lambda-erp 0.1.34__tar.gz → 0.1.36__tar.gz

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-erp
-Version: 0.1.34
+Version: 0.1.36
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: MIT

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/api/auth.py

@@ -96,6 +96,13 @@ def verify_password(plain: str, hashed: str) -> bool:
         return False
 
 
+def has_usable_password(hashed: str | None) -> bool:
+    """True if the stored hash is a real bcrypt password. Social-login-only
+    users carry a non-matchable sentinel that fails this check — they have no
+    password to change (they can set a first one via /auth/set-password)."""
+    return bool(hashed) and hashed.startswith(PASSWORD_HASH_PREFIX)
+
+
 # ---------------------------------------------------------------------------
 # JWT helpers
 # ---------------------------------------------------------------------------
@@ -178,6 +185,10 @@ class ChangePasswordRequest(BaseModel):
     new_password: str
 
 
+class SetPasswordRequest(BaseModel):
+    new_password: str
+
+
 # ---------------------------------------------------------------------------
 # Dependencies
 # ---------------------------------------------------------------------------
@@ -321,7 +332,7 @@ def register(data: RegisterRequest, request: Request, response: Response):
     token = create_access_token(user_name)
     set_auth_cookie(request, response, token)
 
-    return {"name": user_name, "email": data.email.lower(), "full_name": data.full_name, "role": role}
+    return {"name": user_name, "email": data.email.lower(), "full_name": data.full_name, "role": role, "has_password": True}
 
 
 @router.post("/login")
@@ -345,7 +356,8 @@ def login(data: LoginRequest, request: Request, response: Response):
     token = create_access_token(user["name"])
     set_auth_cookie(request, response, token)
 
-    return {"name": user["name"], "email": user["email"], "full_name": user["full_name"], "role": user["role"]}
+    return {"name": user["name"], "email": user["email"], "full_name": user["full_name"], "role": user["role"],
+            "has_password": has_usable_password(user["hashed_password"])}
 
 
 @router.post("/logout")
@@ -356,7 +368,11 @@ def logout(response: Response):
 
 @router.get("/me")
 def me(user: dict = Depends(get_current_user)):
-    return {"name": user["name"], "email": user["email"], "full_name": user["full_name"], "role": user["role"]}
+    db = get_db()
+    row = db.get_value("User", user["name"], ["hashed_password"])
+    has_password = has_usable_password(row["hashed_password"]) if row else False
+    return {"name": user["name"], "email": user["email"], "full_name": user["full_name"],
+            "role": user["role"], "has_password": has_password}
 
 
 @router.post("/change-password")
@@ -381,6 +397,31 @@ def change_password(data: ChangePasswordRequest, user: dict = Depends(get_curren
     return {"ok": True}
 
 
+@router.post("/set-password")
+def set_password(data: SetPasswordRequest, user: dict = Depends(get_current_user)):
+    """Set a first password for an account that has none — e.g. a user created
+    via social login who wants an email+password fallback. Requires an
+    authenticated session; refuses if a usable password already exists (that
+    path is change-password, which verifies the current one) or for the shared
+    demo account."""
+    if user["role"] == "public_manager":
+        raise HTTPException(status_code=403, detail="Demo accounts cannot set a password")
+
+    if len(data.new_password) < 6:
+        raise HTTPException(status_code=422, detail="Password must be at least 6 characters")
+
+    db = get_db()
+    row = db.get_value("User", user["name"], ["hashed_password"])
+    if not row:
+        raise HTTPException(status_code=404, detail="User not found")
+    if has_usable_password(row["hashed_password"]):
+        raise HTTPException(status_code=409, detail="A password is already set; use change password instead")
+
+    db.set_value("User", user["name"],
+                 {"hashed_password": hash_password(data.new_password), "modified": now()})
+    return {"ok": True}
+
+
 @router.post("/invite")
 def create_invite(data: InviteRequest, user: dict = Depends(require_admin)):
     db = get_db()
@@ -541,6 +582,10 @@ DEFAULTS = {
     # When "1", anyone may self-register (as viewer) without an invite. Default
     # off: after the first user (admin), registration is invite-only.
     "allow_public_signup": "0",
+    # When "1", the programmatic chat API (POST /api/v1/chat, Bearer API keys) is
+    # active. Default off — an admin turns it on and issues keys. See
+    # docs/chat-api-plan.md.
+    "chat_api_enabled": "0",
 }
 
