interloper-api 0.40.0__tar.gz → 0.43.3__tar.gz

{interloper_api-0.40.0 → interloper_api-0.43.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: interloper-api
-Version: 0.40.0
+Version: 0.43.3
 Summary: Interloper FastAPI routes
 Author: Guillaume Onfroy
 Author-email: Guillaume Onfroy <guillaume@digitlcloud.com>

{interloper_api-0.40.0 → interloper_api-0.43.3}/pyproject.toml

@@ -3,7 +3,7 @@
 # ###############
 [project]
 name = "interloper-api"
-version = "0.40.0"
+version = "0.43.3"
 description = "Interloper FastAPI routes"
 readme = "README.md"
 authors = [{ name = "Guillaume Onfroy", email = "guillaume@digitlcloud.com" }]

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/app.py

@@ -21,6 +21,7 @@ from interloper_api.routes import (
     oauth,
     organisations,
     runs,
+    tokens,
     ws,
 )
 from interloper_api.routes import catalog as catalog_routes
@@ -88,22 +89,23 @@ def create_app(
         set_smtp_config(smtp_config)
 
     api = APIRouter(prefix="/api")
-    api.include_router(auth.router, tags=["auth"])
-    api.include_router(organisations.router, tags=["organisations"])
-    api.include_router(admin.router, tags=["admin"])
-    api.include_router(catalog_routes.router, prefix="/catalog", tags=["catalog"])
-    api.include_router(components.router, prefix="/components", tags=["components"])
-    api.include_router(runs.router, prefix="/runs", tags=["runs"])
-    api.include_router(backfills.router, prefix="/backfills", tags=["backfills"])
-    api.include_router(oauth.router, tags=["oauth"])
-    api.include_router(ws.router, tags=["ws"])
+    api.include_router(auth.router)
+    api.include_router(organisations.router)
+    api.include_router(admin.router)
+    api.include_router(catalog_routes.router)
+    api.include_router(components.router)
+    api.include_router(runs.router)
+    api.include_router(backfills.router)
+    api.include_router(oauth.router)
+    api.include_router(tokens.router)
+    api.include_router(ws.router)
 
     agent_available = False
     if agent_config is None or agent_config.enabled:
         try:
             from interloper_api.routes import agent as agent_routes
 
-            api.include_router(agent_routes.router, prefix="/agent", tags=["agent"])
+            api.include_router(agent_routes.router)
             agent_available = True
         except ImportError:
             logger.warning(

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/agent.py

@@ -29,7 +29,7 @@ from interloper_api.dependencies import get_catalog, get_org_id, get_store, requ
 
 logger = logging.getLogger(__name__)
 
-router = APIRouter()
+router = APIRouter(prefix="/agent", tags=["agent"])
 
 APP_NAME = "interloper_agent"
 

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/backfills.py

@@ -20,7 +20,7 @@ from interloper_api.dependencies import (
     require_viewer,
 )
 
-router = APIRouter()
+router = APIRouter(prefix="/backfills", tags=["backfills"])
 
 
 class BackfillCreateRequest(BaseModel):

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/catalog.py

@@ -9,7 +9,7 @@ from interloper.catalog.base import Catalog
 
 from interloper_api.dependencies import get_catalog
 
-router = APIRouter()
+router = APIRouter(prefix="/catalog", tags=["catalog"])
 
 
 @router.get("/")

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/components.py

@@ -51,7 +51,7 @@ from interloper_api.dependencies import (
 
 logger = logging.getLogger(__name__)
 
-router = APIRouter()
+router = APIRouter(prefix="/components", tags=["components"])
 
 
 # -- Request/Response models --------------------------------------------------

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/runs.py

@@ -22,7 +22,7 @@ from interloper_api.dependencies import (
     require_viewer,
 )
 
-router = APIRouter()
+router = APIRouter(prefix="/runs", tags=["runs"])
 
