lambda-erp 0.1.46__tar.gz → 0.1.48__tar.gz

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-erp
-Version: 0.1.46
+Version: 0.1.48
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: MIT

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/api/auth.py

@@ -651,14 +651,22 @@ def generate_api_key() -> tuple[str, str, str]:
     return token, token[: len(API_KEY_PREFIX) + 4], hash_api_key(token)
 
 
+def _role_rank(role: str) -> int:
+    return ROLE_HIERARCHY.get(role, 0)
+
+
 def get_api_caller(request: Request) -> dict:
     """FastAPI dependency for the programmatic chat API.
 
     Gated by the `chat_api_enabled` Settings flag — when off the whole surface
     404s (never advertised on instances that don't use it). Otherwise validates
-    the `Authorization: Bearer <token>` header against a non-revoked Api Key and
-    returns a `user_info`-shaped dict the chat agent already consumes (role gates
-    it; `name` == the key's session_owner so it can access its own sessions).
+    the `Authorization: Bearer <token>` header against a non-revoked Api Key.
+
+    Keys are per-user credentials: the effective role is resolved LIVE as
+    min(key's role cap, owner's current role), and a disabled or deleted owner
+    kills every one of their keys immediately. `name` is the key's
+    session_owner (``api:<username>``) — all of one user's keys share a session
+    space, separate from their interactive web chats.
     """
     db = get_db()
     if not _setting_enabled(db, "chat_api_enabled"):
@@ -672,74 +680,123 @@ def get_api_caller(request: Request) -> dict:
         raise HTTPException(status_code=401, detail="Empty bearer token")
 
     rows = db.sql(
-        'SELECT id, name, role, session_owner FROM "Api Key" WHERE key_hash = ? AND revoked = 0',
+        'SELECT id, name, user, role, session_owner FROM "Api Key" WHERE key_hash = ? AND revoked = 0',
         [hash_api_key(token)],
     )
     if not rows:
         raise HTTPException(status_code=401, detail="Invalid API key")
     key = dict(rows[0])
 
+    owner = db.get_value("User", key["user"], ["name", "full_name", "role", "enabled"])
+    if not owner or not owner.get("enabled"):
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    effective_role = (
+        key["role"] if _role_rank(key["role"]) <= _role_rank(owner["role"]) else owner["role"]
+    )
+
     db.sql('UPDATE "Api Key" SET last_used_at = ? WHERE id = ?', [now(), key["id"]])
     db.conn.commit()
 
     return {
         "name": key["session_owner"],
-        "full_name": key.get("name") or "API",
-        "role": key["role"],
+        "full_name": f"{owner.get('full_name') or key['user']} (API)",
+        "role": effective_role,
         "api_key_id": key["id"],
+        "api_key_user": key["user"],
     }
 
 
 class ApiKeyCreate(BaseModel):
     name: str
-    role: str = "manager"
+    # Optional role CAP. Defaults to the creator's own role; may only be equal
+    # or lower — a key can never out-rank its owner.
+    role: str | None = None
 
 
 def _serialize_api_key(row: dict) -> dict:
     return {
         "id": row["id"],
         "name": row["name"],
+        "user": row.get("user"),
         "role": row["role"],
         "key_prefix": row["key_prefix"],
-        "created_by": row.get("created_by"),
         "created_at": row.get("created_at"),
         "last_used_at": row.get("last_used_at"),
         "revoked": bool(row.get("revoked")),
     }
 
 
+def _get_key_or_404(db, key_id: str) -> dict:
+    rows = db.sql('SELECT id, user, revoked FROM "Api Key" WHERE id = ?', [key_id])
+    if not rows:
+        raise HTTPException(status_code=404, detail="API key not found")
+    return dict(rows[0])
+
+
+def _require_key_access(key: dict, user: dict) -> None:
+    """A key is managed by its owner; admins can manage every key."""
+    if key["user"] != user["name"] and user["role"] != "admin":
+        raise HTTPException(status_code=403, detail="Not your API key")
+
+
 @router.get("/api-keys")
-def list_api_keys(user: dict = Depends(require_admin)):
-    """List API keys (metadata only — the token is never returned)."""
+def list_api_keys(user: dict = Depends(require_viewer)):
+    """List API keys (metadata only — the token is never returned).
+
+    Users see their own keys; admins see everyone's.
+    """
     db = get_db()
-    rows = db.sql(
-        'SELECT id, name, role, key_prefix, created_by, created_at, last_used_at, revoked '
-        'FROM "Api Key" ORDER BY created_at DESC'
-    )
+    if user["role"] == "admin":
+        rows = db.sql(
+            'SELECT id, name, user, role, key_prefix, created_at, last_used_at, revoked '
+            'FROM "Api Key" ORDER BY created_at DESC'
+        )
+    else:
+        rows = db.sql(
+            'SELECT id, name, user, role, key_prefix, created_at, last_used_at, revoked '
+            'FROM "Api Key" WHERE user = ? ORDER BY created_at DESC',
+            [user["name"]],
+        )
     return [_serialize_api_key(dict(r)) for r in rows]
 
