_api-0.32.0 → interloper_api-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: interloper-api
-Version: 0.32.0
+Version: 0.33.0
 Summary: Interloper FastAPI routes
 Author: Guillaume Onfroy
 Author-email: Guillaume Onfroy <guillaume@digitlcloud.com>

{interloper_api-0.32.0 → interloper_api-0.33.0}/pyproject.toml

@@ -3,7 +3,7 @@
 # ###############
 [project]
 name = "interloper-api"
-version = "0.32.0"
+version = "0.33.0"
 description = "Interloper FastAPI routes"
 readme = "README.md"
 authors = [{ name = "Guillaume Onfroy", email = "guillaume@digitlcloud.com" }]

{interloper_api-0.32.0 → interloper_api-0.33.0}/src/interloper_api/app.py

@@ -18,7 +18,6 @@ from interloper_api.routes import (
     auth,
     backfills,
     components,
-    external,
     oauth,
     organisations,
     runs,
@@ -97,7 +96,6 @@ def create_app(
     api.include_router(runs.router, prefix="/runs", tags=["runs"])
     api.include_router(backfills.router, prefix="/backfills", tags=["backfills"])
     api.include_router(oauth.router, tags=["oauth"])
-    api.include_router(external.router, prefix="/external", tags=["external"])
     api.include_router(ws.router, tags=["ws"])
 
     agent_available = False
@@ -122,4 +120,6 @@ def create_app(
 
     app.include_router(api)
 
+    oauth.log_provider_status()
+
     return app

{interloper_api-0.32.0 → interloper_api-0.33.0}/src/interloper_api/routes/components.py

@@ -1,4 +1,9 @@
-"""Components API: one generic CRUD surface for every component kind.
+"""Components API: one surface for every component operation.
+
+A generic CRUD for persisted instances of every component kind, plus the
+type-level operations that execute a component class against a candidate,
+unsaved config — resolving a FetchField's options (``/resolve``) and
+checking a connection (``/check``).
 
 The response shape is kind-agnostic — identity, drift ``status``, ``config``
 (decoded for secret kinds on detail responses), machine-owned ``state``,
@@ -9,16 +14,33 @@ come from the catalog (``/catalog``), not from this router.
 
 from __future__ import annotations
 
-from typing import Annotated, Any
+import asyncio
+import logging
+from typing import Annotated, Any, Literal
 from uuid import UUID
 
+import httpx
 from fastapi import APIRouter, Depends, HTTPException, Query
+from interloper.catalog.base import Catalog
 from interloper.component import KINDS
-from interloper.errors import CatalogKeyError, ComponentDriftError, ConfigError, DataNotFoundError, NotFoundError
+from interloper.connection.base import Connection
+from interloper.errors import (
+    CatalogKeyError,
+    ComponentDriftError,
+    ConfigError,
+    ConnectionCheckError,
+    DataNotFoundError,
+    InUseError,
+    NotFoundError,
+)
+from interloper.resource.fields import is_fetch_field_provider
+from interloper.utils.concurrency import invoke
+from interloper.utils.imports import import_from_path
 from interloper_db import Component, ComponentStatus, Profile, Store
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, ValidationError
 
 from interloper_api.dependencies import (
+    get_catalog,
     get_current_user,
     get_org_id,
     get_store,
@@ -27,6 +49,8 @@ from interloper_api.dependencies import (
     require_viewer,
 )
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter()
 
