memgres 0.12.2__tar.gz → 0.13.0__tar.gz

{memgres-0.12.2 → memgres-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgres
-Version: 0.12.2
+Version: 0.13.0
 Summary: Drop-in memory for AI agents: one Postgres, lexical + semantic recall, diff-versioned history, GDPR-erasable.
 Author: mozgsml
 License-Expression: MIT
@@ -30,6 +30,9 @@ Requires-Dist: psycopg-pool>=3.2; extra == "server"
 Provides-Extra: mcp
 Requires-Dist: mcp>=1.2; extra == "mcp"
 Requires-Dist: psycopg-pool>=3.2; extra == "mcp"
+Provides-Extra: web
+Requires-Dist: pyjwt[crypto]>=2.8; extra == "web"
+Requires-Dist: tomli>=2.0; python_version < "3.11" and extra == "web"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Dynamic: license-file
@@ -191,7 +194,8 @@ Not sure which fits? Start with the decision guide: [docs/CHOOSING.md](docs/CHOO
 1. **`docker compose up`** — `pgvector` + service, nothing to configure. For a dedicated vector service instead, `docker compose --profile qdrant up` and set `MEMGRES_VECTOR_BACKEND=qdrant` (Qdrant ranks vectors; Postgres still holds bodies and does tag/subtree/TTL filtering).
 2. **Your own Postgres** — install the `[server]` extra (above), point `MEMGRES_DATABASE_URL` at it, run `memgres-server` (migrates on startup).
 3. **Embedded library** — install the core package, use `Store` directly, no HTTP at all.
-4. **Split service (many clients)** — a stateless API tier that only flags writes plus a scalable `memgres-worker` tier that embeds; see [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) and `deploy/docker-compose.yml`. Switch the embedding model later with `memgres-reembed`; rebuild the link graph with `memgres-relink`.
+4. **A web panel for people** — `MEMGRES_WEB_ENABLED=true` on `memgres-server`: sign in through OpenID Connect providers (or an admin token), browse and search memory as a graph or a tree, issue tokens for your own AI clients, run your spaces' members and invitations, see who wrote what; administrators get the sign-in queue and a people directory. Memory itself is read-only in the panel — writing stays with agents. See [docs/WEB.md](docs/WEB.md) and [docs/OIDC.md](docs/OIDC.md).
+5. **Split service (many clients)** — a stateless API tier that only flags writes plus a scalable `memgres-worker` tier that embeds; see [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) and `deploy/docker-compose.yml`. Switch the embedding model later with `memgres-reembed`; rebuild the link graph with `memgres-relink`.
 
 Semantic recall is optional: the default `MEMGRES_EMBED_PROVIDER=none` gives you lexical FTS with zero models. Turn on `local` (sentence-transformers), a cloud API (`openai`/`jina`), or any OpenAI-compatible server (LM Studio, Ollama, …) when you want meaning-based search — see [docs/EMBEDDINGS.md](docs/EMBEDDINGS.md) for choosing local vs cloud and [docs/BACKENDS.md](docs/BACKENDS.md) for copy-paste setups. The model id + dimension get stamped into the schema and a later mismatch hard-fails instead of silently returning garbage.
 
@@ -215,6 +219,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_ADMIN_TOKEN` | — | global admin bearer for provisioning (managed mode) |
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
+| `MEMGRES_WEB_ENABLED` | `false` | serve the web panel from `memgres-server` (needs `open` or `managed`). With it: `MEMGRES_PUBLIC_URL`, `MEMGRES_MCP_PUBLIC_URL`, `MEMGRES_OIDC_CONFIG`, `MEMGRES_WEB_SESSION_HOURS` (`12`), `MEMGRES_WEB_COOKIE_SECURE` (`true`), and behind a reverse proxy `MEMGRES_FORWARDED_ALLOW_IPS`. See [docs/WEB.md](docs/WEB.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
 | `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |

{memgres-0.12.2 → memgres-0.13.0}/README.md

@@ -155,7 +155,8 @@ Not sure which fits? Start with the decision guide: [docs/CHOOSING.md](docs/CHOO
 1. **`docker compose up`** — `pgvector` + service, nothing to configure. For a dedicated vector service instead, `docker compose --profile qdrant up` and set `MEMGRES_VECTOR_BACKEND=qdrant` (Qdrant ranks vectors; Postgres still holds bodies and does tag/subtree/TTL filtering).
 2. **Your own Postgres** — install the `[server]` extra (above), point `MEMGRES_DATABASE_URL` at it, run `memgres-server` (migrates on startup).
 3. **Embedded library** — install the core package, use `Store` directly, no HTTP at all.
-4. **Split service (many clients)** — a stateless API tier that only flags writes plus a scalable `memgres-worker` tier that embeds; see [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) and `deploy/docker-compose.yml`. Switch the embedding model later with `memgres-reembed`; rebuild the link graph with `memgres-relink`.
+4. **A web panel for people** — `MEMGRES_WEB_ENABLED=true` on `memgres-server`: sign in through OpenID Connect providers (or an admin token), browse and search memory as a graph or a tree, issue tokens for your own AI clients, run your spaces' members and invitations, see who wrote what; administrators get the sign-in queue and a people directory. Memory itself is read-only in the panel — writing stays with agents. See [docs/WEB.md](docs/WEB.md) and [docs/OIDC.md](docs/OIDC.md).
+5. **Split service (many clients)** — a stateless API tier that only flags writes plus a scalable `memgres-worker` tier that embeds; see [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) and `deploy/docker-compose.yml`. Switch the embedding model later with `memgres-reembed`; rebuild the link graph with `memgres-relink`.
 
 Semantic recall is optional: the default `MEMGRES_EMBED_PROVIDER=none` gives you lexical FTS with zero models. Turn on `local` (sentence-transformers), a cloud API (`openai`/`jina`), or any OpenAI-compatible server (LM Studio, Ollama, …) when you want meaning-based search — see [docs/EMBEDDINGS.md](docs/EMBEDDINGS.md) for choosing local vs cloud and [docs/BACKENDS.md](docs/BACKENDS.md) for copy-paste setups. The model id + dimension get stamped into the schema and a later mismatch hard-fails instead of silently returning garbage.
 
@@ -179,6 +180,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_ADMIN_TOKEN` | — | global admin bearer for provisioning (managed mode) |
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
 | `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
+| `MEMGRES_WEB_ENABLED` | `false` | serve the web panel from `memgres-server` (needs `open` or `managed`). With it: `MEMGRES_PUBLIC_URL`, `MEMGRES_MCP_PUBLIC_URL`, `MEMGRES_OIDC_CONFIG`, `MEMGRES_WEB_SESSION_HOURS` (`12`), `MEMGRES_WEB_COOKIE_SECURE` (`true`), and behind a reverse proxy `MEMGRES_FORWARDED_ALLOW_IPS`. See [docs/WEB.md](docs/WEB.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
 | `MEMGRES_REQUIRED_FIELDS` | — | comma-separated fields a content-storing write must carry (`source`, `reason`), refused by name when absent. A policy about a corpus, not a property of the software: a scratch database wants none, a corporate one wants `source`. `move`/`retag` are exempt. Announced in `server_info.write_requirements` |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |

{memgres-0.12.2 → memgres-0.13.0}/memgres/_version.py

@@ -8,4 +8,4 @@ here at release; nowhere else carries the number.
 PEP 440: a ``.devN`` suffix marks an unreleased build ahead of the last tag.
 """
 
-__version__ = "0.12.2"
+__version__ = "0.13.0"

{memgres-0.12.2 → memgres-0.13.0}/memgres/admin.py

@@ -230,7 +230,7 @@ def whoami(conn, p: Principal) -> dict:
 
     Never echoes the credential; `token_id` identifies it without revealing it.
     """
-    return {
+    out = {
         "user_id": p.user_id,
         "role": p.role,
         "permission": p.permission,          # this credential's ceiling
@@ -238,6 +238,13 @@ def whoami(conn, p: Principal) -> dict:
         "token_id": p.token_id,
         "capabilities": capabilities(conn, p),
     }
+    if p.is_admin and p.scope_namespace_id is None and p.user_id is not None:
+        # The one caller for whom `all` is narrower than what it can read. Said
+        # here rather than in every tool's description, which everybody's agent
+        # reads and only a superadmin could use.
+        out["search_hint"] = ("space='all' searches the namespaces you belong to; "
+                              "space='*' searches every namespace in this deployment")
+    return out
 
