provekit 0.1.0__py3-none-any.whl

provekit/routers/auth.py

@@ -0,0 +1,150 @@
+"""Auth endpoints: register / login / logout / me (email + password).
+
+Sessions are httpOnly cookies carrying a signed token. GitHub OAuth is a planned
+provider; the User model + session layer are provider-agnostic so it slots in later.
+"""
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from pydantic import BaseModel, EmailStr
+from sqlalchemy.orm import Session
+
+from ..config import get_settings
+from ..database import get_db
+from ..models import User
+from ..services import auth, email
+from ..services.limits import check_login_rate
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+
+class Credentials(BaseModel):
+    email: EmailStr
+    password: str
+    name: str = ""
+
+
+def _set_cookie(resp: Response, u: User) -> None:
+    token = auth.make_token(u.id, ver=u.token_version)
+    resp.set_cookie(auth.COOKIE, token, max_age=auth._TTL, httponly=True,
+                    samesite="lax", secure=get_settings().hosted, path="/")
+
+
+def _public(u: User) -> dict:
+    return {"id": u.id, "email": u.email, "name": u.name, "auth_provider": u.auth_provider,
+            "email_verified": u.email_verified}
+
+
+def _send_verify(u: User) -> None:
+    s = get_settings()
+    token = auth.make_token(u.id, ttl=2 * 24 * 3600, purpose="verify", ver=u.token_version)
+    link = f"{s.web_base_url.rstrip('/')}/verify?token={token}"
+    email.send(u.email, "Verify your ProveKit email",
+               f"Confirm your email to finish setting up ProveKit:\n\n{link}\n\nThis link expires in 48 hours.")
+
+
+@router.post("/register")
+def register(body: Credentials, response: Response, db: Session = Depends(get_db)):
+    if db.query(User).filter(User.email == body.email).first():
+        raise HTTPException(409, "An account with that email already exists")
+    if len(body.password) < 8:
+        raise HTTPException(400, "Password must be at least 8 characters")
+    u = User(email=body.email, name=body.name or body.email.split("@")[0],
+             password_hash=auth.hash_password(body.password))
+    db.add(u); db.commit(); db.refresh(u)
+    _send_verify(u)
+    if not get_settings().require_email_verification:
+        _set_cookie(response, u)  # verification optional → log in immediately
+    return _public(u)
+
+
+@router.post("/login")
+def login(body: Credentials, request: Request, response: Response, db: Session = Depends(get_db)):
+    client = request.client.host if request.client else "?"
+    check_login_rate(f"{body.email}:{client}")  # brute-force throttle
+    u = db.query(User).filter(User.email == body.email).first()
+    if not u or not u.password_hash:
+        # Spend the same PBKDF2 cost on a missing/OAuth account so response time doesn't
+        # reveal whether the email exists (timing-based account enumeration).
+        auth.verify_password(body.password, auth.DUMMY_HASH)
+        raise HTTPException(401, "Invalid email or password")
+    if not auth.verify_password(body.password, u.password_hash):
+        raise HTTPException(401, "Invalid email or password")
+    if get_settings().require_email_verification and not u.email_verified:
+        raise HTTPException(403, "Please verify your email before signing in.")
+    _set_cookie(response, u)
+    return _public(u)
+
+
+@router.post("/logout")
+def logout(response: Response):
+    response.delete_cookie(auth.COOKIE, path="/")
+    return {"ok": True}
+
+
+@router.get("/me")
+def me(user: User = Depends(auth.get_current_user)):
+    return _public(user)
+
+
+class Email(BaseModel):
+    email: EmailStr
+
+
+@router.post("/forgot")
+def forgot(body: Email, request: Request, db: Session = Depends(get_db)):
+    """Email a password-reset link. Always returns ok — never leaks whether the email exists."""
+    client = request.client.host if request.client else "?"
+    check_login_rate(f"forgot:{body.email}:{client}")
+    u = db.query(User).filter(User.email == body.email).first()
+    if u and u.password_hash:
+        token = auth.make_token(u.id, ttl=3600, purpose="reset", ver=u.token_version)
+        link = f"{get_settings().web_base_url.rstrip('/')}/reset?token={token}"
+        email.send(u.email, "Reset your ProveKit password",
+                   f"Reset your password with this link (valid 1 hour):\n\n{link}\n\n"
+                   "If you didn't request this, ignore this email.")