 
 @router.post("/api-keys")
-def create_api_key(data: ApiKeyCreate, user: dict = Depends(require_admin)):
-    """Create an API key. Returns the full token exactly once."""
+def create_api_key(data: ApiKeyCreate, user: dict = Depends(require_viewer)):
+    """Create an API key for YOURSELF. Returns the full token exactly once.
+
+    Self-service: any logged-in (non-demo) user can mint keys, because a key
+    can never exceed its owner's live role — the optional `role` is a cap that
+    must be equal or lower.
+    """
+    if user["role"] == "public_manager":
+        raise HTTPException(status_code=403, detail="Demo mode cannot create API keys.")
     name = (data.name or "").strip()
     if not name:
         raise HTTPException(status_code=422, detail="A name is required.")
-    role = data.role if data.role in API_KEY_ROLES else "manager"
+
+    role = data.role or user["role"]
+    if role not in API_KEY_ROLES:
+        raise HTTPException(status_code=422, detail=f"Invalid role: {role}")
+    if _role_rank(role) > _role_rank(user["role"]):
+        raise HTTPException(
+            status_code=403,
+            detail=f"A key cannot out-rank its owner (your role: {user['role']}).",
+        )
 
     db = get_db()
     key_id = str(uuid.uuid4())
     token, key_prefix, key_hash = generate_api_key()
+    created_at = now()
     db.sql(
         'INSERT INTO "Api Key" '
-        '(id, name, key_hash, key_prefix, role, session_owner, created_by, created_at, last_used_at, revoked) '
+        '(id, name, user, key_hash, key_prefix, role, session_owner, created_at, last_used_at, revoked) '
         'VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)',
-        [key_id, name, key_hash, key_prefix, role, f"apikey:{key_id}", user["name"], now(), None],
+        [key_id, name, user["name"], key_hash, key_prefix, role, f"api:{user['name']}", created_at, None],
     )
     db.conn.commit()
     row = {
-        "id": key_id, "name": name, "role": role, "key_prefix": key_prefix,
-        "created_by": user["name"], "created_at": now(), "last_used_at": None, "revoked": 0,
+        "id": key_id, "name": name, "user": user["name"], "role": role, "key_prefix": key_prefix,
+        "created_at": created_at, "last_used_at": None, "revoked": 0,
     }
     result = _serialize_api_key(row)
     result["token"] = token  # shown once
@@ -747,12 +804,29 @@ def create_api_key(data: ApiKeyCreate, user: dict = Depends(require_admin)):
 
 
 @router.post("/api-keys/{key_id}/revoke")
-def revoke_api_key(key_id: str, user: dict = Depends(require_admin)):
-    """Revoke (soft-disable) an API key without deleting its history."""
+def revoke_api_key(key_id: str, user: dict = Depends(require_viewer)):
+    """Revoke (soft-disable) an API key. Owner or admin."""
     db = get_db()
-    rows = db.sql('SELECT id FROM "Api Key" WHERE id = ?', [key_id])
-    if not rows:
-        raise HTTPException(status_code=404, detail="API key not found")
+    key = _get_key_or_404(db, key_id)
+    _require_key_access(key, user)
     db.sql('UPDATE "Api Key" SET revoked = 1 WHERE id = ?', [key_id])
     db.conn.commit()
     return {"id": key_id, "revoked": True}
+
+
+@router.delete("/api-keys/{key_id}")
+def delete_api_key(key_id: str, user: dict = Depends(require_viewer)):
+    """Hard-delete a REVOKED API key. Owner or admin.
+
+    Two-step by design: a live key must be revoked first (409 otherwise), so a
+    key can't vanish while still usable. Past sessions keep their session_owner
+    string, so historical attribution survives the row's deletion.
+    """
+    db = get_db()
+    key = _get_key_or_404(db, key_id)
+    _require_key_access(key, user)
+    if not key.get("revoked"):
+        raise HTTPException(status_code=409, detail="Revoke the key first, then delete it.")
+    db.sql('DELETE FROM "Api Key" WHERE id = ?', [key_id])
+    db.conn.commit()
+    return {"id": key_id, "deleted": True}

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/api/chat.py

@@ -1913,7 +1913,7 @@ For purchased goods, prefer Purchase Receipt when receiving separately from bill
 customer, supplier, item, warehouse, account, company, cost-center
 
 ## Master Data Deletion
-Master records CAN be deleted — use the `delete_master` tool (ADMIN role only). It is reference-protected: an unreferenced record (e.g. a mistakenly created or duplicate one) is permanently deleted; a record referenced by any document, GL entry, or stock data is NOT deleted but automatically disabled/archived instead, and the result names the blocking reference — relay that reason to the user. When the user merely wants a record out of the way (not destroyed), prefer `update_master` with `{"disabled": 1}`. Non-admin users: explain that deletion needs an admin and offer to disable instead.
+Master records CAN be deleted — use the `delete_master` tool (ADMIN role only). It is reference-protected: an unreferenced record (e.g. a mistakenly created or duplicate one) is permanently deleted; a record referenced by any document, GL entry, or stock data is NOT deleted but automatically disabled/archived instead, and the result names the blocking reference — relay that reason to the user. When the user merely wants a record out of the way (not destroyed), prefer `update_master` with `{{"disabled": 1}}`. Non-admin users: explain that deletion needs an admin and offer to disable instead.
 