 
@@ -284,12 +308,14 @@ def delete_component(
     user: Profile = Depends(get_current_user),
     store: Store = Depends(get_store),
 ) -> dict[str, str]:
-    """Delete a component. Children and relations cascade."""
+    """Delete a component. Refused (409) while other components are bound to it."""
     load_authorized(store.get_component, component_id, user, store, label="Component", minimum="editor")
     try:
         store.delete_component(component_id)
     except NotFoundError as e:
         raise HTTPException(status_code=404, detail=str(e))
+    except InUseError as e:
+        raise HTTPException(status_code=409, detail={"message": str(e), "used_by": e.referrers})
     except ValueError as e:
         raise HTTPException(status_code=400, detail=str(e))
     return {"status": "deleted"}
@@ -366,3 +392,200 @@ def get_partition_row_counts(
         partition_column=partitioning.column,
         counts=[PartitionRowCountItem(partition=str(k), row_count=v) for k, v in sorted(counts.items())],
     )
+
+
+# -- Field resolution ----------------------------------------------------------
+
+
+def handle_error(error: Exception, context: str) -> None:
+    """Map external API errors to appropriate HTTP responses."""
+    logger.error("Error %s: %s", context, error)
+
+    if isinstance(error, httpx.HTTPStatusError):
+        status = error.response.status_code
+        if status in (401, 403):
+            raise HTTPException(status_code=status, detail=f"Authorization failed while {context}.")
+        if status == 404:
+            raise HTTPException(status_code=404, detail=f"Resource not found while {context}.")
+
+    if isinstance(error, HTTPException):
+        raise error
+
+    raise HTTPException(status_code=500, detail=f"Failed {context}.")
+
+
+class ResolveRequest(BaseModel):
+    """A request to resolve one provider-backed FetchField's options."""
+
+    component_key: str
+    field: str
+    # Credentials per resource slot, e.g. {"connection": {"access_token": ...}}.
+    deps: dict[str, dict[str, Any]] = {}
+
+
+@router.post("/resolve")
+async def resolve_fetch_field(
+    body: ResolveRequest,
+    catalog: Catalog = Depends(get_catalog),
+    _user: Profile = Depends(require_viewer),
+) -> list[dict[str, Any]]:
+    """Resolve the options for a ``FetchField(provider=...)`` field.
+
+    One endpoint resolves any field declared with
+    ``FetchField(provider="<slot>.<method>")`` — there are no hand-written
+    per-provider routes. The component definition comes from the catalog
+    (authoritative — the provider reference comes from the server's schema,
+    never the client), the resource in ``<slot>`` is instantiated from the
+    credentials the form already holds, and the ``@fetch_field_provider``
+    method ``<method>`` is called on it. That marker is the allowlist: only
+    methods opted in that way may be invoked, so the browser cannot call
+    arbitrary attributes.
+    """
+    defn = catalog.get(body.component_key)
+    if defn is None:
+        raise HTTPException(status_code=404, detail=f"Unknown component '{body.component_key}'")
+
+    # Read the provider from the server's own schema, so the client cannot
+    # redirect the call to an arbitrary method.
+    prop = getattr(defn, "config_schema", {}).get("properties", {}).get(body.field, {})
+    provider = prop.get("x-fetch", {}).get("provider")
+    if not provider:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Field '{body.field}' on '{body.component_key}' is not a provider-backed FetchField",
+        )
+    slot, _, method = str(provider).partition(".")
+
+    component_cls = import_from_path(defn.path)
+    resource_cls = getattr(component_cls, "resource_types", {}).get(slot)
+    if resource_cls is None:
+        raise HTTPException(status_code=400, detail=f"Resource slot '{slot}' not found on '{body.component_key}'")
+
+    # Only pass through fields the resource actually declares — the form may
+    # carry extra markers (e.g. an internal id) that the model would reject.
+    raw = body.deps.get(slot, {})
+    creds = {k: v for k, v in raw.items() if k in resource_cls.model_fields}
+    resource = resource_cls(**creds)
+
+    fn = getattr(resource, method, None)
+    if not is_fetch_field_provider(fn):
+        # Should never happen — validated at catalog build — but guard anyway.
+        raise HTTPException(status_code=403, detail=f"'{provider}' is not a fetch provider")
+    assert fn is not None  # narrowed by the is_fetch_field_provider guard above
+
+    try:
+        result = await invoke(fn)
+    except Exception as exc:
+        handle_error(exc, f"resolving {body.component_key}.{body.field}")
+        return []
+    return list(result or [])
+
+
+# -- Connection check ----------------------------------------------------------
+
+
+#: Upper bound on a live check — the wizard must never hang on a dead host.
+CHECK_TIMEOUT = 15.0
+
+
+class FieldError(BaseModel):
+    """One static-validation error, addressed to a config field."""
+
+    field: str
+    message: str
+
+
+class CheckRequest(BaseModel):
+    """A request to check one connection's candidate config."""
+
+    component_key: str
+    config: dict[str, Any] = {}
+
+
+class CheckResponse(BaseModel):
+    """The outcome of a connection check.
+
+    ``live`` distinguishes a full check from a static-only one (the class
+    implements no ``check()`` hook). ``category`` classifies failures so the
+    UI can hint at a fix: bad ``config`` values, rejected ``auth``,
+    unreachable ``network``, or an uncategorised ``error``.
+    """
+
+    ok: bool
+    live: bool
+    message: str | None = None
+    category: Literal["config", "auth", "network", "error"] | None = None
+    errors: list[FieldError] = Field(default_factory=list)
+
+
+def _check_failure(exc: Exception, key: str) -> CheckResponse:
+    """Map a live-check exception to its response.
+
+    Full details are logged server-side only — provider errors may carry
+    URLs with tokens.
+
+    Returns:
+        The categorised failure response.
+    """
+    logger.error("Connection check failed for '%s': %s", key, exc)
+
+    if isinstance(exc, ConnectionCheckError):
+        return CheckResponse(ok=False, live=True, category="error", message=str(exc))
+    if isinstance(exc, httpx.HTTPStatusError):
+        status = exc.response.status_code
+        if status in (401, 403):
+            return CheckResponse(ok=False, live=True, category="auth", message="The provider rejected the credentials.")
+        return CheckResponse(
+            ok=False, live=True, category="error", message=f"The provider responded with HTTP {status}."
+        )
+    if isinstance(exc, (TimeoutError, httpx.TimeoutException)):
+        return CheckResponse(ok=False, live=True, category="network", message="The provider did not respond in time.")
+    if isinstance(exc, httpx.TransportError):
+        return CheckResponse(ok=False, live=True, category="network", message="The provider could not be reached.")
+    return CheckResponse(ok=False, live=True, category="error", message="The connection check failed unexpectedly.")
+
+
+@router.post("/check")
+async def check_connection(
+    body: CheckRequest,
+    catalog: Catalog = Depends(get_catalog),
+    _user: Profile = Depends(require_viewer),
+) -> CheckResponse:
+    """Check a connection's candidate config, statically and (when supported) live.
+
+    The static tier instantiates the connection class from the config the
+    form holds — pydantic validation surfaces per-field errors. The live
+    tier calls the class's ``check()`` hook (when implemented), a
+    lightweight authenticated call against the provider. A failed check is
+    this endpoint's *expected* output, so failures are reported as
+    ``ok: false`` in a 200 response, never as HTTP errors; only an unknown
+    component key is a 404.
+    """
+    defn = catalog.get(body.component_key)
+    if defn is None or defn.kind != "connection":
+        raise HTTPException(status_code=404, detail=f"Unknown connection '{body.component_key}'")
+
+    connection_cls = import_from_path(defn.path)
+    assert issubclass(connection_cls, Connection)  # guaranteed by the kind check above
+
+    # Only pass through fields the connection actually declares — the form may
+    # carry extra markers (e.g. an internal id) that the model would reject.
+    config = {k: v for k, v in body.config.items() if k in connection_cls.model_fields}
+    try:
+        conn = connection_cls(**config)
+    except ValidationError as exc:
+        errors = [FieldError(field=".".join(str(loc) for loc in e["loc"]), message=e["msg"]) for e in exc.errors()]
+        return CheckResponse(
+            ok=False, live=False, category="config", message="The configuration is invalid.", errors=errors
+        )
+
+    if not connection_cls.checkable():
+        return CheckResponse(ok=True, live=False)
+
+    try:
+        ok = bool(await asyncio.wait_for(invoke(conn.check), timeout=CHECK_TIMEOUT))
+    except Exception as exc:
+        return _check_failure(exc, body.component_key)
+    if not ok:
+        return CheckResponse(ok=False, live=True, category="error", message="The connection check failed.")
+    return CheckResponse(ok=True, live=True)