 
 # ─── users ───────────────────────────────────────────────────────────────────

{memgres-0.12.2 → memgres-0.13.0}/memgres/config.py

@@ -140,6 +140,22 @@ class Config:
     # database
     database_url: str
     pool_size: int               # max pooled connections (HTTP + http-MCP servers)
+    # web panel (served by memgres-server; see docs/WEB.md)
+    web_enabled: bool = False    # mount the panel and its /ui/api on the REST server
+    web_cookie_secure: bool = True   # session cookie only over HTTPS. Off is for a
+                                 # plain-http LAN, where the cookie can be read off
+                                 # the wire by anyone on it — say so in the docs
+    web_session_hours: int = 12  # a session ends this long after sign-in, used or not
+    public_url: str = ""         # where people reach the panel, e.g.
+                                 # https://memory.example.com — the one origin state-
+                                 # changing calls are accepted from, and the base of
+                                 # the OIDC redirect URI. Empty = the request's own Host
+    oidc_config: str = ""        # path of the TOML file listing sign-in providers
+                                 # (see memgres/web/oidc_config.py and docs/OIDC.md)
+    mcp_public_url: str = ""     # the MCP endpoint people put in their clients, e.g.
+                                 # https://memory.example.com/mcp — shown in the panel's
+                                 # config snippets. The panel cannot know it: MCP is
+                                 # usually another container, port or host
 
     def validate(self) -> None:
         if self.pool_size < 1:
@@ -195,6 +211,23 @@ class Config:
             # and the CLI would write the same operator's secrets to different
             # directories — and neither would say so.
             raise ValueError("MEMGRES_TOKEN_SINK must be an absolute path")
+        if self.web_session_hours < 1:
+            raise ValueError("MEMGRES_WEB_SESSION_HOURS must be >= 1")
+        if self.public_url and not self.public_url.startswith(("http://", "https://")):
+            raise ValueError("MEMGRES_PUBLIC_URL must start with http:// or https://")
+        if self.web_enabled and not self.public_url:
+            # Without it the allowed Origin and the OIDC redirect URI would come
+            # from the request's Host header — wrong behind a proxy, and
+            # attacker-chosen in front of none.
+            raise ValueError("the web panel needs MEMGRES_PUBLIC_URL (e.g. https://memory.example.com)")
+        if self.web_enabled and self.oidc_config and not self.web_cookie_secure:
+            from urllib.parse import urlsplit
+            if (urlsplit(self.public_url).hostname or "") not in ("localhost", "127.0.0.1", "::1"):
+                raise ValueError("OIDC sign-in needs MEMGRES_WEB_COOKIE_SECURE=true "
+                                 "(insecure cookies are allowed only on localhost)")
+        if self.web_enabled and self.key_mode == "single":
+            # Nobody to sign in as: single mode has no accounts and no tokens.
+            raise ValueError("the web panel needs MEMGRES_KEY_MODE=open or managed")
         if self.admin_token and self.admin_token_file:
             raise ValueError(
                 "set only one of MEMGRES_ADMIN_TOKEN / MEMGRES_ADMIN_TOKEN_FILE")
@@ -259,6 +292,12 @@ def load() -> Config:
         embed_max_seq=_int("MEMGRES_EMBED_MAX_SEQ", 0),
         database_url=_str("MEMGRES_DATABASE_URL", ""),
         pool_size=_int("MEMGRES_POOL_SIZE", 4),
+        web_enabled=_bool("MEMGRES_WEB_ENABLED", False),
+        web_cookie_secure=_bool("MEMGRES_WEB_COOKIE_SECURE", True),
+        web_session_hours=_int("MEMGRES_WEB_SESSION_HOURS", 12),
+        public_url=_str("MEMGRES_PUBLIC_URL", "").rstrip("/"),
+        mcp_public_url=_str("MEMGRES_MCP_PUBLIC_URL", ""),
+        oidc_config=_str("MEMGRES_OIDC_CONFIG", ""),
     )
     cfg.validate()
     return cfg