+    return {"ok": True}
+
+
+class ResetIn(BaseModel):
+    token: str
+    password: str
+
+
+@router.post("/reset")
+def reset(body: ResetIn, db: Session = Depends(get_db)):
+    claims = auth.read_token(body.token, purpose="reset")
+    if claims is None:
+        raise HTTPException(400, "This reset link is invalid or has expired.")
+    if len(body.password) < 8:
+        raise HTTPException(400, "Password must be at least 8 characters")
+    uid, ver = claims
+    u = db.get(User, uid)
+    if not u or u.token_version != ver:  # a reset link is single-use and dies on the next reset
+        raise HTTPException(400, "This reset link is invalid or has expired.")
+    u.password_hash = auth.hash_password(body.password)
+    # Receiving this link proves control of the mailbox — the same proof the verify link
+    # provides — so consume it as verification too. Without this, bumping token_version
+    # below would kill the registration verify link (the only one ever minted) and, with
+    # REQUIRE_EMAIL_VERIFICATION, lock the account out permanently.
+    u.email_verified = True
+    u.token_version += 1  # revoke every existing session + this now-used reset link
+    db.commit()
+    return {"ok": True}
+
+
+class TokenIn(BaseModel):
+    token: str
+
+
+@router.post("/verify")
+def verify(body: TokenIn, response: Response, db: Session = Depends(get_db)):
+    claims = auth.read_token(body.token, purpose="verify")
+    if claims is None:
+        raise HTTPException(400, "This verification link is invalid or has expired.")
+    uid, ver = claims
+    u = db.get(User, uid)
+    if not u or u.token_version != ver:
+        raise HTTPException(400, "This verification link is invalid or has expired.")
+    u.email_verified = True
+    db.commit()
+    _set_cookie(response, u)  # verifying signs you in
+    return _public(u)

provekit/routers/connections.py

@@ -0,0 +1,270 @@
+"""Connections (providers): llm | mcp | agent. Secrets are masked in responses and
+preserved on update when the client sends a masked/empty key."""
+import httpx
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..models import Connection, Workspace, iso_utc
+from ..services.assertions import get_path
+from ..services.masking import is_masked, mask_headers, mask_value
+from ..services.netguard import BlockedURL, guard_url
+from ..services.providers.mcp_client import MCPSession
+from ..services.workspace import current_workspace
+
+
+def _guard_url(url: str) -> None:
+    """Shared SSRF guard (services.netguard), surfaced as a 400 for router callers."""
+    try:
+        guard_url(url)
+    except BlockedURL as exc:
+        raise HTTPException(400, str(exc))
+
+
+def _get(db: Session, ws: Workspace, cid: int) -> Connection:
+    """Fetch a connection scoped to the workspace (404 across workspaces)."""
+    c = db.get(Connection, cid)
+    if not c or c.workspace_id != ws.id:
+        raise HTTPException(404, "Connection not found")
+    return c
+
+
+router = APIRouter(prefix="/api/connections", tags=["connections"])
+
+
+def _public(c: Connection) -> dict:
+    cfg = dict(c.config or {})
+    if cfg.get("api_key"):
+        cfg["api_key"] = mask_value(cfg["api_key"])
+        cfg["has_key"] = True
+    hdrs = cfg.get("headers")
+    if isinstance(hdrs, dict) and hdrs:
+        cfg["headers"] = mask_headers(hdrs)
+    oauth = cfg.get("oauth")
+    if isinstance(oauth, dict) and oauth.get("client_secret"):
+        cfg["oauth"] = {**oauth, "client_secret": mask_value(oauth["client_secret"])}
+    env = cfg.get("env")
+    if isinstance(env, dict) and env:
+        cfg["env"] = {k: mask_value(v) for k, v in env.items()}
+    return {"id": c.id, "name": c.name, "kind": c.kind, "config": cfg,
+            "created_at": iso_utc(c.created_at)}
+
+
+class ConnectionIn(BaseModel):
+    name: str
+    kind: str  # llm | mcp | agent
+    config: dict = {}
+
+
+def _restore_secrets(incoming: dict, stored: dict) -> dict:
+    """Map each masked value back to the stored secret it stands for, by key.
