secondshift 0.1.0b12__py3-none-any.whl

secondshift/connections/mcp/signin.py

@@ -0,0 +1,206 @@
+"""Browser sign-in for MCP connections: start, then finish on the callback."""
+
+import logging
+import re
+import secrets
+from urllib.parse import urlencode
+
+from asgiref.sync import async_to_sync
+from django.contrib.auth.models import AbstractBaseUser
+from django.db import IntegrityError, transaction
+from django.utils import timezone
+
+from secondshift.connections.dao import (
+    binding_taken,
+    create_authorization,
+    delete_stale_authorizations,
+    lock_unused_authorization,
+)
+from secondshift.connections.mcp.base import MCPError
+from secondshift.connections.mcp.client import (
+    connection_target,
+    discover_tools,
+    select_tools,
+)
+from secondshift.connections.mcp.oauth import (
+    AUTHORIZATION_TTL,
+    MAX_SCOPES,
+    OAUTH,
+    SCOPE_PATTERN,
+    apply_tokens,
+    discover,
+    granted_scopes,
+    pkce_pair,
+    redirect_uri,
+    register_client,
+    token_request,
+)
+from secondshift.connections.mcp.providers import mcp_provider
+from secondshift.connections.models import Connection, OAuthAuthorization
+from secondshift.connections.services import ConnectionConflict
+from secondshift.workspaces.access import Action, role_allows
+from secondshift.workspaces.dao import find_membership
+from secondshift.workspaces.models import Workspace
+
+logger = logging.getLogger(__name__)
+
+
+class SignInError(MCPError):
+    """A sign-in that cannot finish. `code` is safe to put in a redirect URL."""
+
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+
+
+def start_authorization(
+    workspace: Workspace,
+    user: AbstractBaseUser,
+    provider_key: str,
+    binding_key: str,
+    display_name: str,
+    values: dict[str, str],
+    scopes: list[str],
+    connection: Connection | None = None,
+    require_approval: bool = False,
+) -> str:
+    """Record a pending sign-in and return the address to send the browser to."""
+    provider = mcp_provider(provider_key)
+    if OAUTH not in provider.auth_methods:
+        raise MCPError(f"{provider.label} does not support sign-in.")
+    if connection is None and binding_taken(workspace.pk, binding_key):
+        raise ConnectionConflict("This binding already has a connection.")
+    cleaned = provider.clean_settings(values)
+    server = async_to_sync(discover)(provider.endpoint(cleaned))
+    if server is None:
+        raise MCPError("This server does not offer sign-in. Use a token instead.")
+    scopes = sorted(set(scopes))
+    if len(scopes) > MAX_SCOPES or any(
+        not re.fullmatch(SCOPE_PATTERN, scope)
+        or (server.scopes_supported and scope not in server.scopes_supported)
+        for scope in scopes
+    ):
+        raise MCPError("Choose scopes from the server's list.")
+    client_id = async_to_sync(register_client)(server)
+    verifier, challenge = pkce_pair()
+    state = secrets.token_urlsafe(32)
+    delete_stale_authorizations(user, timezone.now() - AUTHORIZATION_TTL)
+    create_authorization(
+        workspace=workspace,
+        user=user,
+        connection=connection,
+        state=state,
+        code_verifier=verifier,
+        provider=provider.key,
+        binding_key=connection.binding_key if connection else binding_key,
+        display_name=display_name,
+        connection_settings=cleaned,
+        scopes=scopes,
+        require_approval=require_approval,
+        oauth={
+            "issuer": server.issuer,
+            "token_endpoint": server.token_endpoint,
+            "client_id": client_id,
+            "resource": server.resource,
+        },
+    )
+    query = {
+        "response_type": "code",
+        "client_id": client_id,
+        "redirect_uri": redirect_uri(),
+        "state": state,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+        "resource": server.resource,
+    }
+    if scopes:
+        query["scope"] = " ".join(scopes)
+    separator = "&" if "?" in server.authorization_endpoint else "?"
+    return f"{server.authorization_endpoint}{separator}{urlencode(query)}"
+
+
+def claim_authorization(user: AbstractBaseUser, state: str) -> OAuthAuthorization:
+    """Single use: a state value works once, for the person who started it."""
+    with transaction.atomic():
+        authorization = lock_unused_authorization(state, user)
+        if authorization is None:
+            raise SignInError("invalid", "This sign-in is not valid. Start again.")
+        authorization.used_at = timezone.now()
+        authorization.save(update_fields=["used_at"])
+    if authorization.created_at < timezone.now() - AUTHORIZATION_TTL:
+        raise SignInError("expired", "This sign-in expired. Start again.")
+    # The person may have lost their role since they started.
+    membership = find_membership(authorization.workspace_id, user.pk)
+    if membership is None or not role_allows(
+        membership.role, Action.ADD_MCP_CONNECTIONS
+    ):
+        raise SignInError("invalid", "This sign-in is not valid. Start again.")
+    return authorization
+
+
+def complete_authorization(
+    user: AbstractBaseUser, state: str, code: str, error: str
+) -> Connection:
+    authorization = claim_authorization(user, state)
+    if error or not code:
+        raise SignInError("refused", "Sign-in was cancelled or refused.")
+    provider = mcp_provider(authorization.provider)
+    oauth = authorization.oauth
+    tokens = async_to_sync(token_request)(
+        oauth["token_endpoint"],
+        {
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": redirect_uri(),
+            "client_id": oauth["client_id"],
+            "code_verifier": authorization.code_verifier,
+            "resource": oauth["resource"],
+        },
+    )
+    granted = granted_scopes(tokens, authorization.scopes)
+    missing = set(authorization.scopes) - set(granted)
+    if missing:
+        logger.warning("MCP sign-in missing required scopes: %s", sorted(missing))
+        raise SignInError(
+            "scope", "The server did not grant the required access. Nothing was saved."
+        )
+    oauth = {**oauth, "requested_scopes": list(authorization.scopes)}
+    connection = authorization.connection or Connection(
+        workspace=authorization.workspace,
+        provider=provider.key,
+        kind=Connection.Kind.MCP,
+        binding_key=authorization.binding_key,
+        require_approval=authorization.require_approval,
+    )
+    if connection.workspace_id != authorization.workspace_id:
+        raise SignInError("invalid", "This sign-in is not valid. Start again.")
+    cleaned = authorization.connection_settings
+    connection.display_name = (
+        authorization.display_name.strip() or connection.display_name or provider.label
+    )
+    connection.endpoint_url = provider.endpoint(cleaned)
+    connection.auth_strategy = Connection.AuthStrategy.OAUTH
+    connection.status = Connection.Status.CONNECTED
+    connection.scopes = granted
+    connection.refresh_token = ""
+    apply_tokens(connection, tokens)
+    connection.metadata = {
+        **connection.metadata,
+        "target": connection_target(provider, cleaned),
+        "settings": cleaned,
+        "oauth": oauth,
+    }
+    tools = discover_tools(connection)
+    select_tools(
+        connection,
+        provider,
+        tools,
+        connection.available_tools if authorization.connection else None,
+    )
+    connection.full_clean()
+    try:
+        with transaction.atomic():
+            connection.save()
+    except IntegrityError:
+        raise ConnectionConflict("This binding already has a connection.") from None
+    return connection