{memgres-0.12.2 → memgres-0.13.0}/memgres/identity.py

@@ -435,18 +435,23 @@ def resolve_space(conn, principal: Principal, *, space_id: Optional[str] = None,
 
 # The two words that address a SET of namespaces rather than one.
 #
-# `all` means every namespace you reach as a member. For a superadmin that is
-# NOT everything it can read — its role reaches any namespace by id — so for
-# that one caller the word asks two different questions, and answering the
-# narrow one silently is a partial result wearing the shape of a complete one.
-# `*` is the wide answer, said out loud.
+# `all` means every namespace you belong to — you own it, or you were added to
+# it — for everyone, superadmin included. `*` means every namespace in the
+# deployment, and only a superadmin may say it: its role reaches any namespace
+# by id, and `*` spends that reach in one call instead of N.
 #
-# There is deliberately no second word for "the ones I belong to": a namespace
-# can be called anything, and the obvious candidates (`mine`, `own`) are names
-# people actually use — the first draft of this shadowed a namespace literally
-# named `mine` in this repo's own tests. `*` survives that objection because a
-# namespace named `*` is not something anyone types by accident, and the
-# collision is still checked rather than assumed away.
+# A superadmin's `all` used to be refused while namespaces existed outside its
+# memberships, on the grounds that "mine" and "everything I can read" differ for
+# that one caller. That left a superadmin no way to say "mine" at all, and a
+# refusal is the wrong tool for a question that has a plain answer: `all` is the
+# namespaces you are in, the same sentence for every caller, and `*` is there
+# for the wider one.
+#
+# There is deliberately no second WORD for "the ones I belong to" beyond `all`:
+# a namespace can be called anything, and the obvious candidates (`mine`, `own`)
+# are names people actually use. `*` survives that objection because a namespace
+# named `*` is not something anyone types by accident, and the collision is still
+# checked rather than assumed away.
 ALL_SPACES = "all"
 EVERY_SPACE = "*"
 
@@ -509,7 +514,6 @@ def resolve_spaces(conn, principal: Principal, *, space=None,
                 "— drop `space_id`, or list the namespaces you want explicitly")
         if _wants(space, EVERY_SPACE):
             return _every_namespace(conn, principal)
-        _refuse_ambiguous_all(conn, principal, ALL_SPACES)
         return _all_reachable(conn, principal)
 
     if not names and not ids:
@@ -533,6 +537,18 @@ def _collect(out: List[Tuple[str, str]], seen: set, resolved: Tuple[str, str]) -
         out.append((nsid, perm))
 
 
+def _own_words(conn, user_id: str) -> List[str]:
+    """The names this caller chose: its own namespaces and its aliases.
+
+    What a keyword may collide with. A namespace SHARED with you was named by
+    somebody else, and letting that name decide what your `all` or `*` means
+    would hand a stranger a switch on your words — add you to a namespace
+    called `all`, and your `all` stops working. An alias you set is your word,
+    so it counts."""
+    return [s["name"] for s in list_spaces(conn, user_id) if s["mine"]] + \
+        list(list_aliases(conn, user_id).values())
+
+
 def _no_such_name(names: Sequence[str], keyword: str) -> None:
     """Refuse a set keyword that is ALSO the name of a namespace in play.
 
@@ -544,58 +560,11 @@ def _no_such_name(names: Sequence[str], keyword: str) -> None:
             f"ambiguous — address that one by `space_id`")
 