 
@@ -580,3 +625,134 @@ def update_settings(data: dict, user: dict = Depends(require_admin)):
         if k not in settings:
             settings[k] = v
     return settings
+
+
+# ---------------------------------------------------------------------------
+# Programmatic chat API — Bearer API keys
+# ---------------------------------------------------------------------------
+
+API_KEY_PREFIX = "sk_erp_"
+API_KEY_ROLES = ("viewer", "manager", "admin")
+
+
+def hash_api_key(token: str) -> str:
+    """Hash an API token for storage/lookup. Tokens are high-entropy, so a fast
+    sha256 is sufficient (unlike user passwords, which use bcrypt)."""
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def generate_api_key() -> tuple[str, str, str]:
+    """Return (token, key_prefix, key_hash) for a fresh API key.
+
+    The full token is shown to the admin exactly once; only the hash + a short
+    display prefix are stored.
+    """
+    token = API_KEY_PREFIX + secrets.token_hex(24)
+    return token, token[: len(API_KEY_PREFIX) + 4], hash_api_key(token)
+
+
+def get_api_caller(request: Request) -> dict:
+    """FastAPI dependency for the programmatic chat API.
+
+    Gated by the `chat_api_enabled` Settings flag — when off the whole surface
+    404s (never advertised on instances that don't use it). Otherwise validates
+    the `Authorization: Bearer <token>` header against a non-revoked Api Key and
+    returns a `user_info`-shaped dict the chat agent already consumes (role gates
+    it; `name` == the key's session_owner so it can access its own sessions).
+    """
+    db = get_db()
+    if not _setting_enabled(db, "chat_api_enabled"):
+        raise HTTPException(status_code=404, detail="Not Found")
+
+    header = request.headers.get("authorization", "")
+    if not header.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Missing or malformed Authorization header")
+    token = header[7:].strip()
+    if not token:
+        raise HTTPException(status_code=401, detail="Empty bearer token")
+
+    rows = db.sql(
+        'SELECT id, name, role, session_owner FROM "Api Key" WHERE key_hash = ? AND revoked = 0',
+        [hash_api_key(token)],
+    )
+    if not rows:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    key = dict(rows[0])
+
+    db.sql('UPDATE "Api Key" SET last_used_at = ? WHERE id = ?', [now(), key["id"]])
+    db.conn.commit()
+
+    return {
+        "name": key["session_owner"],
+        "full_name": key.get("name") or "API",
+        "role": key["role"],
+        "api_key_id": key["id"],
+    }
+
+
+class ApiKeyCreate(BaseModel):
+    name: str
+    role: str = "manager"
+
+
+def _serialize_api_key(row: dict) -> dict:
+    return {
+        "id": row["id"],
+        "name": row["name"],
+        "role": row["role"],
+        "key_prefix": row["key_prefix"],
+        "created_by": row.get("created_by"),
+        "created_at": row.get("created_at"),
+        "last_used_at": row.get("last_used_at"),
+        "revoked": bool(row.get("revoked")),
+    }
+
+
+@router.get("/api-keys")
+def list_api_keys(user: dict = Depends(require_admin)):
+    """List API keys (metadata only — the token is never returned)."""
+    db = get_db()
+    rows = db.sql(
+        'SELECT id, name, role, key_prefix, created_by, created_at, last_used_at, revoked '
+        'FROM "Api Key" ORDER BY created_at DESC'
+    )
+    return [_serialize_api_key(dict(r)) for r in rows]
+
+
+@router.post("/api-keys")
+def create_api_key(data: ApiKeyCreate, user: dict = Depends(require_admin)):
+    """Create an API key. Returns the full token exactly once."""
+    name = (data.name or "").strip()
+    if not name:
+        raise HTTPException(status_code=422, detail="A name is required.")
+    role = data.role if data.role in API_KEY_ROLES else "manager"
+
+    db = get_db()
+    key_id = str(uuid.uuid4())
+    token, key_prefix, key_hash = generate_api_key()
+    db.sql(
+        'INSERT INTO "Api Key" '
+        '(id, name, key_hash, key_prefix, role, session_owner, created_by, created_at, last_used_at, revoked) '
+        'VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)',
+        [key_id, name, key_hash, key_prefix, role, f"apikey:{key_id}", user["name"], now(), None],
+    )
+    db.conn.commit()
+    row = {
+        "id": key_id, "name": name, "role": role, "key_prefix": key_prefix,
+        "created_by": user["name"], "created_at": now(), "last_used_at": None, "revoked": 0,
+    }
+    result = _serialize_api_key(row)
+    result["token"] = token  # shown once
+    return result
+
+
+@router.post("/api-keys/{key_id}/revoke")
+def revoke_api_key(key_id: str, user: dict = Depends(require_admin)):
+    """Revoke (soft-disable) an API key without deleting its history."""
+    db = get_db()
+    rows = db.sql('SELECT id FROM "Api Key" WHERE id = ?', [key_id])
+    if not rows:
+        raise HTTPException(status_code=404, detail="API key not found")
+    db.sql('UPDATE "Api Key" SET revoked = 1 WHERE id = ?', [key_id])
+    db.conn.commit()
+    return {"id": key_id, "revoked": True}

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/api/chat.py

@@ -2556,6 +2556,101 @@ def transcribe_audio(audio_bytes: bytes, audio_format: str, api_key: str) -> str
     return text
 
 
+# ---------------------------------------------------------------------------
+# Shared agent-turn driver (used by both the WebSocket chat and the REST API)
+# ---------------------------------------------------------------------------
+
+
+async def run_session_turn(
+    session_id: str,
+    user_content: str,
+    user_info: dict | None,
+    on_event,
+    *,
+    attachment_ids: list | None = None,
+    attachments_user_id: str | None = None,
+    client_ip: str | None = None,
+    replay_history: bool = True,
+    on_assistant_message=None,
+    on_title=None,
+) -> str | None:
+    """Run one agent turn for a session; return the assistant's reply text.
+
+    Wraps the transport-agnostic ``run_thinking_loop`` with message building,
+    persistence, and first-reply title generation, so the WebSocket chat and the
+    REST chat API share one code path.
+
+    ``replay_history`` is the single statefulness knob:
+      - True  -> LLM context is the session's recent history (normal chat).
+      - False -> context is ONLY the current user message; prior turns are not
+        replayed (stateless REST default). The turn is still persisted by the
+        caller for audit — it just isn't fed back to the model.
+
+    Hooks (all optional, async):
+      - ``on_event(event)``            streamed loop events (WS -> socket; REST -> no-op)
+      - ``on_assistant_message(sid, content)``  fired after the reply is persisted
+      - ``on_title(sid, title)``       fired after a first-reply title is generated
+    """
+    is_first_reply = count_assistant_messages(session_id) == 0
+
+    messages = [{"role": "system", "content": build_system_prompt(user_info)}]
+
+    if replay_history:
+        conversation = build_conversation(session_id, limit=20)
+    else:
+        # Stateless: only the current user message, no prior turns replayed.
+        conversation = [{"role": "user", "content": user_content}]
+
+    # Multimodal attachments: replace the last user message with an image/PDF-
+    # bearing content array so the LLM can see them directly.
+    if attachment_ids and attachments_user_id:
+        from api.attachments import get_attachments_by_ids, build_multimodal_content
+        atts = get_attachments_by_ids(attachment_ids, attachments_user_id)
+        if atts and conversation and conversation[-1].get("role") == "user":
+            parts = []
+            text = conversation[-1].get("content") or ""
+            if text:
+                parts.append({"type": "text", "text": text})
+            for att in atts:
+                parts.append(build_multimodal_content(att))
+            conversation[-1] = {"role": "user", "content": parts}
+
+    messages.extend(conversation)
+
+    await run_thinking_loop(
+        messages, on_event,
+        session_id=session_id,
+        user_info=user_info,
+        client_ip=client_ip,
+    )
+
+    assistant_content = None
+    for msg in reversed(messages):
+        if msg.get("role") == "assistant" and msg.get("content"):
+            assistant_content = msg["content"]
+            save_chat_message(session_id, "assistant", assistant_content)
+            if on_assistant_message:
+                await on_assistant_message(session_id, assistant_content)
+            break
+
+    if is_first_reply and assistant_content:
+        async def _gen_and_notify():
+            await generate_title(
+                session_id,
+                user_content,
+                assistant_content,
+                client_ip=client_ip,
+                user_role=(user_info or {}).get("role"),
+            )
+            if on_title:
+                session = get_session(session_id)
+                if session:
+                    await on_title(session_id, session["title"])
+        asyncio.create_task(_gen_and_notify())
+
+    return assistant_content
+
+
 # ---------------------------------------------------------------------------
 # WebSocket endpoint
 # ---------------------------------------------------------------------------
@@ -2666,66 +2761,26 @@ async def chat_websocket(
 
     async def process_session_message(target_session_id: str, user_content: str, attachment_ids: list | None = None):
         try:
-            is_first_reply = count_assistant_messages(target_session_id) == 0
-
-            messages = [{"role": "system", "content": build_system_prompt(user_info)}]
-            conversation = build_conversation(target_session_id, limit=20)
-
-            # If the user attached files with this message, replace the last user
-            # message in the conversation with a multimodal content array so the
-            # LLM can see the images/PDFs directly.
-            if attachment_ids and ws_user_id:
-                from api.attachments import get_attachments_by_ids, build_multimodal_content
-                atts = get_attachments_by_ids(attachment_ids, ws_user_id)
-                if atts and conversation and conversation[-1].get("role") == "user":
-                    parts = []
-                    text = conversation[-1].get("content") or ""
-                    if text:
-                        parts.append({"type": "text", "text": text})
-                    for att in atts:
-                        parts.append(build_multimodal_content(att))
-                    conversation[-1] = {"role": "user", "content": parts}
-
-            messages.extend(conversation)
-
             async def on_event(event: dict):
                 await send_event(event["type"], session_id=target_session_id, **{
                     key: value for key, value in event.items() if key != "type"
                 })
 
-            await run_thinking_loop(
-                messages, on_event,
-                session_id=target_session_id,
-                user_info=user_info,
-                client_ip=client_ip,
-            )
+            async def on_assistant_message(sid: str, content: str):
+                await send_message_added(sid, "assistant", content)
 
-            assistant_content = None
-            for msg in reversed(messages):
-                if msg.get("role") == "assistant" and msg.get("content"):
-                    assistant_content = msg["content"]
-                    save_chat_message(target_session_id, "assistant", assistant_content)
-                    await send_message_added(target_session_id, "assistant", assistant_content)
-                    break
-
-            if is_first_reply and assistant_content:
-                async def _gen_and_notify():
-                    await generate_title(
-                        target_session_id,
-                        user_content,
-                        assistant_content,
-                        client_ip=client_ip,
-                        user_role=ws_user_role,
-                    )
-                    session = get_session(target_session_id)
-                    if session:
-                        await send_event(
-                            "session_title_updated",
-                            session_id=target_session_id,
-                            title=session["title"],
-                        )
+            async def on_title(sid: str, title: str):
+                await send_event("session_title_updated", session_id=sid, title=title)
 
-                asyncio.create_task(_gen_and_notify())
+            await run_session_turn(
+                target_session_id, user_content, user_info, on_event,
+                attachment_ids=attachment_ids,
+                attachments_user_id=ws_user_id,
+                client_ip=client_ip,
+                replay_history=True,
+                on_assistant_message=on_assistant_message,
+                on_title=on_title,
+            )
         except asyncio.CancelledError:
             raise
         except Exception as e:

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/api/main.py

@@ -18,7 +18,7 @@ from api.auth import router as auth_router, COOKIE_NAME, decode_token
 from api.oauth import router as oauth_router
 from api.attachments import router as attachments_router
 from api.chat import chat_websocket, router as chat_router
-from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, analytics, accounting, proposals
+from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, analytics, accounting, proposals, chat_api
 
 
 def load_plugins() -> None:
@@ -100,6 +100,7 @@ app.include_router(bank_reconciliation.router, prefix="/api")
 app.include_router(accounting.router, prefix="/api")
 app.include_router(admin.router, prefix="/api")
 app.include_router(chat_router, prefix="/api")
+app.include_router(chat_api.router, prefix="/api")
 
 
 @app.get("/api/health")

lambda_erp-0.1.36/api/routers/chat_api.py

@@ -0,0 +1,108 @@
+"""Programmatic chat API (v1).
+
+A small, synchronous REST surface over the ERP's chat agent, authenticated by
+Bearer API keys and gated by the `chat_api_enabled` Settings flag (off by
+default). Lets an external orchestrator (Lambda's own lambda-web infra, then the
+iPhone app) hold a conversation with an ERP instance the way a connector script
+talks to Dynamics NAV.
+
+Statefulness (see docs/chat-api-plan.md):
+  - no `session_id`  -> stateless reasoning: the agent answers using only the
+    current message; the turn is still persisted to a rolling audit session for
+    visibility, but prior turns are NOT replayed. This suits a caller (the
+    orchestrator) that owns the real conversation and sends self-contained
+    prompts.
+  - with `session_id` -> stateful: that session's history is replayed —
+    caller-owned, ephemeral working memory for a single multi-step ERP task.
+"""
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel
+
+from api.auth import get_api_caller
+from api.chat import (
+    create_session,
+    delete_session,
+    get_session,
+    list_sessions,
+    run_session_turn,
+    save_chat_message,
+)
+
+router = APIRouter(prefix="/v1", tags=["chat-api"])
+
+
+class ChatApiRequest(BaseModel):
+    message: str
+    session_id: str | None = None
+
+
+async def _noop_event(event: dict) -> None:
+    """Discard streamed loop events — the REST response is the final reply only."""
+    return None
+
+
+def _client_ip(request: Request) -> str | None:
+    xff = request.headers.get("x-forwarded-for", "")
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else None
+
+
+@router.post("/chat")
+async def chat(payload: ChatApiRequest, request: Request, caller: dict = Depends(get_api_caller)):
+    """Send one message to the ERP chat agent and return its final reply.
+
+    Blocks until the agent finishes (it may run several tool calls internally).
+    """
+    message = (payload.message or "").strip()
+    if not message:
+        raise HTTPException(status_code=422, detail="message cannot be empty")
+
+    owner = caller["name"]
+
+    if payload.session_id:
+        session = get_session(payload.session_id)
+        if not session or session.get("user_id") != owner:
+            raise HTTPException(status_code=404, detail="Session not found")
+        target_session_id = payload.session_id
+        replay_history = True  # opt-in continuity
+    else:
+        # Rolling audit session: append to the caller's most-recent session, or
+        # open one. Stateless reasoning — persisted for visibility, not replayed.
+        existing = list_sessions(user_id=owner)
+        target_session_id = existing[0]["id"] if existing else create_session(user_id=owner)["id"]
+        replay_history = False
+
+    save_chat_message(target_session_id, "user", message)
+
+    reply = await run_session_turn(
+        target_session_id,
+        message,
+        caller,
+        _noop_event,
+        client_ip=_client_ip(request),
+        replay_history=replay_history,
+    )
+
+    session = get_session(target_session_id)
+    return {
+        "reply": reply or "",
+        "session_id": target_session_id,
+        "title": session["title"] if session else None,
+    }
+
+
+@router.get("/chat/sessions")
+def sessions(caller: dict = Depends(get_api_caller)):
+    """List the caller's chat sessions (id, title, timestamps)."""
+    return list_sessions(user_id=caller["name"])
+
+
+@router.delete("/chat/sessions/{session_id}")
+def delete(session_id: str, caller: dict = Depends(get_api_caller)):
+    """Delete one of the caller's sessions. The next stateless call opens a fresh one."""
+    session = get_session(session_id)
+    if not session or session.get("user_id") != caller["name"]:
+        raise HTTPException(status_code=404, detail="Session not found")
+    delete_session(session_id)
+    return {"id": session_id, "deleted": True}

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/frontend/src/api/client.ts

@@ -424,6 +424,11 @@ export const api = {
       method: "POST",
       body: JSON.stringify({ current_password, new_password }),
     }),
+  authSetPassword: (new_password: string) =>
+    request<any>("/auth/set-password", {
+      method: "POST",
+      body: JSON.stringify({ new_password }),
+    }),
   authInvite: (email: string, role: string) =>
     request<any>("/auth/invite", { method: "POST", body: JSON.stringify({ email, role }) }),
   authListUsers: () => request<any[]>("/auth/users"),
@@ -440,6 +445,17 @@ export const api = {
   getSettings: () => request<Record<string, string>>("/auth/settings"),
   updateSettings: (data: Record<string, string>) =>
     request<Record<string, string>>("/auth/settings", { method: "PUT", body: JSON.stringify(data) }),
+  getApiKeys: () =>
+    request<Array<{
+      id: string; name: string; role: string; key_prefix: string;
+      created_by?: string; created_at?: string; last_used_at?: string | null; revoked: boolean;
+    }>>("/auth/api-keys"),
+  createApiKey: (name: string, role: string) =>
+    request<{ id: string; name: string; role: string; key_prefix: string; token: string }>(
+      "/auth/api-keys", { method: "POST", body: JSON.stringify({ name, role }) }),
+  revokeApiKey: (id: string) =>
+    request<{ id: string; revoked: boolean }>(
+      `/auth/api-keys/${encodeURIComponent(id)}/revoke`, { method: "POST" }),
 
   getDemoSpend: () =>
     request<{

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/lambda_erp/database.py

@@ -1308,6 +1308,25 @@ class Database:
                 value TEXT
             )""",
 
+            # Bearer API keys for the programmatic chat API (off by default via
+            # the `chat_api_enabled` Settings flag). Tokens are stored hashed
+            # (sha256); `key_prefix` is a display-only fragment. `role` bounds the
+            # agent's tool access; `session_owner` is the user_id the key's chat
+            # sessions are owned under (isolated from human users). See
+            # docs/chat-api-plan.md.
+            """CREATE TABLE IF NOT EXISTS "Api Key" (
+                id TEXT PRIMARY KEY,
+                name TEXT,
+                key_hash TEXT UNIQUE,
+                key_prefix TEXT,
+                role TEXT DEFAULT 'manager',
+                session_owner TEXT,
+                created_by TEXT,
+                created_at TEXT,
+                last_used_at TEXT,
+                revoked INTEGER DEFAULT 0
+            )""",
+
             # Exchange rates for multi-currency. A lookup carries forward the
             # most recent rate on/before a transaction's date; the rate is then
             # snapshotted onto the document, so editing this table never changes

{lambda_erp-0.1.34 → lambda_erp-0.1.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "0.1.34"
+version = "0.1.36"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "MIT"