+
+    A masked value is a display placeholder, never a credential. If the key has no stored
+    counterpart — the user renamed an env var or header without retyping its value — the
+    entry is dropped rather than persisted, which would otherwise seal the literal
+    "••••3456" as the credential and fail later with no clue why.
+    """
+    out = {}
+    for k, v in incoming.items():
+        if not is_masked(v):
+            out[k] = v
+        elif k in stored:
+            out[k] = stored[k]
+    return out
+
+
+@router.get("")
+def list_connections(db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    return [_public(c) for c in db.query(Connection).filter(Connection.workspace_id == ws.id).order_by(Connection.id).all()]
+
+
+@router.post("")
+def create_connection(payload: ConnectionIn, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    # A new connection has nothing stored to restore a mask from, so any masked value here
+    # (a UI "duplicate" that round-trips a GET response) is dropped, not saved as a secret.
+    cfg = dict(payload.config or {})
+    if is_masked(cfg.get("api_key")):
+        cfg["api_key"] = ""
+    if isinstance(cfg.get("oauth"), dict) and is_masked(cfg["oauth"].get("client_secret")):
+        cfg["oauth"] = {**cfg["oauth"], "client_secret": ""}
+    for field in ("headers", "env"):
+        if isinstance(cfg.get(field), dict):
+            cfg[field] = _restore_secrets(cfg[field], {})
+    cfg.pop("has_key", None)
+    c = Connection(workspace_id=ws.id, name=payload.name, kind=payload.kind, config=cfg)
+    db.add(c); db.commit(); db.refresh(c)
+    return _public(c)
+
+
+@router.put("/{cid}")
+def update_connection(cid: int, payload: ConnectionIn, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    c = _get(db, ws, cid)
+    cfg = dict(payload.config or {})
+    stored = c.config or {}
+    # Preserve the stored key if the client didn't send a fresh one.
+    incoming = cfg.get("api_key", "")
+    if not incoming or is_masked(incoming):
+        cfg["api_key"] = stored.get("api_key", "")
+    # Same for masked secret headers — don't let a masked value overwrite the real token.
+    if isinstance(cfg.get("headers"), dict):
+        cfg["headers"] = _restore_secrets(cfg["headers"], stored.get("headers") or {})
+    # Preserve a masked/blank MCP OAuth client_secret rather than clobbering the stored one.
+    oauth = cfg.get("oauth")
+    if isinstance(oauth, dict):
+        cs = oauth.get("client_secret", "")
+        if isinstance(cs, str) and (not cs or is_masked(cs)):
+            cfg["oauth"] = {**oauth, "client_secret": (stored.get("oauth") or {}).get("client_secret", "")}
+    # Same for masked stdio env values.
+    if isinstance(cfg.get("env"), dict):
+        cfg["env"] = _restore_secrets(cfg["env"], stored.get("env") or {})
+    cfg.pop("has_key", None)
+    c.name, c.kind, c.config = payload.name, payload.kind, cfg
+    db.commit(); db.refresh(c)
+    return _public(c)
+
+
+@router.delete("/{cid}")
+def delete_connection(cid: int, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    c = db.get(Connection, cid)
+    if c and c.workspace_id == ws.id:
+        db.delete(c); db.commit()
+    return {"deleted": True}
+
+
+class AuthPayload(BaseModel):
+    login_path: str = "/api/auth/login"
+    method: str = "POST"
+    body: dict = {}
+    token_path: str = "token"
+    header: str = "Authorization"
+    scheme: str = "Bearer"
+
+
+@router.post("/{cid}/authenticate")
+def authenticate(cid: int, payload: AuthPayload, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Perform a login against the agent's base URL, extract the token, and store it as a
+    default header on the connection. Credentials are used transiently — only the token
+    (which expires) is saved, never the username/password."""