 
-def _unreached_count(conn, principal: Principal) -> int:
-    """How many namespaces the caller could read but is not a member of.
-
-    Zero for everyone but a superadmin, whose reach is defined by its role
-    rather than by membership rows — which is precisely why `all` has to be
-    disambiguated for it and for nobody else.
-    """
-    if not principal.is_admin or principal.user_id is None:
-        return 0
-    if principal.scope_namespace_id is not None:
-        return 0                              # pinned to one; nothing is outside
-    with conn.cursor() as cur:
-        cur.execute(
-            "SELECT count(*) FROM namespace n WHERE n.owner_user_id <> %(u)s "
-            "AND NOT EXISTS (SELECT 1 FROM namespace_member m "
-            "                WHERE m.namespace_id=n.id AND m.user_id=%(u)s)",
-            {"u": principal.user_id})
-        return int(cur.fetchone()[0])
-
-
-def _refuse_ambiguous_all(conn, principal: Principal,
-                          said: Optional[str] = None) -> None:
-    """A superadmin read that would answer with less than the role can read.
-
-    For every other caller `all` IS everything, and the word stays untouched.
-    For a superadmin it is two different questions, and the narrow answer looks
-    exactly like the wide one — a search returning nothing reads as "there is
-    nothing", not as "not where I looked". So it is refused, the wide word is
-    named, and it is refused only while the two answers differ: a superadmin
-    whose memberships already cover the deployment sees no change.
-
-    ``said`` is the word the caller used, or None when they named no namespace
-    at all — the same trap, reached by saying nothing.
-    """
-    outside = _unreached_count(conn, principal)
-    if not outside:
-        return
-    own = [s["name"] for s in list_spaces(conn, principal.user_id)]
-    listed = ", ".join(repr(n) for n in sorted(own)) or "none"
-    opening = (f"'{said}' is ambiguous here" if said
-               else "naming no namespace would answer too narrowly here")
-    raise SpaceAmbiguous(
-        f"you are a superadmin, so {opening}: you belong to {len(own)} "
-        f"namespace(s) ({listed}), and {outside} more exist that your role can "
-        f"also read. Say `space='{EVERY_SPACE}'` for every namespace in this "
-        f"deployment, or name the ones you mean with `space=[…]` / "
-        f"`space_id=[…]`")
-
-
 def _all_reachable(conn, principal: Principal,
                    keyword: str = ALL_SPACES) -> List[Tuple[str, str]]:
-    """Every namespace the caller reaches, capped by the token ceiling."""
+    """Every namespace the caller belongs to — owns or was added to — capped by
+    the token ceiling. For a superadmin this is NOT everything its role can
+    read; that is `*`."""
     if principal.user_id is None:
         # An env break-glass root has no membership rows to enumerate, and a
         # provisional open-mode token owns nothing yet. Neither can say "all".
@@ -610,20 +579,21 @@ def _all_reachable(conn, principal: Principal,
     reachable = list_spaces(conn, principal.user_id)
     if not reachable:
         raise SpaceNotFound("you can reach no namespaces yet")
-    _no_such_name([s["name"] for s in reachable], keyword)
+    _no_such_name(_own_words(conn, principal.user_id), keyword)
     return [(s["id"], perm_min(s["permission"], ceiling)) for s in reachable]
 
 
 def _every_namespace(conn, principal: Principal) -> List[Tuple[str, str]]:
     """Every namespace in the deployment — the superadmin's explicit wide read.
 
-    The counterpart to refusing `all` for a superadmin: having said that the
-    narrow answer must not be given silently, there has to be a way to ask for
-    the wide one. It is the same reach `resolve_space(space_id=…)` already grants
-    that role one namespace at a time, so it adds no authority — only a way to
-    spend it in one call instead of N.
+    `all` is the namespaces you belong to, for a superadmin as for anyone; this
+    is the wider answer, asked for by its own word. It is the same reach
+    `resolve_space(space_id=…)` already grants that role one namespace at a
+    time, so it adds no authority — only a way to spend it in one call instead
+    of N.
     """
-    # The name check comes FIRST, and against the caller's OWN reachable set.
+    # The name check comes FIRST, and against the caller's OWN words (see
+    # `_own_words`: namespaces it owns and its aliases).
     # Two reasons, both learned the hard way:
     #   * a caller who owns a namespace literally named `*` most likely means
     #     that one, and telling them the keyword is superadmin-only would be an
@@ -636,12 +606,11 @@ def _every_namespace(conn, principal: Principal) -> List[Tuple[str, str]]:
     #     uuids. A stranger's choice of name must not reach into what this
     #     caller's words mean.
     if principal.user_id is not None:
-        _no_such_name([s["name"] for s in list_spaces(conn, principal.user_id)],
-                      EVERY_SPACE)
+        _no_such_name(_own_words(conn, principal.user_id), EVERY_SPACE)
     if not principal.is_admin:
         raise AuthError(
             f"`space='{EVERY_SPACE}'` means every namespace in this deployment "
-            f"and is superadmin-only — use '{ALL_SPACES}' for the ones you reach")
+            f"and is superadmin-only — use '{ALL_SPACES}' for the ones you belong to")
     if principal.scope_namespace_id is not None:
         # The pin is a property of THIS credential and outranks the role: a
         # token deliberately narrowed to one namespace does not widen back.
@@ -659,14 +628,10 @@ def _every_namespace(conn, principal: Principal) -> List[Tuple[str, str]]:
 def _sole_reachable(conn, principal: Principal) -> Tuple[str, str]:
     """The caller's only namespace, or an error naming the candidates.
 
