ocmo-api 0.8.19__py3-none-any.whl

core/api/namespace.py

@@ -0,0 +1,86 @@
+from ninja import Query, Router
+from ninja.pagination import paginate
+
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..operation_ids import (
+    CREATE_NAMESPACE,
+    DELETE_NAMESPACE,
+    LIST_NAMESPACES,
+    SHOW_NAMESPACE,
+    UPDATE_NAMESPACE,
+)
+from ..schemas import (
+    ErrorSchema,
+    NamespaceCreateSchema,
+    NamespaceDeletedSchema,
+    NamespacePatchSchema,
+    NamespaceSchema,
+)
+
+router = Router()
+
+
+@router.get("/ns/", response=list[NamespaceSchema], tags=["Namespace"], operation_id=LIST_NAMESPACES)
+@paginate
+def list_namespaces(request, name_filter: str = Query(None)):
+    """List existing namespaces with optional name filter."""
+    auth = AuthManager.from_request(request)
+    AuditManager.bind(request, auth)
+    return NamespaceManager(None, auth=auth).list(name_filter)
+
+
+@router.get(
+    "/ns/{namespace}",
+    response={200: NamespaceSchema, 404: ErrorSchema},
+    tags=["Namespace"],
+    operation_id=SHOW_NAMESPACE,
+)
+def show_namespace(request, namespace: str):
+    """Get specific namespace details."""
+    auth = AuthManager.from_request(request)
+    mgr = NamespaceManager(namespace, auth=auth)
+    AuditManager.bind(request, auth, namespace=mgr.ns)
+    return mgr.get_or_raise()
+
+
+@router.post(
+    "/ns/",
+    response={201: NamespaceSchema, 409: ErrorSchema},
+    tags=["Namespace"],
+    operation_id=CREATE_NAMESPACE,
+)
+def create_namespace(request, payload: NamespaceCreateSchema):
+    """Create a new namespace."""
+    auth = AuthManager.from_request(request)
+    AuditManager.bind(request, auth)
+    return 201, NamespaceManager(payload.name, auth=auth).create(payload)
+
+
+@router.patch(
+    "/ns/{namespace}",
+    response={200: NamespaceSchema, 404: ErrorSchema, 422: ErrorSchema},
+    tags=["Namespace"],
+    operation_id=UPDATE_NAMESPACE,
+)
+def update_namespace(request, namespace: str, payload: NamespacePatchSchema):
+    """Update namespace metadata or active tag pointers."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return 200, NamespaceManager(namespace, auth=auth).update(payload)
+
+
+@router.delete(
+    "/ns/{namespace}",
+    response={204: NamespaceDeletedSchema, 404: ErrorSchema},
+    tags=["Namespace"],
+    operation_id=DELETE_NAMESPACE,
+)
+def delete_namespace(request, namespace: str):
+    """Delete namespace and all its contents."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return 204, NamespaceManager(namespace, auth=auth).delete()

core/api/propagation.py

@@ -0,0 +1,29 @@
+from ninja import Router
+
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..managers.propagation import PropagationManager
+from ..operation_ids import PROPAGATE_CONFIG
+from ..schemas import ErrorSchema, PropagationResultSchema
+
+router = Router()
+
+
+@router.post(
+    "/ns/{namespace}/~propagate/{path:path}",
+    response={200: PropagationResultSchema, 404: ErrorSchema},
+    tags=["Propagation"],
+    operation_id=PROPAGATE_CONFIG,
+)
+def propagate_config(
+    request,
+    namespace: str,
+    path: str,
+    version: str = "latest",
+):
+    """Manually trigger propagation from the config at ``path``."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return PropagationManager(ns, path, auth=auth).propagate_manual(version)

core/api/resolve.py

@@ -0,0 +1,229 @@
+from django.http import HttpResponse
+from ninja import Body, Query, Router
+
+from ocmoapi.auth import resolver_auth
+from ocmoapi.oauth2_provider import oauth2_auth
+
+from ..managers.artifacts import ArtifactsManager
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..managers.resolution import (
+    ResolutionManager,
+    decode_resolve_path,
+    parse_query_params,
+    scoped_resolve_path,
+    validate_cast_format,
+)
+from ..managers.resolve_parameters import ResolveParametersManager
+from ..managers.tree import TreeManager
+from ..operation_ids import (
+    DOWNLOAD_RESOLVED_ARTIFACT,
+    LIST_CAST_FORMATS,
+    RESOLVE_CONFIG,
+    RESOLVE_DRAFT_CONFIG,
+    RESOLVE_PARAMETERS,
+)
+from ..schemas import (
+    CastFormatsListSchema,
+    ResolveParametersResponseSchema,
+    ResolveResponseSchema,
+)
+from ..schemas.cast_options import cast_format_option_schemas, format_cast_options_json_schema
+from ..schemas.requests import ConfigDocument
+from ..shortcuts import public_base_url
+from ._common import root_model_openapi_extension
+
+router = Router()
+
+_resolve_auth = [resolver_auth, oauth2_auth]
+
+
+@router.get(
+    "/~cast-formats/",
+    response=CastFormatsListSchema,
+    tags=["Resolve"],
+    auth=oauth2_auth,
+    operation_id=LIST_CAST_FORMATS,
+)
+def list_cast_formats(request):
+    """Return all REST-supported cast formats and their option schemas."""
+    return {
+        "formats": [
+            {
+                "format": name,
+                "options_schema": format_cast_options_json_schema(name),
+            }
+            for name in sorted(cast_format_option_schemas())
+        ],
+    }
+
+
+@router.get(
+    "/ns/{namespace}/~resolve/{path:path}/~download/{token}",
+    tags=["Resolve"],
+    auth=None,
+    operation_id=DOWNLOAD_RESOLVED_ARTIFACT,
+)
+def download_resolved_artifact(request, namespace: str, path: str, token: str):
+    """Download a previously resolved artifact using a signed token.
+
+    Request authentication is not used; the short-lived token in the URL is the
+    sole credential (signed-URL semantics). Any Authorization header is ignored.
+    """
+    ns = NamespaceManager(namespace, auth=None).get_or_raise()
+    mode, content = ArtifactsManager(ns).download_artifact(path, token)
+    if mode == "xaccel":
+        # X-Accel-Redirect mode: delegate to Nginx
+        response = HttpResponse(status=200)
+        response["X-Accel-Redirect"] = content
+        response["Content-Type"] = "application/octet-stream"
+        return response
+    elif mode == "direct":
+        return HttpResponse(content, content_type="application/octet-stream")
+    else:
+        raise ValueError(f"Unknown download mode: {mode}")
+
+
+@router.get(
+    "/ns/{namespace}/~resolve/{path:path}",
+    response=ResolveResponseSchema,
+    tags=["Resolve"],
+    auth=_resolve_auth,
+    operation_id=RESOLVE_CONFIG,
+)
+def resolve_config(
+    request,
+    namespace: str,
+    path: str,
+    version: str = Query("latest"),
+    cast: str | None = Query(None),
+    trace_only: bool = Query(False),
+    mark_stable: bool = Query(False, alias="mark-stable"),
+    ignore_configs_with_missing_tags: bool = Query(False, alias="ignore-configs-with-missing-tags"),
+    no_creds: bool = Query(False, alias="no-creds"),
+):
+    """Resolve a Config (or every Config under a folder path) through the
+    parameters → extend → render → cast pipeline.
+
+    When ``mark-stable=true``, advance the reserved ``stable`` tag on resolved
+    Config root(s) to the version that was just resolved (Configs only).
+
+    When ``ignore-configs-with-missing-tags=true`` and ``path`` is a folder,
+    skip Configs that do not have the requested ``version`` tag or number
+    instead of failing the whole folder resolve.
+
+    When ``no-creds=true``, secret parameters are replaced with the dummy
+    value ``<secret-value-placeholder>`` without fetching or decrypting secrets
+    (``secret:resolve`` is not required).
+
+    When authenticated as a Resolver, ``path`` is relative to the resolver's
+    scope. Use ``'.'`` to resolve the scope root folder.
+    """
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    path = decode_resolve_path(path)
+    validate_cast_format(cast)
+    mgr = ResolutionManager(
+        ns,
+        path,
+        auth=auth,
+        query_params=request.GET,
+        base_url=public_base_url(request),
+        version=version,
+        cast=cast,
+        trace_only=trace_only,
+        promote_stable=mark_stable,
+        ignore_configs_with_missing_tags=ignore_configs_with_missing_tags,
+        no_creds=no_creds,
+    )
+    result = mgr.resolve()
+    request._resolve_cache_status = mgr.cache_status
+    return result
+
+
+@router.get(
+    "/ns/{namespace}/~resolve-parameters/{path:path}",
+    response=ResolveParametersResponseSchema,
+    tags=["Resolve"],
+    auth=_resolve_auth,
+    operation_id=RESOLVE_PARAMETERS,
+)
+def resolve_parameters(
+    request,
+    namespace: str,
+    path: str,
+    version: str = Query("latest"),
+    no_creds: bool = Query(False, alias="no-creds"),
+):
+    """Return effective parameter values for a single Config (debug).
+
+    When ``no-creds=true``, secret parameters show the dummy value
+    ``<secret-value-placeholder>`` without fetching secrets (``secret:resolve``
+    is not required).
+
+    When authenticated as a Resolver, ``path`` is relative to the resolver's
+    scope. Use ``'.'`` to refer to the scope root (must be a Config, not a
+    folder — a folder path is rejected by the underlying resolver).
+    """
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    path = decode_resolve_path(path)
+    effective_path, _ = scoped_resolve_path(ns, path, auth)
+    dynamic_params, _ = parse_query_params(request.GET)
+    config_obj = TreeManager(ns, effective_path, auth=auth).get_or_raise(["config"])
+    rpm = ResolveParametersManager(
+        ns,
+        config_obj,
+        base_folder="/".join(config_obj.path.split("/")[:-1]),
+        version_tag=version,
+        version_number=TreeManager.resolve_version(config_obj, version).version,
+        dynamic_params=dynamic_params,
+        auth=auth,
+        no_creds=no_creds,
+    )
+    return rpm.resolve_debug()
+
+
+@router.post(
+    "/ns/{namespace}/~resolve-draft/{path:path}",
+    response=ResolveResponseSchema,
+    tags=["Resolve"],
+    auth=[oauth2_auth],
+    openapi_extra=root_model_openapi_extension(ConfigDocument),
+    operation_id=RESOLVE_DRAFT_CONFIG,
+)
+def resolve_draft_config(
+    request,
+    namespace: str,
+    path: str,
+    document: ConfigDocument = Body(...),
+    cast: str | None = Query(None),
+    trace_only: bool = Query(False),
+    no_creds: bool = Query(False, alias="no-creds"),
+):
+    """Resolve unsaved draft YAML at the given path without persisting it.
+
+    The full parameters → extend → render → cast pipeline runs against the
+    submitted content. ``config:resolve`` is required on the path and all
+    transitive participants. Results are returned as download URLs (same
+    shape as ``GET /~resolve/{path}``). Response items use ``version=0``.
+    """
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    validate_cast_format(cast)
+    mgr = ResolutionManager(
+        ns,
+        path,
+        auth=auth,
+        query_params=request.GET,
+        base_url=public_base_url(request),
+        cast=cast,
+        trace_only=trace_only,
+        no_creds=no_creds,
+        draft_content=document.root,
+    )
+    return mgr.resolve()

core/api/resolver.py

@@ -0,0 +1,96 @@
+from typing import Any
+
+from ninja import Body, Router
+
+from ocmoapi.oauth2_provider import oauth2_auth
+
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..managers.tree import TreeManager
+from ..operation_ids import (
+    CREATE_RESOLVER,
+    GET_RESOLVER_CONFIGURATION_SCHEMA,
+    ROTATE_RESOLVER_TOKEN,
+    UPDATE_RESOLVER,
+)
+from ..schemas import ErrorSchema, ResolverSchema, ResolverTokenRotationResponseSchema
+from ..schemas.requests import ResolverDocument, ResolverRotateTokenPayload
+from ..schemas.resolver_json_schema import build_resolver_configuration_json_schema
+from ._common import root_model_openapi_extension
+
+router = Router()
+
+
+@router.get(
+    "/~resolver-configuration-schema",
+    response=dict[str, Any],
+    tags=["Resolver"],
+    auth=oauth2_auth,
+    summary="Resolver configuration JSON Schema",
+    operation_id=GET_RESOLVER_CONFIGURATION_SCHEMA,
+)
+def get_resolver_configuration_schema(request):
+    """Return JSON Schema for resolver configuration YAML (editor autocomplete)."""
+    return build_resolver_configuration_json_schema()
+
+
+@router.post(
+    "/ns/{namespace}/~resolver/~create/{path:path}",
+    response={201: ResolverSchema, 409: ErrorSchema, 422: ErrorSchema},
+    tags=["Resolver"],
+    openapi_extra=root_model_openapi_extension(ResolverDocument),
+    operation_id=CREATE_RESOLVER,
+)
+def create_resolver(
+    request,
+    namespace: str,
+    path: str,
+    document: ResolverDocument = Body(ResolverDocument("")),
+):
+    """Create a new Resolver. Returns token1 in full on creation."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    item = TreeManager(ns, path, auth=auth).create_item(document.root, "resolver")
+    item._reveal_token1 = True
+    return 201, item
+
+
+@router.put(
+    "/ns/{namespace}/~resolver/~update/{path:path}",
+    response={200: ResolverSchema, 404: ErrorSchema, 422: ErrorSchema},
+    tags=["Resolver"],
+    openapi_extra=root_model_openapi_extension(ResolverDocument),
+    operation_id=UPDATE_RESOLVER,
+)
+def update_resolver(
+    request,
+    namespace: str,
+    path: str,
+    document: ResolverDocument = Body(ResolverDocument("")),
+):
+    """Update resolver configuration."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return TreeManager(ns, path, auth=auth).update_item(document.root)
+
+
+@router.post(
+    "/ns/{namespace}/~resolver/~rotate-token/{path:path}",
+    response={200: ResolverTokenRotationResponseSchema, 404: ErrorSchema, 422: ErrorSchema},
+    tags=["Resolver"],
+    operation_id=ROTATE_RESOLVER_TOKEN,
+)
+def rotate_resolver_token(
+    request,
+    namespace: str,
+    path: str,
+    payload: ResolverRotateTokenPayload,
+):
+    """Rotate token1 or token2 for a Resolver (token_number must be 1 or 2)."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return TreeManager(ns, path, auth=auth).rotate_resolver_token(payload.token_number)

core/api/secret.py

@@ -0,0 +1,53 @@
+from ninja import Body, Router
+
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..managers.secret import SecretManager
+from ..operation_ids import CREATE_SECRET, UPDATE_SECRET
+from ..schemas import AnyExtendedNodeSchema, ErrorSchema
+from ..schemas.requests import SecretDocument
+from ._common import root_model_openapi_extension
+
+router = Router()
+
+
+@router.post(
+    "/ns/{namespace}/~secret/~create/{path:path}",
+    response={201: AnyExtendedNodeSchema, 409: ErrorSchema, 413: ErrorSchema, 422: ErrorSchema},
+    tags=["Secret"],
+    openapi_extra=root_model_openapi_extension(SecretDocument),
+    operation_id=CREATE_SECRET,
+)
+def create_secret(
+    request,
+    namespace: str,
+    path: str,
+    document: SecretDocument = Body(...),
+):
+    """Create a new Secret. The document is validated as YAML then encrypted at rest."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    item = SecretManager(ns, path, auth=auth).create(document.root)
+    return 201, item
+
+
+@router.put(
+    "/ns/{namespace}/~secret/~update/{path:path}",
+    response={200: AnyExtendedNodeSchema, 404: ErrorSchema, 413: ErrorSchema, 422: ErrorSchema},
+    tags=["Secret"],
+    openapi_extra=root_model_openapi_extension(SecretDocument),
+    operation_id=UPDATE_SECRET,
+)
+def update_secret(
+    request,
+    namespace: str,
+    path: str,
+    document: SecretDocument = Body(...),
+):
+    """Update an existing Secret. A new encrypted version is created only when content differs."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return SecretManager(ns, path, auth=auth).update(document.root)

