mainsequence-metatable 0.1.0__py3-none-any.whl

api/__init__.py

@@ -0,0 +1,3 @@
+from metatables.sdk_compat import require_sdk_capabilities
+
+require_sdk_capabilities(server=True)

api/app/auth/__init__.py

@@ -0,0 +1 @@
+"""Inbound FastAPI caller authentication."""

api/app/auth/boundary.py

@@ -0,0 +1,104 @@
+"""Shared request admission for hosted assertions and local SDK identity."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from uuid import UUID
+
+from fastapi import Depends, HTTPException, Request
+
+from api.app.auth.caller_assertions import (
+    ASSERTION_HEADER,
+    CallerAssertionUnavailable,
+    InvalidCallerAssertion,
+    configured_verifier,
+)
+from api.app.runtime import RuntimeState
+from api.backend.domain.permission_rules import TrustedActorFacts
+
+
+@dataclass(frozen=True)
+class AdmittedCaller:
+    user_uid: UUID
+    environment_uid: UUID | None = None
+    active_team_uids: frozenset[UUID] = frozenset()
+    is_admin: bool = False
+
+
+def admit_request(request: Request) -> AdmittedCaller:
+    state: RuntimeState = request.app.state.runtime
+    if state.config.local_mode or state.config.developer_mode:
+        if state.identity is None:
+            raise HTTPException(status_code=503, detail="Local SDK identity is unavailable.")
+        environment_uid = None
+        if state.config.developer_mode and not state.config.local_mode:
+            from mainsequence.code_repository_context import get_code_repository_context
+            context = get_code_repository_context()
+            environment_uid = context.organization_environment_uid
+        teams, admin = state.actor_facts_cache.get(
+            (True, state.identity.user_uid),
+            lambda: sdk_actor_facts(state.identity.user_uid, local=True),
+        )
+        return AdmittedCaller(
+            user_uid=state.identity.user_uid, active_team_uids=teams, is_admin=admin,
+            environment_uid=UUID(environment_uid) if environment_uid else None,
+        )
+    assertion = request.headers.get(ASSERTION_HEADER)
+    if assertion is None:
+        raise HTTPException(status_code=401, detail="Caller assertion is required.")
+    try:
+        caller = configured_verifier().verify(assertion)
+    except InvalidCallerAssertion as exc:
+        raise HTTPException(status_code=401, detail="Invalid caller assertion.") from exc
+    except CallerAssertionUnavailable as exc:
+        raise HTTPException(status_code=503, detail="Caller authentication is unavailable.") from exc
+    user_uid = UUID(caller.user_uid)
+    teams, admin = state.actor_facts_cache.get(
+        (False, user_uid), lambda: sdk_actor_facts(user_uid, local=False),
+    )
+    return AdmittedCaller(
+        user_uid=UUID(caller.user_uid), active_team_uids=teams, is_admin=admin,
+        environment_uid=UUID(caller.environment_uid) if getattr(caller, "environment_uid", None) else None,
+    )
+
+
+
+def platform_facts(identity):
+    """Consume facts supplied by SDK User responses for the already verified caller."""
+    admin = getattr(identity, "is_organization_admin", None)
+    teams = getattr(identity, "active_team_uids", None)
+    if type(admin) is not bool or teams is None:
+        raise HTTPException(503, "The platform must supply current admin and Team facts.")
+    try:
+        return frozenset(UUID(str(uid)) for uid in teams), admin
+    except (TypeError, ValueError) as exc:
+        raise HTTPException(503, "Invalid platform Team facts.") from exc
+
+
+def trusted_actor_facts(caller: AdmittedCaller = Depends(admit_request)) -> TrustedActorFacts:
+    return TrustedActorFacts(user_uid=caller.user_uid, user_active=True,
+                             active_team_uids=caller.active_team_uids, is_admin=caller.is_admin)
+
+
+def require_admin(caller: AdmittedCaller = Depends(admit_request)) -> AdmittedCaller:
+    if not caller.is_admin:
+        raise HTTPException(403, "Application administration requires platform admin access.")
+    return caller
+
+
+def require_admin_actor(actor: TrustedActorFacts = Depends(trusted_actor_facts)) -> TrustedActorFacts:
+    if not actor.user_active or not actor.is_admin:
+        raise HTTPException(403, "Application administration requires platform admin access.")
+    return actor
+
+
+def sdk_actor_facts(user_uid: UUID, *, local: bool):
+    """Fetch current facts when the runtime cache is missing or expired."""
+    from mainsequence.client.models_user import User
+    try:
+        identity = User.get_authenticated_user_details() if local else User.get_by_uid(str(user_uid))
+        if identity.is_active is not True or UUID(identity.uid) != user_uid:
+            raise ValueError("Caller identity is inactive or changed.")
+        return platform_facts(identity)
+    except Exception as exc:
+        raise HTTPException(503, "Current platform identity facts are unavailable.") from exc