-    This is the READ path — a search that named no namespace at all. It carries
-    the same superadmin refusal as `all`, and for the same reason: with one
-    membership and other namespaces on the deployment, "your only namespace"
-    silently answers a narrower question than the caller asked, and an empty
-    result reads as "there is nothing". (The WRITE path deliberately keeps
-    resolving to the single membership: a write has to land somewhere, the one
-    namespace you belong to is the only sane target, and nothing is silently
-    left out of an answer.)
+    This is the READ path — a search that named no namespace at all. One
+    namespace you belong to is used; several are an error naming them. For a
+    superadmin, too, this is about membership: the namespaces it reaches only by
+    its role are searched when it says `*`.
     """
     if principal.user_id is None:
         if principal.is_admin:            # env break-glass root owns nothing
@@ -675,7 +640,6 @@ def _sole_reachable(conn, principal: Principal) -> Tuple[str, str]:
     if principal.scope_namespace_id is not None:
         return resolve_space(conn, principal,
                              space_id=principal.scope_namespace_id)
-    _refuse_ambiguous_all(conn, principal)
     reachable = list_spaces(conn, principal.user_id)
     if len(reachable) == 1:
         only = reachable[0]

{memgres-0.12.2 → memgres-0.13.0}/memgres/mcp_server.py

@@ -552,7 +552,7 @@ def build_server(cfg: Optional[Config] = None):
         choosing what to read in full with `memory_get`.
 
         WHERE to search: `space` takes a namespace name, a list of names, or
-        `"all"` for every namespace you reach; `space_id` takes ids (the only way
+        `"all"` for every namespace you belong to (own or were added to); `space_id` takes ids (the only way
         to name a namespace shared WITH you). Omit both and your single namespace
         is used — but if you reach several, naming one is REQUIRED, because
         searching just one of them would return "nothing found" and read like an

memgres-0.13.0/memgres/migrations/0024_web_panel.sql

@@ -0,0 +1,134 @@
+-- The web panel: browser sessions, sign-in identities, a language (schema v25).
+--
+-- Everything here is additive. An older client neither reads nor writes these
+-- tables, and nothing it relies on changes shape.
+
+-- A browser session. The cookie carries a random id; only its sha256 is stored,
+-- so a copy of this table does not let anyone walk in as the people listed in
+-- it — the same reason tokens are stored as hashes.
+--
+-- user_id NULL is the env break-glass root (MEMGRES_ADMIN_TOKEN resolving to no
+-- account). Such a session is tied to that secret by `root_fp`, its sha256: if
+-- the operator rotates the env token, every session it opened ends with it.
+--
+-- `token_id` is the credential a token sign-in used. A session opened with a
+-- token must not outlive the token, so it is checked again on every request
+-- rather than trusted from the moment of sign-in.
+CREATE TABLE IF NOT EXISTS web_session (
+    id_hash      text        PRIMARY KEY,
+    user_id      uuid        REFERENCES app_user(id) ON DELETE CASCADE,
+    via          text        NOT NULL,          -- 'token' | 'oidc:<provider>'
+    token_id     uuid        REFERENCES token(id) ON DELETE CASCADE,
+    root_fp      text,
+    csrf         text        NOT NULL,
+    created_at   timestamptz NOT NULL DEFAULT now(),
+    last_seen_at timestamptz NOT NULL DEFAULT now(),
+    expires_at   timestamptz NOT NULL,
+    revoked_at   timestamptz
+);
+CREATE INDEX IF NOT EXISTS web_session_user ON web_session (user_id);
+
+-- A way of signing in, attached to an account. The identity is (issuer,
+-- subject) — never the email, which is only how a FIRST link may be found.
+-- One account may hold any number of these; one (issuer, subject) belongs to
+-- exactly one account.
+CREATE TABLE IF NOT EXISTS app_user_identity (
+    issuer        text        NOT NULL,
+    subject       text        NOT NULL,
+    user_id       uuid        NOT NULL REFERENCES app_user(id) ON DELETE CASCADE,
+    provider      text        NOT NULL,         -- the config key it came through
+    email         text,
+    linked_at     timestamptz NOT NULL DEFAULT now(),
+    last_login_at timestamptz,
+    PRIMARY KEY (issuer, subject)
+);
+CREATE INDEX IF NOT EXISTS app_user_identity_user ON app_user_identity (user_id);
+
+-- The panel language a person chose. NULL = follow the browser.
+ALTER TABLE app_user ADD COLUMN IF NOT EXISTS ui_language text;
+
+-- A handle for one sign-in method that is not its (issuer, subject): the panel
+-- shows and unlinks methods by it, and an issuer URL in a path is awkward.
+ALTER TABLE app_user_identity ADD COLUMN IF NOT EXISTS id uuid NOT NULL DEFAULT gen_random_uuid();
+CREATE UNIQUE INDEX IF NOT EXISTS app_user_identity_id ON app_user_identity (id);
+
+-- One OIDC sign-in in progress: between the redirect to the provider and its
+-- redirect back. Single use, short-lived. `state` is looked up by hash, and the
+-- flow is bound to the browser that started it (`browser_hash` = sha256 of a
+-- cookie set at the start), so a callback URL carried to another browser — or
+-- planted in a victim's — completes nothing.
+--
+-- `link_user_id` is set when a signed-in person is adding a method to their own
+-- account. It is recorded here at the start because the callback arrives as a
+-- cross-site navigation, which does not carry the SameSite=Strict session.
+CREATE TABLE IF NOT EXISTS oidc_flow (
+    state_hash    text        PRIMARY KEY,
+    browser_hash  text        NOT NULL,
+    provider      text        NOT NULL,
+    nonce         text        NOT NULL,
+    code_verifier text        NOT NULL,
+    link_user_id  uuid        REFERENCES app_user(id) ON DELETE CASCADE,
+    created_at    timestamptz NOT NULL DEFAULT now(),
+    expires_at    timestamptz NOT NULL
+);
+
+-- Someone a provider vouched for, whom no rule let straight in. No account is
+-- created until an administrator decides: link them to an existing account
+-- (the one whose email matched is suggested), create one, or reject.
+CREATE TABLE IF NOT EXISTS signin_request (
+    id                uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    provider          text        NOT NULL,
+    issuer            text        NOT NULL,
+    subject           text        NOT NULL,
+    email             text,
+    email_verified    boolean     NOT NULL DEFAULT false,
+    name              text        NOT NULL DEFAULT '',
+    suggested_user_id uuid        REFERENCES app_user(id) ON DELETE SET NULL,
+    status            text        NOT NULL DEFAULT 'pending'
+                                  CHECK (status IN ('pending', 'approved', 'rejected')),
+    created_at        timestamptz NOT NULL DEFAULT now(),
+    last_seen_at      timestamptz NOT NULL DEFAULT now(),
+    decided_at        timestamptz,
+    decided_by        uuid        REFERENCES app_user(id) ON DELETE SET NULL,
+    user_id           uuid        REFERENCES app_user(id) ON DELETE SET NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS signin_request_open
+    ON signin_request (issuer, subject) WHERE status = 'pending';
+CREATE INDEX IF NOT EXISTS signin_request_seen ON signin_request (issuer, subject, decided_at);
+
+-- The sign-in method a provider session was opened with, so unlinking one
+-- method ends exactly its sessions and not those of another method from the
+-- same provider.
+ALTER TABLE web_session ADD COLUMN IF NOT EXISTS identity_id uuid;
+
+-- A link flow is authorised by the session that started it, and that session
+-- must still be alive when the provider sends the person back: signing out,
+-- revoking the token or disabling the account in those minutes stops the link.
+ALTER TABLE oidc_flow ADD COLUMN IF NOT EXISTS link_session_hash text;
+
+-- An invitation into a space for an address that has no account yet. Someone
+-- who already has an account with that email is added straight away and no row
+-- is written. The invitation waits until a sign-in arrives whose provider
+-- vouches for the address (email_verified), and is applied then — it opens the
+-- space, never the server: whether that sign-in is let in at all is still
+-- decided by the provider's rules and the administrators.
+CREATE TABLE IF NOT EXISTS space_invite (
+    id           uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    namespace_id uuid        NOT NULL REFERENCES namespace(id) ON DELETE CASCADE,
+    email        text        NOT NULL,
+    permission   text        NOT NULL CHECK (permission IN ('read', 'write', 'admin')),
+    invited_by   uuid        REFERENCES app_user(id) ON DELETE SET NULL,
+    created_at   timestamptz NOT NULL DEFAULT now(),
+    expires_at   timestamptz NOT NULL,
+    accepted_at  timestamptz,
+    user_id      uuid        REFERENCES app_user(id) ON DELETE SET NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS space_invite_open
+    ON space_invite (namespace_id, lower(email)) WHERE accepted_at IS NULL;
+CREATE INDEX IF NOT EXISTS space_invite_email
+    ON space_invite (lower(email)) WHERE accepted_at IS NULL;
+
+-- A person's write activity, by day: the profile chart reads one author's
+-- history over a window, which the author-only index answers with a sort.
+CREATE INDEX IF NOT EXISTS memory_history_author_time
+    ON memory_history (author_user_id, created_at) WHERE author_user_id IS NOT NULL;