 #: Hard cap on the number of events returned in a single page, regardless of
 #: the requested ``limit``. Keeps a pathological ``?limit=1000000`` from loading

interloper_api-0.43.3/src/interloper_api/routes/tokens.py

@@ -0,0 +1,120 @@
+"""Personal access token routes — mint, list, and revoke API tokens.
+
+Tokens authenticate programmatic clients (the MCP server, CLIs) as their
+holder in one organisation, with the holder's live role. Management is
+session-cookie-only by design: a leaked token must not be able to mint
+further tokens.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException
+from interloper_db import Profile, Store
+from pydantic import BaseModel, Field
+
+from interloper_api.dependencies import get_current_user, get_org_id, get_store, require_viewer
+
+router = APIRouter(prefix="/tokens", tags=["tokens"])
+
+
+# -- Response / Request models ------------------------------------------------
+
+
+class CreateTokenRequest(BaseModel):
+    """Request body for creating a token."""
+
+    name: str = Field(min_length=1, max_length=100)
+    expires_in_days: int | None = Field(default=90, ge=1, le=3650)
+
+
+class TokenResponse(BaseModel):
+    """Token metadata — never carries secret material."""
+
+    id: UUID
+    name: str
+    token_prefix: str
+    organisation_id: UUID
+    created_at: datetime | None = None
+    expires_at: datetime | None = None
+    last_used_at: datetime | None = None
+    revoked_at: datetime | None = None
+
+
+class CreatedTokenResponse(TokenResponse):
+    """Creation response: the only place the raw token ever appears."""
+
+    token: str
+
+
+# -- Routes --------------------------------------------------------------------
+
+
+@router.post("", status_code=201)
+def create_token(
+    body: CreateTokenRequest,
+    user: Profile = Depends(require_viewer),
+    org_id: UUID = Depends(get_org_id),
+    store: Store = Depends(get_store),
+) -> CreatedTokenResponse:
+    """Create a personal access token scoped to the active organisation.
+
+    Any org member may mint one: the token conveys only the holder's own
+    live role, so no escalation is possible. The raw token is returned
+    exactly once and cannot be recovered afterwards.
+    """
+    expires_at = None
+    if body.expires_in_days is not None:
+        expires_at = datetime.now(timezone.utc) + timedelta(days=body.expires_in_days)
+
+    row, raw = store.create_token(user.id, org_id, name=body.name, expires_at=expires_at)
+    return CreatedTokenResponse(
+        id=row.id,
+        name=row.name,
+        token_prefix=row.token_prefix,
+        organisation_id=row.organisation_id,
+        created_at=row.created_at,
+        expires_at=row.expires_at,
+        last_used_at=row.last_used_at,
+        revoked_at=row.revoked_at,
+        token=raw,
+    )
+
+
+@router.get("")
+def list_tokens(
+    user: Profile = Depends(require_viewer),
+    org_id: UUID = Depends(get_org_id),
+    store: Store = Depends(get_store),
+) -> list[TokenResponse]:
+    """List the caller's tokens in the active organisation."""
+    rows = store.list_tokens(user.id, org_id)
+    return [TokenResponse.model_validate(row, from_attributes=True) for row in rows]
+
+
+@router.delete("/{token_id}")
+def revoke_token(
+    token_id: UUID,
+    user: Profile = Depends(get_current_user),
+    store: Store = Depends(get_store),
+) -> dict[str, str]:
+    """Revoke a token.
+
+    The owner may revoke their own tokens; an org admin may revoke any token
+    scoped to their organisation. Missing and unauthorized get the same 404,
+    so token IDs don't act as an existence oracle.
+    """
+    detail = f"Token {token_id} not found"
+    row = store.get_token(token_id)
+    if row is None:
+        raise HTTPException(status_code=404, detail=detail)
+
+    if row.user_id != user.id:
+        role = store.get_user_role(user.id, row.organisation_id)
+        if role != "admin":
+            raise HTTPException(status_code=404, detail=detail)
+
+    store.revoke_token(token_id)
+    return {"status": "revoked"}

{interloper_api-0.40.0 → interloper_api-0.43.3}/src/interloper_api/routes/ws.py

@@ -24,7 +24,7 @@ from fastapi import APIRouter, Cookie, FastAPI, WebSocket, WebSocketDisconnect
 from interloper_api.dependencies import get_store
 
 logger = logging.getLogger(__name__)
-router = APIRouter()
+router = APIRouter(tags=["ws"])
 
 
 class ConnectionManager: