querri 1.0.8__tar.gz → 2.0.0__tar.gz

querri-2.0.0/CHANGELOG.md

@@ -0,0 +1,89 @@
+# Changelog
+
+## 2.0.0 (2026-08-31)
+
+Migration guide with before/after snippets: [docs/MIGRATION.md](docs/MIGRATION.md).
+
+### Breaking
+
+- **`source_scope` removed from `client.embed.create_session()`** (sync and
+  async). It was never enforced by the server — a silently-ignored parameter
+  that *looked* like access control. Passing it now raises `TypeError`. Scope
+  sessions with access policies instead: `client.embed.get_session(access=...)`.
+- **`as_user()` / `UserQuerri` rebased from `/api` to `/api/v1`.** Embed
+  sessions (`X-Embed-Session`) are the public API's highest-priority
+  credential, so user-scoped clients now call the same public API paths as
+  the admin client.
+- **`user_client.dashboards` is read-only.** Embed sessions exclude the
+  `admin:dashboards:write` scope server-side; the user-scoped surface now
+  exposes only `list()`, `get()`, and `refresh_status()` — `create`,
+  `update`, `delete`, and `refresh` no longer exist there (they always
+  belonged to the admin client).
+- There is no `user_client.embed`: embed sessions exclude
+  `embed:session:create` server-side (a session cannot mint sessions).
+  The accessor never existed in the SDK; the contract is now documented
+  and tested.
+- **`ttl` is validated client-side**: `create_session()` and
+  `get_session()` raise `ValueError` for TTLs outside [900, 86400] seconds
+  instead of sending a value the server would silently clamp.
+
+### Added
+
+- `client.embed.get_ui_config(org)` — fetches the public, unauthenticated
+  `GET {host}/api/embed/ui-config?org=...` (main app path, not `/api/v1`)
+  and returns the raw `{chrome, theme, privacy}` dict.
+- `querri session ui-config --org <id>` CLI command for the same.
+- `OriginRequiredError` (subclass of `ValidationError`), raised for
+  `400 origin_required` with a message explaining the org's embed-domain
+  allowlist and how to pass `origin`.
+- `querri share source org` gained `--disable` to turn org-wide sharing
+  off (the server contract always supported `enabled: false`).
+- `querri keys create` interactive scope picker now includes the
+  `admin:skills:*`, `admin:library:*` scopes and `*` (superadmin).
+
+### Fixed
+
+- `client.embed.revoke_user_sessions()` no longer stops at the first
+  listing page: the server caps listings at 200 with no cursor, so it now
+  loops revoke-and-relist until a listing shows no sessions for the user
+  (bounded at 50 passes), and tolerates a session expiring between list
+  and delete. Still best-effort — with more than 200 concurrent sessions
+  org-wide the listing is a sample and stragglers can survive; do not
+  treat a return as proof every session is gone.
+
+## 1.1.1 (2026-08-31)
+
+### Fixed
+
+- **Web-embed example** (`examples/web-embed/server.py`): three dispatched
+  actions called keyword-only SDK methods positionally, raising `TypeError`
+  (returned as HTTP 500): `embed.refreshSession`, `users.getOrCreate`, and
+  `policies.resolve`. All now pass keyword arguments.
+- **Web-embed example** (`examples/web-embed/index.html`): the SDK Explorer's
+  "Data" group sent `data.*` action names the server never dispatched — every
+  action in the group returned "Unknown action". Renamed to the real
+  `sources.*` actions.
+- **Docs**: `docs/server-sdk.md` and `README.md` showed `create_session`,
+  `refresh_session`, and `get_session` with positional parameters; all three
+  are keyword-only (`create_session(*, user_id=..., origin=..., ttl=...)`,
+  `refresh_session(session_token=...)`). Snippets updated to keyword form.
+- **Browser embed loading**: examples and docs now load the embed script from
+  the product — `<script src="{serverUrl}/sdk/querri-embed.js">` — instead of
+  an unverifiable CDN/npm IIFE path. The web-embed example injects the script
+  after fetching `serverUrl` from its `/api/config` endpoint.
+- **Embed chrome options**: examples use the v2 vocabulary
+  (`chrome: { rail: { show: true }, header: { show: true } }` — `rail`
+  replaces `sidebar`).
+- **Origin allowlist guidance**: create-session docs and examples now pass
+  `origin` and document the enforcement behavior — when the organization
+  configures allowed embed domains, session creation without an origin fails
+  with `400 origin_required`, and an origin not on the allowlist fails with
+  `403 origin_not_allowed`.
+
+### Deprecated
+
+- `source_scope` on `client.embed.create_session()` (sync and async): the
+  server does not enforce it, and it will be removed in v2.0.0. Passing it now
+  emits a `DeprecationWarning`; the field is still sent, so behavior is
+  unchanged. Scope sessions with access policies instead — see
+  `client.embed.get_session(access=...)`.

querri-2.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Querri, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{querri-1.0.8 → querri-2.0.0}/PKG-INFO

@@ -1,12 +1,13 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: querri
-Version: 1.0.8
+Version: 2.0.0
 Summary: Python SDK and CLI for the Querri data analysis platform
 Project-URL: Homepage, https://querri.com
 Project-URL: Documentation, https://docs.querri.com/sdk/python
 Project-URL: Repository, https://github.com/Querri-inc/querri-python
 Author-email: Querri <support@querri.com>
 License-Expression: MIT
+License-File: LICENSE
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -117,7 +118,7 @@ See [`skills/querri-cli/SKILL.md`](skills/querri-cli/SKILL.md) for the full comm
 
 ## Python SDK
 
-For embedding Querri analytics in a Python web application. Use alongside the [`@querri-inc/embed`](https://www.npmjs.com/package/@querri-inc/embed) frontend component.
+For embedding Querri analytics in a Python web application. The backend SDK creates embed sessions; the frontend loads the embed script directly from your Querri server at `{serverUrl}/sdk/querri-embed.js` (a React wrapper is also available — see below).
 
 ### Quick Start
 
@@ -164,15 +165,52 @@ def querri_session():
 
 Django and FastAPI follow the identical pattern — see **[docs/server-sdk.md](docs/server-sdk.md)** for those examples.
 
+Always forward the request's `Origin` header as shown. If your organization configures an allowlist of embed domains, the server enforces it when the session is created: a missing origin fails with `400 origin_required`, and an origin not on the allowlist fails with `403 origin_not_allowed`. Without an allowlist, `origin` is accepted but not enforced.
+
+### Add the embed (browser)
+
+Load the embed script from your Querri server — it is served at `{serverUrl}/sdk/querri-embed.js` and always matches the server's version:
+
+```html
+<div id="querri" style="width: 100%; height: 600px;"></div>
+<script src="https://app.querri.com/sdk/querri-embed.js"></script>
+<script>
+  QuerriEmbed.create(document.getElementById('querri'), {
+    serverUrl: 'https://app.querri.com',
+    auth: {
+      fetchSessionToken: async () => {
+        const res = await fetch('/api/querri-session', { method: 'POST' });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || 'Session failed');
+        return data.session_token;
+      },
+    },
+    startView: '/home',
+    chrome: { rail: { show: true }, header: { show: true } },
+  });
+</script>
+```
+
+Use the same host for the script tag and `serverUrl`. See [`examples/web-embed/`](examples/web-embed/) for a working page that fetches the server URL from its backend before injecting the script.
+
 ### Add the embed (React)
 
+A React wrapper is available (requires `@querri-inc/embed` >= 1.0.0):
+
 ```tsx
 import { QuerriEmbed } from '@querri-inc/embed/react';
 
 <QuerriEmbed
   style={{ width: '100%', height: '600px' }}
   serverUrl="https://app.querri.com"
-  auth={{ sessionEndpoint: '/api/querri-session' }}
+  auth={{
+    fetchSessionToken: async () => {
+      const res = await fetch('/api/querri-session', { method: 'POST' });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || 'Session failed');
+      return data.session_token;
+    },
+  }}
 />
 ```
 
@@ -244,7 +282,7 @@ See **[docs/server-sdk.md](docs/server-sdk.md#user-scoped-client-as_user)** for
 
 | Resource | Access | Key Methods |
 |----------|--------|-------------|
-| `client.embed` | Embed sessions (flagship) | `get_session`, `create_session`, `refresh_session`, `revoke_session`, `list_sessions` |
+| `client.embed` | Embed sessions (flagship) | `get_session`, `create_session`, `refresh_session`, `revoke_session`, `list_sessions`, `get_ui_config` |
 | `client.policies` | Row-level access control | `setup`, `create`, `list`, `get`, `update`, `delete`, `assign_users`, `remove_user`, `resolve`, `columns` |
 | `client.users` | User management | `list`, `create`, `get`, `get_or_create`, `update`, `delete` |
 | `client.dashboards` | Dashboard management | `list`, `create`, `get`, `update`, `delete`, `refresh`, `refresh_status` |
@@ -280,6 +318,7 @@ All errors extend `QuerriError`:
 QuerriError
 ├── APIError                — HTTP error responses
 │   ├── ValidationError     — 400
+│   │   └── OriginRequiredError — 400 origin_required (org has an embed-domain allowlist)
 │   ├── AuthenticationError — 401
 │   ├── PermissionError     — 403
 │   ├── NotFoundError       — 404
@@ -315,3 +354,7 @@ pytest tests/test_integration.py -m integration -v  # requires API credentials
 ## License
 
 MIT
+
+## Support policy
+
+The 1.x line receives security fixes only, for 6 months from the 2.0.0 release (2026-08-31). Migrate with [docs/MIGRATION.md](docs/MIGRATION.md).