core/api/system.py

@@ -0,0 +1,42 @@
+import json
+
+from django.http import HttpResponse
+from ninja import Router
+
+from ..managers.health import HealthManager
+from ..managers.system import SystemManager
+from ..operation_ids import HEALTH, VERSION
+from ..schemas import HealthSchema, ProductVersionWithNoticeSchema
+
+router = Router(tags=["System"])
+
+
+@router.get(
+    "/health",
+    response={200: HealthSchema, 503: HealthSchema},
+    auth=None,
+    summary="Application health",
+    operation_id=HEALTH,
+)
+def health(request):
+    """Validate core dependencies required for normal API operation."""
+    payload = HealthManager().check()
+    status_code = 200 if payload["status"] == "ok" else 503
+    return status_code, payload
+
+
+@router.get(
+    "/version",
+    response=ProductVersionWithNoticeSchema,
+    auth=None,
+    summary="Application version",
+    operation_id=VERSION,
+)
+def version(request, notice: bool = False):
+    """Return the deployed OCMO product version and public auth configuration."""
+    payload = SystemManager().version_payload(include_notice=notice)
+    body = ProductVersionWithNoticeSchema.model_validate(payload).model_dump(
+        mode="json",
+        exclude_none=True,
+    )
+    return HttpResponse(json.dumps(body), content_type="application/json")

core/api/template.py

@@ -0,0 +1,53 @@
+from ninja import Body, Router
+
+from ..managers.audit import AuditManager
+from ..managers.auth import AuthManager
+from ..managers.namespace import NamespaceManager
+from ..managers.tree import TreeManager
+from ..operation_ids import CREATE_TEMPLATE, UPDATE_TEMPLATE
+from ..schemas import AnyExtendedNodeSchema, ErrorSchema
+from ..schemas.requests import TemplateDocument
+from ._common import root_model_openapi_extension
+
+router = Router()
+
+
+@router.post(
+    "/ns/{namespace}/~template/~create/{path:path}",
+    response={201: AnyExtendedNodeSchema, 409: ErrorSchema, 413: ErrorSchema, 422: ErrorSchema},
+    tags=["Template"],
+    openapi_extra=root_model_openapi_extension(TemplateDocument),
+    operation_id=CREATE_TEMPLATE,
+)
+def create_template(
+    request,
+    namespace: str,
+    path: str,
+    document: TemplateDocument = Body(...),
+):
+    """Create a new Template at the specified path."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    item = TreeManager(ns, path, auth=auth).create_item(document.root, "template")
+    return 201, item
+
+
+@router.put(
+    "/ns/{namespace}/~template/~update/{path:path}",
+    response={200: AnyExtendedNodeSchema, 404: ErrorSchema, 413: ErrorSchema, 422: ErrorSchema},
+    tags=["Template"],
+    openapi_extra=root_model_openapi_extension(TemplateDocument),
+    operation_id=UPDATE_TEMPLATE,
+)
+def update_template(
+    request,
+    namespace: str,
+    path: str,
+    document: TemplateDocument = Body(...),
+):
+    """Update an existing Template. Creates a new version only when content changes."""
+    auth = AuthManager.from_request(request)
+    ns = NamespaceManager(namespace, auth=auth).get_or_raise()
+    AuditManager.bind(request, auth, namespace=ns)
+    return TreeManager(ns, path, auth=auth).update_item(document.root)