+    c = _get(db, ws, cid)
+    if c.kind != "agent":
+        raise HTTPException(400, "Not an agent connection")
+    base = (c.config or {}).get("base_url")
+    if not base:
+        raise HTTPException(400, "Connection has no base_url")
+    url = base.rstrip("/") + "/" + payload.login_path.lstrip("/")
+    _guard_url(url)
+    try:
+        r = httpx.request(payload.method.upper(), url, json=payload.body or None, timeout=30)
+        r.raise_for_status()
+        data = r.json()
+    except Exception as exc:
+        raise HTTPException(502, f"Login failed: {exc}")
+    token = get_path(data, payload.token_path)
+    if not token:
+        raise HTTPException(400, f"No token found at '{payload.token_path}' in the login response")
+    headers = dict((c.config or {}).get("headers") or {})
+    headers[payload.header] = f"{payload.scheme} {token}".strip()
+    c.config = {**(c.config or {}), "headers": headers}
+    db.commit()
+    tok = str(token)
+    return {"ok": True, "header": payload.header, "token": (tok[:6] + "…" + tok[-4:]) if len(tok) > 12 else "••••"}
+
+
+DEFAULT_BASE = {"openai": "https://api.openai.com/v1", "openai-responses": "https://api.openai.com/v1",
+                "anthropic": "https://api.anthropic.com/v1"}
+
+
+@router.post("/{cid}/test")
+def test_connection(cid: int, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Live reachability/auth check so onboarding can confirm a connection works before use.
+    llm → list models · mcp → list tools · agent → GET the base URL."""
+    c = _get(db, ws, cid)
+    cfg = c.config or {}
+    try:
+        if c.kind == "mcp":
+            if not cfg.get("url") and not cfg.get("command"):
+                return {"ok": False, "detail": "No server URL or command set"}
+            tools = _mcp_from_cfg(cfg).list_tools()
+            return {"ok": True, "detail": f"{len(tools)} tool{'s' if len(tools) != 1 else ''} discovered"}
+        if c.kind == "llm":
+            provider = cfg.get("provider", "openai")
+            if provider == "mock":
+                return {"ok": True, "detail": "Demo agent ready — no key needed"}
+            base = (cfg.get("base_url") or DEFAULT_BASE.get(provider, "")).rstrip("/")
+            key = cfg.get("api_key") or ""
+            if not key:
+                return {"ok": False, "detail": "No API key set"}
+            if not base:
+                return {"ok": False, "detail": "No base URL set"}
+            _guard_url(base)
+            if provider == "anthropic":
+                headers = {"x-api-key": key, "anthropic-version": "2023-06-01"}
+            else:
+                headers = {"Authorization": f"Bearer {key}"}
+            r = httpx.get(base + "/models", headers=headers, timeout=15)
+            if r.status_code == 200:
+                n = len(((r.json() or {}).get("data")) or [])
+                return {"ok": True, "detail": f"Authenticated — {n} models available" if n else "Authenticated ✓"}
+            if r.status_code in (401, 403):
+                return {"ok": False, "detail": "Key rejected (401/403) — check the API key"}
+            return {"ok": False, "detail": f"Provider returned {r.status_code}"}
+        if c.kind == "a2a":
+            base = (cfg.get("base_url") or "").rstrip("/")
+            if not base:
+                return {"ok": False, "detail": "No base URL set"}
+            _guard_url(base)
+            from ..services.providers.a2a_client import fetch_card
+            card = fetch_card(base, headers=cfg.get("headers"))
+            return {"ok": True, "detail": f"Agent card: {card.get('name')} (A2A {card.get('_version')})"}
+        # agent
+        base = (cfg.get("base_url") or "").rstrip("/")
+        if not base:
+            return {"ok": False, "detail": "No base URL set"}
+        _guard_url(base)
+        r = httpx.get(base, headers=cfg.get("headers") or None, timeout=15)
+        return {"ok": r.status_code < 500, "detail": f"Reachable — HTTP {r.status_code}"}
+    except Exception as exc:
+        return {"ok": False, "detail": f"Unreachable: {str(exc)[:120]}"}
+
+
+def _mcp_from_cfg(cfg: dict) -> MCPSession:
+    """Build an MCP session (stdio | http, spec, oauth) from a connection config."""
+    if cfg.get("command"):
+        return MCPSession(command=cfg["command"], args=cfg.get("args"), env=cfg.get("env"),
+                          spec=cfg.get("spec", "auto"))
+    _guard_url(cfg.get("url") or "")
+    return MCPSession(cfg.get("url"), headers=cfg.get("headers"),
+                      spec=cfg.get("spec", "auto"), oauth=cfg.get("oauth"))
+
+
+@router.get("/{cid}/agent-card")
+def agent_card(cid: int, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Fetch + validate an A2A connection's agent card (for the request form / discovery)."""