api/app/auth/caller_assertions.py

@@ -0,0 +1,39 @@
+"""Adapt SDK caller verification to FastAPI dependencies and HTTP errors."""
+
+from functools import lru_cache
+
+from fastapi import Depends, Header, HTTPException
+from mainsequence.server.caller_assertions import (
+    ASSERTION_HEADER,
+    AuthenticatedCaller,
+    CallerAssertionUnavailable,
+    CallerAssertionVerifier,
+    InvalidCallerAssertion,
+)
+
+
+@lru_cache(maxsize=1)
+def configured_verifier() -> CallerAssertionVerifier:
+    try:
+        return CallerAssertionVerifier.from_environment()
+    except CallerAssertionUnavailable as exc:
+        raise HTTPException(
+            status_code=503, detail="Caller authentication is unavailable."
+        ) from exc
+
+
+def authenticated_caller(
+    assertion: str | None = Header(default=None, alias=ASSERTION_HEADER),
+    verifier: CallerAssertionVerifier = Depends(configured_verifier),
+) -> AuthenticatedCaller:
+    """FastAPI dependency for caller-aware operations; never trust UID headers."""
+    if assertion is None:
+        raise HTTPException(status_code=401, detail="Caller assertion is required.")
+    try:
+        return verifier.verify(assertion)
+    except InvalidCallerAssertion as exc:
+        raise HTTPException(status_code=401, detail="Invalid caller assertion.") from exc
+    except CallerAssertionUnavailable as exc:
+        raise HTTPException(
+            status_code=503, detail="Caller authentication is unavailable."
+        ) from exc

api/app/auth/local_actor.py

@@ -0,0 +1,55 @@
+"""Catalog session dependency shared by protected routes."""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Iterator
+
+from fastapi import HTTPException, Request
+from sqlalchemy.exc import DisconnectionError, InterfaceError, OperationalError, TimeoutError
+from sqlalchemy.orm import Session, sessionmaker
+
+from api.backend.persistence.database import create_catalog_engine
+
+
+@lru_cache(maxsize=1)
+def _session_factory(url: str, local: bool = False) -> sessionmaker[Session]:
+    return sessionmaker(create_catalog_engine(url, allow_sqlite=local), expire_on_commit=False)
+
+
+def catalog_session_factory(request: Request = None) -> sessionmaker[Session]:
+    try:
+        if request is not None:
+            state = request.app.state.runtime
+            if state.bootstrap is not None:
+                if not state.bootstrap.active:
+                    raise HTTPException(503, "Initialize the runtime DataSource in Settings first.")
+                return state.bootstrap.factory
+            if state.binding.catalog_url:
+                return _session_factory(state.binding.catalog_url, bool(state.binding.workspace))
+        raise RuntimeError("No runtime DataSource is active.")
+    except (RuntimeError, ValueError) as exc:
+        raise HTTPException(status_code=503, detail="MetaTables catalog is unavailable.") from exc
+
+
+def catalog_session(request: Request = None) -> Iterator[Session]:
+    factory = catalog_session_factory(request)
+    with factory() as session:
+        try:
+            from api.app.runtime import data_source_provider
+            from api.backend.backends.access import install_session_security
+            from api.backend.backends.registry import backend_for
+            from api.backend.integrations.catalog_data_sources import CatalogDataSourceProvider
+            if request is not None and request.app.state.runtime.bootstrap is not None:
+                provider = data_source_provider(request.app.state.runtime)
+                if isinstance(provider, CatalogDataSourceProvider):
+                    bound = CatalogDataSourceProvider(provider.session_factory, provider.credentials,
+                        binding=provider.binding, session=session)
+                    install_session_security(session, lambda: backend_for(bound.get(bound.default_uid())))
+            yield session
+            if session.info.pop("physical_write_pending", False):
+                session.commit()
+        except (DisconnectionError, InterfaceError, OperationalError, TimeoutError) as exc:
+            raise HTTPException(
+                status_code=503, detail="MetaTables catalog is unavailable."
+            ) from exc