{interloper_api-0.32.0 → interloper_api-0.33.0}/src/interloper_api/routes/oauth.py

@@ -26,7 +26,7 @@ from typing import Any
 
 import httpx
 from fastapi import APIRouter, Depends, HTTPException
-from interloper.oauth import PROVIDERS, OAuthProvider
+from interloper.oauth import PROVIDERS, OAuthAppCredentials, OAuthProvider, provider_env_names
 from interloper_db import Profile
 from pydantic import BaseModel
 
@@ -37,26 +37,22 @@ logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/oauth", tags=["oauth"])
 
 
-# -- App credentials (environment) ---------------------------------------------
+def log_provider_status() -> None:
+    """Log which OAuth providers are usable, warning on partial credential trios.
 
-
-class _ProviderConfig:
-    """In-house OAuth credentials resolved from environment variables."""
-
-    def __init__(self, key: str, *, env_prefix: str | None = None) -> None:
-        prefix = (env_prefix or key).upper()
-        self.key = key
-        self.client_id = os.environ.get(f"INTERLOPER_{prefix}_CLIENT_ID", "")
-        self.client_secret = os.environ.get(f"INTERLOPER_{prefix}_CLIENT_SECRET", "")
-        self.redirect_uri = os.environ.get(f"INTERLOPER_{prefix}_REDIRECT_URI", "")
-
-    @property
-    def configured(self) -> bool:
-        return bool(self.client_id and self.client_secret and self.redirect_uri)
-
-
-def _load_providers() -> dict[str, _ProviderConfig]:
-    return {key: _ProviderConfig(key) for key in PROVIDERS.keys()}
+    Called at app startup: a provider with only some of its three env vars set
+    is invisible everywhere else (it simply isn't offered), so this warning is
+    the one place a typo'd or forgotten variable surfaces.
+    """
+    active = []
+    for key in PROVIDERS.keys():
+        names = provider_env_names(key)
+        missing = [n for n in names.values() if not os.environ.get(n)]
+        if not missing:
+            active.append(key)
+        elif len(missing) < len(names):
+            logger.warning("OAuth provider '%s' is partially configured — missing %s", key, ", ".join(sorted(missing)))
+    logger.info("OAuth sign-in providers: %s", ", ".join(sorted(active)) if active else "none configured")
 
 
 # -- Generic token exchange ----------------------------------------------------
@@ -65,7 +61,7 @@ def _load_providers() -> dict[str, _ProviderConfig]:
 async def _exchange(
     client: httpx.AsyncClient,
     spec: OAuthProvider,
-    cfg: _ProviderConfig,
+    cfg: OAuthAppCredentials,
     code: str,
 ) -> dict[str, Any]:
     """Exchange an authorization code for tokens, driven by the provider spec.
@@ -136,18 +132,17 @@ def list_providers() -> list[ProviderInfo]:
     ``REDIRECT_URI`` environment variables set are included.  Metadata
     (auth_url, label, icon) comes from the provider registry.
     """
-    specs = dict(PROVIDERS.items())
     return [
         ProviderInfo(
-            key=cfg.key,
-            client_id=cfg.client_id,
-            redirect_uri=cfg.redirect_uri,
-            auth_url=specs[cfg.key].auth_url,
-            label=specs[cfg.key].label,
-            icon=specs[cfg.key].icon,
+            key=key,
+            client_id=creds.client_id,
+            redirect_uri=creds.redirect_uri,
+            auth_url=spec.auth_url,
+            label=spec.label,
+            icon=spec.icon,
         )
-        for cfg in _load_providers().values()
-        if cfg.configured
+        for key, spec in PROVIDERS.items()
+        if (creds := OAuthAppCredentials.from_env(key)) is not None
     ]
 
 
@@ -167,8 +162,8 @@ async def exchange_token(
     if spec is None:
         raise HTTPException(status_code=400, detail=f"Unknown OAuth provider: {provider}")
 
-    cfg = _ProviderConfig(provider)
-    if not cfg.configured:
+    cfg = OAuthAppCredentials.from_env(provider)
+    if cfg is None:
         raise HTTPException(status_code=400, detail=f"OAuth provider {provider} is not configured")
 
     try:

interloper_api-0.32.0/src/interloper_api/routes/external/__init__.py

@@ -1,40 +0,0 @@
-"""External provider API routes.
-
-FetchField options are resolved by a single generic endpoint (``resolve``);
-there are no per-provider routes. Each connector exposes its lookups as
-``@fetch_field_provider`` methods on its connection class, which the resolver calls.
-"""
-
-from __future__ import annotations
-
-import logging
-
-import httpx
-from fastapi import APIRouter, HTTPException
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-def handle_error(error: Exception, context: str) -> None:
-    """Map external API errors to appropriate HTTP responses."""
-    logger.error("Error %s: %s", context, error)
-
-    if isinstance(error, httpx.HTTPStatusError):
-        status = error.response.status_code
-        if status in (401, 403):
-            raise HTTPException(status_code=status, detail=f"Authorization failed while {context}.")
-        if status == 404:
-            raise HTTPException(status_code=404, detail=f"Resource not found while {context}.")
-
-    if isinstance(error, HTTPException):
-        raise error
-
-    raise HTTPException(status_code=500, detail=f"Failed {context}.")
-
-
-# Import and register the resolver after helpers are defined.
-from interloper_api.routes.external.resolve import sub_router as resolve_router  # noqa: E402
-
-router.include_router(resolve_router)