 ## Warehouse Master Rules
 - To create a warehouse via `create_master`, you MUST pass a `data` object.

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/frontend/src/api/client.ts

@@ -452,15 +452,18 @@ export const api = {
     request<Record<string, string>>("/auth/settings", { method: "PUT", body: JSON.stringify(data) }),
   getApiKeys: () =>
     request<Array<{
-      id: string; name: string; role: string; key_prefix: string;
-      created_by?: string; created_at?: string; last_used_at?: string | null; revoked: boolean;
+      id: string; name: string; user?: string; role: string; key_prefix: string;
+      created_at?: string; last_used_at?: string | null; revoked: boolean;
     }>>("/auth/api-keys"),
   createApiKey: (name: string, role: string) =>
-    request<{ id: string; name: string; role: string; key_prefix: string; token: string }>(
+    request<{ id: string; name: string; user?: string; role: string; key_prefix: string; token: string }>(
       "/auth/api-keys", { method: "POST", body: JSON.stringify({ name, role }) }),
   revokeApiKey: (id: string) =>
     request<{ id: string; revoked: boolean }>(
       `/auth/api-keys/${encodeURIComponent(id)}/revoke`, { method: "POST" }),
+  deleteApiKey: (id: string) =>
+    request<{ id: string; deleted: boolean }>(
+      `/auth/api-keys/${encodeURIComponent(id)}`, { method: "DELETE" }),
 
   getDemoSpend: () =>
     request<{

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/lambda_erp/database.py

@@ -1314,14 +1314,18 @@ class Database:
             # agent's tool access; `session_owner` is the user_id the key's chat
             # sessions are owned under (isolated from human users). See
             # docs/chat-api-plan.md.
+            # Per-user API keys (v2): a key BELONGS to a User and can never act
+            # above its owner — `role` is only a CAP; the effective role is
+            # min(cap, owner's current role) resolved live at auth time, so a
+            # demotion or disable applies to existing keys immediately.
             """CREATE TABLE IF NOT EXISTS "Api Key" (
                 id TEXT PRIMARY KEY,
                 name TEXT,
+                user TEXT NOT NULL,
                 key_hash TEXT UNIQUE,
                 key_prefix TEXT,
                 role TEXT DEFAULT 'manager',
                 session_owner TEXT,
-                created_by TEXT,
                 created_at TEXT,
                 last_used_at TEXT,
                 revoked INTEGER DEFAULT 0
@@ -1894,6 +1898,36 @@ def _m018_quotation_item_frequency(db: "Database") -> None:
     db._add_column_if_missing("Quotation Item", "frequency", "TEXT")
 
 
+def _m019_api_keys_per_user(db: "Database") -> None:
+    """API keys v2 — per-user credentials (clean break, deliberate).
+
+    v1 keys were org-global objects minted by admins with a free-standing role
+    and a synthetic identity; anyone holding the token WAS the key. v2 binds
+    every key to a User (self-service creation, effective role capped by the
+    owner's live role). Existing v1 rows are DROPPED, not migrated — decided
+    2026-07-14: no legacy rules; holders simply re-issue their keys.
+    """
+    if "user" in db._get_table_columns("Api Key"):
+        return  # fresh install — table already has the v2 shape
+    db.conn.execute('DROP TABLE "Api Key"')
+    db.conn.execute(
+        """CREATE TABLE "Api Key" (
+            id TEXT PRIMARY KEY,
+            name TEXT,
+            user TEXT NOT NULL,
+            key_hash TEXT UNIQUE,
+            key_prefix TEXT,
+            role TEXT DEFAULT 'manager',
+            session_owner TEXT,
+            created_at TEXT,
+            last_used_at TEXT,
+            revoked INTEGER DEFAULT 0
+        )"""
+    )
+    db._col_cache.pop("Api Key", None)
+    db._text_col_cache.pop("Api Key", None)
+
+
 Database.MIGRATIONS = [
     (1, "chat_message_session_id", _m001_chat_message_session_id),
     (2, "chat_session_user_id", _m002_chat_session_user_id),
@@ -1913,6 +1947,7 @@ Database.MIGRATIONS = [
     (16, "customer_contact_person", _m016_customer_contact_person),
     (17, "proposal_cover_template", _m017_proposal_cover_template),
     (18, "quotation_item_frequency", _m018_quotation_item_frequency),
+    (19, "api_keys_per_user", _m019_api_keys_per_user),
 ]
 
 

{lambda_erp-0.1.46 → lambda_erp-0.1.48}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "0.1.46"
+version = "0.1.48"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "MIT"