{memgres-0.12.2 → memgres-0.13.0}/memgres/schema.py

@@ -18,7 +18,7 @@ from pathlib import Path
 from .config import Config
 
 # The version this build migrates the database TO (the latest migration it carries).
-SCHEMA_VERSION = 24
+SCHEMA_VERSION = 25
 
 # The compatibility FLOOR: the schema version of the most recent backward-
 # INCOMPATIBLE migration — one that changed the shape/semantics old code relied on
@@ -78,6 +78,9 @@ SCHEMA_VERSION = 24
 #     link PARSER was fixed (hyphens in paths were dropped, indented code was
 #     parsed) → additive, floor stays 16. It rebuilds a derived index from text
 #     that is already stored; an older client neither writes nor reads differently.
+#   v25 (0024): added web_session, app_user_identity and app_user.ui_language for
+#     the web panel → additive, floor stays 16. An older client ignores all three;
+#     it simply has no panel.
 SCHEMA_BREAKING_VERSION = 16
 
 # Dev layout: repo/migrations next to the package. When packaged, migrations are

{memgres-0.12.2 → memgres-0.13.0}/memgres/server.py

@@ -732,14 +732,24 @@ def create_app(cfg: Optional[Config] = None):
             return _guard(lambda: admin.revoke_superadmin(
                 conn, p, user_id=user_id, demote_to=req.demote_to))
 
+    if cfg.web_enabled:
+        from .web.routes import mount
+        mount(app, cfg, pool, _store)
+
     return app
 
 
 def main():  # pragma: no cover - entrypoint
     import os
     import uvicorn
+    # Behind a reverse proxy, the client address (used to throttle sign-in
+    # attempts) is only real if the proxy's X-Forwarded-For is trusted:
+    # MEMGRES_FORWARDED_ALLOW_IPS lists the proxy addresses (uvicorn's
+    # forwarded_allow_ips; unset = uvicorn's own default, 127.0.0.1).
     uvicorn.run(create_app(), host=os.environ.get("MEMGRES_HTTP_HOST", "0.0.0.0"),
-                port=int(os.environ.get("MEMGRES_HTTP_PORT", "8080")))
+                port=int(os.environ.get("MEMGRES_HTTP_PORT", "8080")),
+                proxy_headers=True,
+                forwarded_allow_ips=os.environ.get("MEMGRES_FORWARDED_ALLOW_IPS") or None)
 
 
 if __name__ == "__main__":  # pragma: no cover