interloper_api-0.32.0/src/interloper_api/routes/external/resolve.py

@@ -1,88 +0,0 @@
-"""Generic FetchField resolver.
-
-Replaces the hand-written per-provider ``/external/<provider>/<x>`` routes
-for fields declared with ``FetchField(provider="<slot>.<method>")``. One
-endpoint resolves any such field by:
-
-1. Looking up the component definition in the catalog (authoritative — the
-   provider reference comes from the server's schema, never the client).
-2. Importing the component class and reading the resource class in ``<slot>``.
-3. Instantiating that resource from the credentials the form already holds.
-4. Calling the ``@fetch_field_provider`` method ``<method>`` on it.
-
-The ``@fetch_field_provider`` marker is the allowlist: only methods opted in that
-way may be invoked, so the browser cannot call arbitrary attributes.
-"""
-
-from __future__ import annotations
-
-from typing import Any
-
-from fastapi import APIRouter, Depends, HTTPException
-from interloper.catalog.base import Catalog
-from interloper.resource.fields import is_fetch_field_provider
-from interloper.utils.concurrency import invoke
-from interloper.utils.imports import import_from_path
-from interloper_db import Profile
-from pydantic import BaseModel
-
-from interloper_api.dependencies import get_catalog, require_viewer
-from interloper_api.routes.external import handle_error
-
-sub_router = APIRouter()
-
-
-class ResolveRequest(BaseModel):
-    """A request to resolve one provider-backed FetchField's options."""
-
-    component_key: str
-    field: str
-    # Credentials per resource slot, e.g. {"connection": {"access_token": ...}}.
-    deps: dict[str, dict[str, Any]] = {}
-
-
-@sub_router.post("/resolve")
-async def resolve_fetch_field(
-    body: ResolveRequest,
-    catalog: Catalog = Depends(get_catalog),
-    _user: Profile = Depends(require_viewer),
-) -> list[dict[str, Any]]:
-    """Resolve the options for a ``FetchField(provider=...)`` field."""
-    defn = catalog.get(body.component_key)
-    if defn is None:
-        raise HTTPException(status_code=404, detail=f"Unknown component '{body.component_key}'")
-
-    # Read the provider from the server's own schema, so the client cannot
-    # redirect the call to an arbitrary method.
-    prop = getattr(defn, "config_schema", {}).get("properties", {}).get(body.field, {})
-    provider = prop.get("x-fetch", {}).get("provider")
-    if not provider:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Field '{body.field}' on '{body.component_key}' is not a provider-backed FetchField",
-        )
-    slot, _, method = str(provider).partition(".")
-
-    component_cls = import_from_path(defn.path)
-    resource_cls = getattr(component_cls, "resource_types", {}).get(slot)
-    if resource_cls is None:
-        raise HTTPException(status_code=400, detail=f"Resource slot '{slot}' not found on '{body.component_key}'")
-
-    # Only pass through fields the resource actually declares — the form may
-    # carry extra markers (e.g. an internal id) that the model would reject.
-    raw = body.deps.get(slot, {})
-    creds = {k: v for k, v in raw.items() if k in resource_cls.model_fields}
-    resource = resource_cls(**creds)
-
-    fn = getattr(resource, method, None)
-    if not is_fetch_field_provider(fn):
-        # Should never happen — validated at catalog build — but guard anyway.
-        raise HTTPException(status_code=403, detail=f"'{provider}' is not a fetch provider")
-    assert fn is not None  # narrowed by the is_fetch_field_provider guard above
-
-    try:
-        result = await invoke(fn)
-    except Exception as exc:
-        handle_error(exc, f"resolving {body.component_key}.{body.field}")
-        return []
-    return list(result or [])