+    c = _get(db, ws, cid)
+    if c.kind != "a2a":
+        raise HTTPException(400, "Not an A2A connection")
+    base = (c.config or {}).get("base_url")
+    if not base:
+        raise HTTPException(400, "A2A connection has no base_url")
+    _guard_url(base)
+    try:
+        from ..services.providers.a2a_client import fetch_card
+        return {"card": fetch_card(base, headers=(c.config or {}).get("headers"))}
+    except Exception as exc:
+        raise HTTPException(502, f"A2A error: {exc}")
+
+
+@router.get("/{cid}/tools")
+def list_tools(cid: int, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Discover the tools exposed by an MCP connection (for the tool request form)."""
+    c = _get(db, ws, cid)
+    if c.kind != "mcp":
+        raise HTTPException(400, "Not an MCP connection")
+    cfg = c.config or {}
+    if not cfg.get("url") and not cfg.get("command"):
+        raise HTTPException(400, "MCP connection has no url or command")
+    try:
+        return {"tools": _mcp_from_cfg(cfg).list_tools()}
+    except Exception as exc:
+        raise HTTPException(502, f"MCP error: {exc}")

provekit/routers/deployments.py

@@ -0,0 +1,161 @@
+"""Deployments — publish a flow as a hosted, versioned endpoint. Workspace-scoped.
+The public invocation route lives in routers/runtime.py."""
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from ..config import get_settings
+from ..database import get_db
+from ..models import Deployment, Flow, Run, Workspace, iso_utc
+from ..services import deploy
+from ..services.workspace import current_workspace
+
+router = APIRouter(prefix="/api/deployments", tags=["deployments"])
+
+
+def _public(d: Deployment, url: str | None = None) -> dict:
+    out = {"id": d.id, "slug": d.slug, "version": d.version, "name": d.name,
+           "flow_id": d.flow_id, "active": d.active, "created_at": iso_utc(d.created_at)}
+    if url:
+        out["url"] = url
+    return out
+
+
+def _endpoint(slug: str) -> str:
+    base = get_settings().public_base_url.rstrip("/")
+    return f"{base}/v1/d/{slug}"
+
+
+class DeployIn(BaseModel):
+    flow_id: int
+
+
+@router.post("")
+def create_deployment(payload: DeployIn, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Publish a flow. First publish mints an API key (returned once); redeploys of the
+    same flow bump the version, snapshot the current graph, and keep the key."""
+    f = db.get(Flow, payload.flow_id)
+    if not f or f.workspace_id != ws.id:
+        raise HTTPException(404, "Flow not found")
+
+    prior = (db.query(Deployment)
+             .filter(Deployment.workspace_id == ws.id, Deployment.flow_id == f.id)
+             .order_by(Deployment.version.desc()).first())
+    snapshot = {"nodes": f.nodes, "edges": f.edges}
+    plaintext = None
+    if prior:
+        key_hash, slug, version = prior.api_key_hash, prior.slug, prior.version + 1
+        for d in db.query(Deployment).filter(Deployment.slug == slug, Deployment.active.is_(True)).all():
+            d.active = False
+    else:
+        plaintext, key_hash = deploy.new_api_key()
+        slug, version = _unique_slug(db, deploy.slugify(f.name)), 1
+
+    d = Deployment(workspace_id=ws.id, flow_id=f.id, slug=slug, version=version,
+                   name=f.name, snapshot=snapshot, api_key_hash=key_hash, active=True)
+    db.add(d); db.commit(); db.refresh(d)
+    resp = _public(d, _endpoint(slug))
+    if plaintext:  # shown exactly once
+        resp["api_key"] = plaintext
+    return resp
+
+
+def _unique_slug(db, base: str) -> str:
+    slug, n = base, 2
+    while db.query(Deployment).filter(Deployment.slug == slug).first():
+        slug = f"{base}-{n}"; n += 1
+    return slug
+
+
+@router.get("")
+def list_deployments(db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """One row per slug: the version actually being served, plus the version count.