{querri-1.0.8 → querri-2.0.0}/README.md

@@ -72,7 +72,7 @@ See [`skills/querri-cli/SKILL.md`](skills/querri-cli/SKILL.md) for the full comm
 
 ## Python SDK
 
-For embedding Querri analytics in a Python web application. Use alongside the [`@querri-inc/embed`](https://www.npmjs.com/package/@querri-inc/embed) frontend component.
+For embedding Querri analytics in a Python web application. The backend SDK creates embed sessions; the frontend loads the embed script directly from your Querri server at `{serverUrl}/sdk/querri-embed.js` (a React wrapper is also available — see below).
 
 ### Quick Start
 
@@ -119,15 +119,52 @@ def querri_session():
 
 Django and FastAPI follow the identical pattern — see **[docs/server-sdk.md](docs/server-sdk.md)** for those examples.
 
+Always forward the request's `Origin` header as shown. If your organization configures an allowlist of embed domains, the server enforces it when the session is created: a missing origin fails with `400 origin_required`, and an origin not on the allowlist fails with `403 origin_not_allowed`. Without an allowlist, `origin` is accepted but not enforced.
+
+### Add the embed (browser)
+
+Load the embed script from your Querri server — it is served at `{serverUrl}/sdk/querri-embed.js` and always matches the server's version:
+
+```html
+<div id="querri" style="width: 100%; height: 600px;"></div>
+<script src="https://app.querri.com/sdk/querri-embed.js"></script>
+<script>
+  QuerriEmbed.create(document.getElementById('querri'), {
+    serverUrl: 'https://app.querri.com',
+    auth: {
+      fetchSessionToken: async () => {
+        const res = await fetch('/api/querri-session', { method: 'POST' });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || 'Session failed');
+        return data.session_token;
+      },
+    },
+    startView: '/home',
+    chrome: { rail: { show: true }, header: { show: true } },
+  });
+</script>
+```
+
+Use the same host for the script tag and `serverUrl`. See [`examples/web-embed/`](examples/web-embed/) for a working page that fetches the server URL from its backend before injecting the script.
+
 ### Add the embed (React)
 
+A React wrapper is available (requires `@querri-inc/embed` >= 1.0.0):
+
 ```tsx
 import { QuerriEmbed } from '@querri-inc/embed/react';
 
 <QuerriEmbed
   style={{ width: '100%', height: '600px' }}
   serverUrl="https://app.querri.com"
-  auth={{ sessionEndpoint: '/api/querri-session' }}
+  auth={{
+    fetchSessionToken: async () => {
+      const res = await fetch('/api/querri-session', { method: 'POST' });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error || 'Session failed');
+      return data.session_token;
+    },
+  }}
 />
 ```
 
@@ -199,7 +236,7 @@ See **[docs/server-sdk.md](docs/server-sdk.md#user-scoped-client-as_user)** for
 
 | Resource | Access | Key Methods |
 |----------|--------|-------------|
-| `client.embed` | Embed sessions (flagship) | `get_session`, `create_session`, `refresh_session`, `revoke_session`, `list_sessions` |
+| `client.embed` | Embed sessions (flagship) | `get_session`, `create_session`, `refresh_session`, `revoke_session`, `list_sessions`, `get_ui_config` |
 | `client.policies` | Row-level access control | `setup`, `create`, `list`, `get`, `update`, `delete`, `assign_users`, `remove_user`, `resolve`, `columns` |
 | `client.users` | User management | `list`, `create`, `get`, `get_or_create`, `update`, `delete` |
 | `client.dashboards` | Dashboard management | `list`, `create`, `get`, `update`, `delete`, `refresh`, `refresh_status` |
@@ -235,6 +272,7 @@ All errors extend `QuerriError`:
 QuerriError
 ├── APIError                — HTTP error responses
 │   ├── ValidationError     — 400
+│   │   └── OriginRequiredError — 400 origin_required (org has an embed-domain allowlist)
 │   ├── AuthenticationError — 401
 │   ├── PermissionError     — 403
 │   ├── NotFoundError       — 404
@@ -270,3 +308,7 @@ pytest tests/test_integration.py -m integration -v  # requires API credentials
 ## License
 
 MIT
+
+## Support policy
+
+The 1.x line receives security fixes only, for 6 months from the 2.0.0 release (2026-08-31). Migrate with [docs/MIGRATION.md](docs/MIGRATION.md).