secondshift/connections/migration_helpers.py

@@ -0,0 +1,28 @@
+"""Versioned data operations used by generated connections migrations.
+
+Keep these functions independent of current models.
+"""
+
+from django.apps.registry import Apps
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def record_requested_scopes_v1(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+) -> None:
+    """Keep OAuth requirements apart from grants on connections saved before b10."""
+    connection_model = apps.get_model("connections", "Connection")
+    alias = schema_editor.connection.alias
+    changed = []
+    for connection in connection_model.objects.using(alias).filter(
+        auth_strategy="oauth"
+    ):
+        oauth = connection.metadata.get("oauth", {})
+        if "requested_scopes" in oauth:
+            continue
+        connection.metadata = {
+            **connection.metadata,
+            "oauth": {**oauth, "requested_scopes": list(connection.scopes)},
+        }
+        changed.append(connection)
+    connection_model.objects.using(alias).bulk_update(changed, ["metadata"])

secondshift/connections/migrations/0001_initial.py

@@ -0,0 +1,101 @@
+# Generated by Django 6.0.9 on 2026-10-26 14:22
+
+import django.db.models.deletion
+import encrypted_model_fields.fields
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('workspaces', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Connection',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('provider', models.CharField(choices=[('github', 'GitHub'), ('sentry', 'Sentry'), ('chatgpt', 'ChatGPT'), ('slack', 'Slack'), ('mcp', 'MCP server'), ('api', 'HTTP API'), ('webhook', 'Webhook'), ('anthropic', 'Anthropic'), ('openai', 'OpenAI'), ('openrouter', 'OpenRouter'), ('openai_compatible', 'OpenAI-compatible')], max_length=24)),
+                ('kind', models.CharField(choices=[('identity', 'Identity'), ('mcp', 'MCP'), ('api', 'API'), ('notification', 'Notification'), ('model', 'Model provider')], default='identity', max_length=24)),
+                ('binding_key', models.SlugField(blank=True, help_text='Logical name used by repository manifests, for example observability.', max_length=120)),
+                ('display_name', models.CharField(max_length=200)),
+                ('endpoint_url', models.URLField(blank=True)),
+                ('external_account_id', models.CharField(blank=True, max_length=255)),
+                ('status', models.CharField(choices=[('connected', 'Connected'), ('expired', 'Expired'), ('revoked', 'Revoked')], default='connected', max_length=16)),
+                ('scopes', models.JSONField(blank=True, default=list)),
+                ('available_tools', models.JSONField(blank=True, default=list)),
+                ('allowed_models', models.JSONField(blank=True, default=list)),
+                ('default_model', models.CharField(blank=True, max_length=200)),
+                ('is_default', models.BooleanField(default=False, help_text="The workspace's default model provider for runs.")),
+                ('auth_strategy', models.CharField(choices=[('oauth', 'OAuth'), ('secret_reference', 'Secret reference'), ('api_key', 'Encrypted API key'), ('managed', 'Managed by service'), ('none', 'None')], default='oauth', max_length=24)),
+                ('credential_reference', models.CharField(blank=True, help_text='Opaque Vault/KMS/provider reference. Never a credential value.', max_length=255)),
+                ('delivery_url', encrypted_model_fields.fields.EncryptedTextField(blank=True, default='')),
+                ('access_token', encrypted_model_fields.fields.EncryptedTextField(blank=True, default='')),
+                ('refresh_token', encrypted_model_fields.fields.EncryptedTextField(blank=True, default='')),
+                ('expires_at', models.DateTimeField(blank=True, null=True)),
+                ('metadata', models.JSONField(blank=True, default=dict)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='connections', to='workspaces.workspace')),
+            ],
+            options={
+                'ordering': ['provider', 'display_name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='OAuthAuthorization',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('state', models.CharField(max_length=64, unique=True)),
+                ('code_verifier', encrypted_model_fields.fields.EncryptedTextField()),
+                ('provider', models.CharField(choices=[('github', 'GitHub'), ('sentry', 'Sentry'), ('chatgpt', 'ChatGPT'), ('slack', 'Slack'), ('mcp', 'MCP server'), ('api', 'HTTP API'), ('webhook', 'Webhook'), ('anthropic', 'Anthropic'), ('openai', 'OpenAI'), ('openrouter', 'OpenRouter'), ('openai_compatible', 'OpenAI-compatible')], max_length=24)),
+                ('binding_key', models.SlugField(blank=True, max_length=120)),
+                ('display_name', models.CharField(blank=True, max_length=200)),
+                ('connection_settings', models.JSONField(blank=True, default=dict)),
+                ('scopes', models.JSONField(blank=True, default=list)),
+                ('oauth', models.JSONField(blank=True, default=dict)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('used_at', models.DateTimeField(blank=True, null=True)),
+                ('connection', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='oauth_authorizations', to='connections.connection')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='oauth_authorizations', to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='oauth_authorizations', to='workspaces.workspace')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Secret',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=128)),
+                ('description', models.CharField(blank=True, max_length=255)),
+                ('value', encrypted_model_fields.fields.EncryptedTextField()),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='secrets', to='workspaces.workspace')),
+            ],
+            options={
+                'ordering': ['name'],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='connection',
+            constraint=models.UniqueConstraint(condition=models.Q(('external_account_id', ''), _negated=True), fields=('workspace', 'provider', 'external_account_id'), name='unique_workspace_provider_account'),
+        ),
+        migrations.AddConstraint(
+            model_name='connection',
+            constraint=models.UniqueConstraint(condition=models.Q(('binding_key', ''), _negated=True), fields=('workspace', 'binding_key'), name='unique_workspace_connection_binding'),
+        ),
+        migrations.AddConstraint(
+            model_name='connection',
+            constraint=models.UniqueConstraint(condition=models.Q(('is_default', True)), fields=('workspace',), name='unique_workspace_default_model'),
+        ),
+        migrations.AddConstraint(
+            model_name='secret',
+            constraint=models.UniqueConstraint(fields=('workspace', 'name'), name='unique_workspace_secret_name'),
+        ),
+    ]

secondshift/connections/migrations/0002_alter_connection_kind.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.9 on 2026-10-26 14:43
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='connection',
+            name='kind',
+            field=models.CharField(choices=[('identity', 'Identity'), ('source', 'Repository source'), ('mcp', 'MCP'), ('api', 'API'), ('notification', 'Notification'), ('model', 'Model provider')], default='identity', max_length=24),
+        ),
+    ]

secondshift/connections/migrations/0003_require_approval.py

@@ -0,0 +1,23 @@
+# Generated by Django 6.0.9 on 2026-11-01 10:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0002_alter_connection_kind'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='connection',
+            name='require_approval',
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name='oauthauthorization',
+            name='require_approval',
+            field=models.BooleanField(default=False),
+        ),
+    ]

secondshift/connections/migrations/0004_new_connections_skip_approval.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.9 on 2026-11-01 10:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0003_require_approval'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='connection',
+            name='require_approval',
+            field=models.BooleanField(default=False),
+        ),
+    ]

secondshift/connections/migrations/0005_agentconnection.py

@@ -0,0 +1,36 @@
+# Generated by Django 6.0.9 on 2026-11-03 13:33
+
+import django.core.validators
+import django.db.models.deletion
+import encrypted_model_fields.fields
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0004_new_connections_skip_approval'),
+        ('workspaces', '0002_api_token'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AgentConnection',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('backend', models.CharField(max_length=24)),
+                ('display_name', models.CharField(max_length=200)),
+                ('auth_data', encrypted_model_fields.fields.EncryptedTextField()),
+                ('credential_key', models.UUIDField(default=uuid.uuid4, editable=False)),
+                ('connected', models.BooleanField(default=True)),
+                ('max_runs_per_day', models.PositiveIntegerField(blank=True, null=True, validators=[django.core.validators.MinValueValidator(1)])),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='workspaces.workspace')),
+            ],
+        ),
+    ]

secondshift/connections/migrations/0006_remove_is_default.py

@@ -0,0 +1,23 @@
+# Generated by Django 6.0.9 on 2026-11-03 14:14
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0005_agentconnection'),
+        # The workspace keeps the default model key from here on.
+        ('workspaces', '0004_copy_default_model_key'),
+    ]
+
+    operations = [
+        migrations.RemoveConstraint(
+            model_name='connection',
+            name='unique_workspace_default_model',
+        ),
+        migrations.RemoveField(
+            model_name='connection',
+            name='is_default',
+        ),
+    ]

secondshift/connections/migrations/0007_agent_last_check.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.9 on 2026-11-03 15:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0006_remove_is_default'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='agentconnection',
+            name='last_check',
+            field=models.JSONField(blank=True, null=True),
+        ),
+    ]

secondshift/connections/migrations/0008_agentcredentialcleanup.py

@@ -0,0 +1,25 @@
+# Generated by Django 6.0.9 on 2026-11-07 09:51
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0007_agent_last_check'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AgentCredentialCleanup',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('credential_key', models.UUIDField(unique=True)),
+                ('attempts', models.PositiveIntegerField(default=0)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('connection', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='credential_cleanups', to='connections.agentconnection')),
+            ],
+        ),
+    ]

secondshift/connections/migrations/0009_release_0_1_0b11.py

@@ -0,0 +1,52 @@
+# Generated by Django 6.0.9 on 2026-11-09 09:15
+
+import django.db.migrations.operations.special
+import secondshift.connections.migration_helpers
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    replaces = [('connections', '0009_remove_secrets_and_identity'), ('connections', '0010_record_requested_scopes')]
+
+    dependencies = [
+        ('connections', '0008_agentcredentialcleanup'),
+    ]
+
+    operations = [
+        migrations.RemoveConstraint(
+            model_name='secret',
+            name='unique_workspace_secret_name',
+        ),
+        migrations.RemoveField(
+            model_name='connection',
+            name='credential_reference',
+        ),
+        migrations.AlterField(
+            model_name='connection',
+            name='auth_strategy',
+            field=models.CharField(choices=[('oauth', 'OAuth'), ('api_key', 'Encrypted API key'), ('managed', 'Managed by service'), ('none', 'None')], default='oauth', max_length=24),
+        ),
+        migrations.AlterField(
+            model_name='connection',
+            name='kind',
+            field=models.CharField(choices=[('source', 'Repository source'), ('mcp', 'MCP'), ('api', 'API'), ('notification', 'Notification'), ('model', 'Model provider')], max_length=24),
+        ),
+        migrations.AlterField(
+            model_name='connection',
+            name='provider',
+            field=models.CharField(choices=[('github', 'GitHub'), ('sentry', 'Sentry'), ('mcp', 'MCP server'), ('api', 'HTTP API'), ('webhook', 'Webhook'), ('anthropic', 'Anthropic'), ('openai', 'OpenAI'), ('openrouter', 'OpenRouter'), ('openai_compatible', 'OpenAI-compatible')], max_length=24),
+        ),
+        migrations.AlterField(
+            model_name='oauthauthorization',
+            name='provider',
+            field=models.CharField(choices=[('github', 'GitHub'), ('sentry', 'Sentry'), ('mcp', 'MCP server'), ('api', 'HTTP API'), ('webhook', 'Webhook'), ('anthropic', 'Anthropic'), ('openai', 'OpenAI'), ('openrouter', 'OpenRouter'), ('openai_compatible', 'OpenAI-compatible')], max_length=24),
+        ),
+        migrations.DeleteModel(
+            name='Secret',
+        ),
+        migrations.RunPython(
+            code=secondshift.connections.migration_helpers.record_requested_scopes_v1,
+            reverse_code=django.db.migrations.operations.special.RunPython.noop,
+        ),
+    ]

secondshift/connections/migrations/0010_connection_attribution.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.9 on 2026-11-13 11:00
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0009_release_0_1_0b11'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='connection',
+            name='attribution',
+            field=models.BooleanField(blank=True, null=True),
+        ),
+    ]