+
+    Picks the *active* row, falling back to the latest when nothing is active. Always
+    picking the latest would misreport a rolled-back slug as inactive while an older
+    version keeps answering /v1/d/{slug} — see runtime.serve().
+    """
+    rows = db.query(Deployment).filter(Deployment.workspace_id == ws.id).order_by(Deployment.id.desc()).all()
+    serving: dict[str, Deployment] = {}
+    counts: dict[str, int] = {}
+    latest: dict[str, int] = {}
+    for d in rows:
+        counts[d.slug] = counts.get(d.slug, 0) + 1
+        latest[d.slug] = max(latest.get(d.slug, 0), d.version)
+        cur = serving.get(d.slug)
+        if cur is None or (d.active, d.version) > (cur.active, cur.version):
+            serving[d.slug] = d
+    return [{**_public(d, _endpoint(slug)), "versions": counts[slug], "latest_version": latest[slug]}
+            for slug, d in serving.items()]
+
+
+@router.get("/{slug}")
+def get_deployment(slug: str, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    rows = (db.query(Deployment)
+            .filter(Deployment.workspace_id == ws.id, Deployment.slug == slug)
+            .order_by(Deployment.version.desc()).all())
+    if not rows:
+        raise HTTPException(404, "Deployment not found")
+    active = next((r for r in rows if r.active), rows[0])
+    return {**_public(active, _endpoint(slug)),
+            "versions": [{"version": r.version, "active": r.active, "created_at": iso_utc(r.created_at)} for r in rows]}
+
+
+@router.get("/{slug}/runs")
+def deployment_runs(slug: str, limit: int = 50, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Recent invocations of this deployment (all versions)."""
+    dep_ids = [d.id for d in db.query(Deployment.id).filter(Deployment.workspace_id == ws.id, Deployment.slug == slug).all()]
+    if not dep_ids:
+        raise HTTPException(404, "Deployment not found")
+    limit = max(1, min(limit, 200))  # clamp both ends (SQLite treats LIMIT -1 as unlimited)
+    rows = (db.query(Run).filter(Run.deployment_id.in_(dep_ids))
+            .order_by(Run.id.desc()).limit(limit).all())
+    return [{"id": r.id, "status": r.status, "duration_ms": r.duration_ms,
+             "created_at": iso_utc(r.created_at)} for r in rows]
+
+
+@router.get("/{slug}/stats")
+def deployment_stats(slug: str, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    """Aggregate metrics: invocations, error rate, p50/p95 latency."""
+    dep_ids = [d.id for d in db.query(Deployment.id).filter(Deployment.workspace_id == ws.id, Deployment.slug == slug).all()]
+    if not dep_ids:
+        raise HTTPException(404, "Deployment not found")
+    rows = db.query(Run.status, Run.duration_ms).filter(Run.deployment_id.in_(dep_ids)).all()
+    total = len(rows)
+    failed = sum(1 for s, _ in rows if s == "failed")
+    durs = sorted(d for _, d in rows if d is not None)
+
+    def pct(p):
+        if not durs:
+            return 0
+        return durs[min(len(durs) - 1, int(len(durs) * p))]
+    return {"invocations": total, "failed": failed,
+            "error_rate": round(failed / total, 4) if total else 0.0,
+            "p50_ms": pct(0.50), "p95_ms": pct(0.95)}
+
+
+@router.post("/{slug}/deactivate")
+def deactivate(slug: str, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    rows = db.query(Deployment).filter(Deployment.workspace_id == ws.id, Deployment.slug == slug).all()
+    if not rows:
+        raise HTTPException(404, "Deployment not found")
+    for r in rows:
+        r.active = False
+    db.commit()
+    return {"ok": True}
+
+
+class RollbackIn(BaseModel):
+    version: int
+
+
+@router.post("/{slug}/rollback")
+def rollback(slug: str, payload: RollbackIn, db: Session = Depends(get_db), ws: Workspace = Depends(current_workspace)):
+    rows = db.query(Deployment).filter(Deployment.workspace_id == ws.id, Deployment.slug == slug).all()
+    target = next((r for r in rows if r.version == payload.version), None)
+    if not target:
+        raise HTTPException(404, "Version not found")
+    for r in rows:
+        r.active = (r.version == payload.version)
+    db.commit()
+    return _public(target, _endpoint(slug))