querri-2.0.0/docs/MIGRATION.md

@@ -0,0 +1,120 @@
+# Migrating from 1.x to 2.0
+
+v2.0.0 removes a fake security parameter, aligns the user-scoped client with
+what the server actually authorizes, and makes two silent server behaviors
+loud. Most 1.x code runs unchanged; the breaking changes are below, each with
+before/after.
+
+## `source_scope` removed from `create_session()`
+
+**This is a security fix, not a cleanup.** `source_scope` was accepted by the
+SDK and sent to the server, but the server never enforced it. Code that passed
+it got sessions that *looked* scoped to specific sources and were not — a
+silently-ignored access-control parameter is worse than none, because it reads
+as a guarantee. v1.1.1 started warning; v2.0.0 removes it, so passing it now
+raises `TypeError`.
+
+Scope sessions with access policies, which the server enforces:
+
+```python
+# Before (1.x) — source_scope was silently ignored
+session = client.embed.create_session(
+    user_id="usr_1",
+    source_scope=["src_sales"],   # did nothing
+)
+
+# After (2.0) — access policies are enforced server-side
+session = client.embed.get_session(
+    user="customer-42",
+    access={"sources": ["src_sales"], "filters": {"tenant_id": "acme"}},
+)
+```
+
+`get_session()` resolves the user, finds-or-creates a policy from the access
+spec, assigns it, and mints the session in one call. If you manage policies
+yourself, use `client.policies.setup(...)` / `assign_users(...)` and then
+`create_session(user_id=...)` — the session inherits whatever the user's
+policies grant.
+
+## `as_user()` now calls `/api/v1`
+
+`UserQuerri` previously called the internal API at `{host}/api`. Embed
+sessions are the public API's highest-priority credential, so user-scoped
+clients now call the same `/api/v1` paths as the admin client, still with the
+`X-Embed-Session` header. No code change needed unless you depended on the
+URL (e.g. in proxies, allowlists, or request logging):
+
+```python
+# Same code in 1.x and 2.0 — only the wire paths changed:
+#   1.x: GET {host}/api/projects
+#   2.0: GET {host}/api/v1/projects
+with client.as_user(session) as uc:
+    for project in uc.projects.list():
+        print(project.name)
+```
+
+## User-scoped dashboards are read-only
+
+Embed sessions exclude the `admin:dashboards:write` scope server-side —
+writes always failed with 403. The SDK surface now says so:
+`user_client.dashboards` exposes `list()`, `get()`, and `refresh_status()`
+only.
+
+```python
+# Before (1.x) — compiled, then 403'd at runtime
+with client.as_user(session) as uc:
+    uc.dashboards.delete("dash_1")        # AttributeError in 2.0
+
+# After (2.0) — dashboard writes belong to the admin client
+client.dashboards.delete("dash_1")
+```
+
+Similarly, there is no `user_client.embed` (there never was one that worked:
+`embed:session:create` is excluded from embed-session scopes). Mint and
+manage sessions from the admin client.
+
+## `ttl` outside [900, 86400] raises `ValueError`
+
+The server silently clamps out-of-range TTLs. The SDK now refuses to send a
+TTL that would not be honored as given:
+
+```python
+# Before (1.x) — sent ttl=60, server silently created a 900s session
+client.embed.create_session(user_id="usr_1", ttl=60)
+
+# After (2.0) — fails loudly before any HTTP
+# ValueError: ttl must be between 900 and 86400 seconds, got 60
+```
+
+## `400 origin_required` raises `OriginRequiredError`
+
+When the org configures an embed-domain allowlist and no `origin` is passed,
+the SDK now raises `OriginRequiredError` — a subclass of `ValidationError`,
+so existing `except ValidationError` handlers keep working — with a message
+that says what to do (pass the embedding page's origin):
+
+```python
+from querri import OriginRequiredError
+
+try:
+    session = client.embed.create_session(user_id="usr_1")
+except OriginRequiredError:
+    session = client.embed.create_session(
+        user_id="usr_1", origin="https://app.customer.com"
+    )
+```
+
+## `revoke_user_sessions()` paginates
+
+In 1.x it revoked at most whatever one listing returned (the server caps
+listings at 200 with no cursor). It now loops revoke-and-relist until a
+listing shows no sessions for the user. The signature and return value are
+unchanged; only the completeness improved — expect more requests (and a
+larger returned count) for users with many sessions.
+
+## New in 2.0 (non-breaking)
+
+- `client.embed.get_ui_config(org)` — the public embed UI config
+  (`{chrome, theme, privacy}`) from `GET {host}/api/embed/ui-config?org=...`.
+- `querri session ui-config --org <id>` — CLI for the same.
+- `querri share source org SOURCE_ID --disable` — turn org-wide sharing off.