secondshift 0.1.0b12__py3-none-any.whl

secondshift/connections/serialization.py

@@ -0,0 +1,100 @@
+from secondshift.connections.execution import recent_login_runs
+from secondshift.connections.github import is_github_source, shows_attribution
+from secondshift.connections.mcp.base import SOURCE_AUTH
+from secondshift.connections.mcp.oauth import requested_scopes
+from secondshift.connections.models import AgentConnection, Connection
+from secondshift.connections.schemas import (
+    ConnectionSchema,
+    ConnectionUsageSchema,
+    OfferedToolSchema,
+)
+from secondshift.connections.services import (
+    connection_target,
+)
+from secondshift.runs.reporting.connection_usage import ConnectionUsage
+
+
+def connection_settings_view(connection: Connection) -> dict[str, str]:
+    """Owner-chosen settings that are safe to show. Never a credential."""
+    if connection.kind == Connection.Kind.MCP:
+        return connection.settings
+    if connection.kind == Connection.Kind.API:
+        return {
+            **connection.settings,
+            "base_url": connection.endpoint_url,
+            "spec_url": connection.metadata.get("spec_url", ""),
+        }
+    return {}
+
+
+def connection_auth(connection: Connection) -> str:
+    """How the connection signs in: oauth, token, app, or empty."""
+    if connection.kind == Connection.Kind.SOURCE:
+        return (
+            "app"
+            if connection.auth_strategy == Connection.AuthStrategy.MANAGED
+            else "token"
+        )
+    if connection.kind not in {Connection.Kind.MCP, Connection.Kind.API}:
+        return ""
+    if connection.auth_strategy == Connection.AuthStrategy.OAUTH:
+        return "oauth"
+    if connection.auth_strategy == Connection.AuthStrategy.MANAGED:
+        return SOURCE_AUTH
+    return "token"
+
+
+def serialize_connection(
+    connection: Connection, usage: ConnectionUsage | None = None
+) -> ConnectionSchema:
+    return ConnectionSchema(
+        id=connection.id,
+        provider=connection.provider,
+        kind=connection.kind,
+        binding_key=connection.binding_key,
+        display_name=connection.display_name,
+        status=connection.current_status,
+        expires_at=connection.expires_at,
+        available_tools=connection.available_tools,
+        target=connection_target(connection),
+        allowed_models=connection.allowed_models,
+        default_model=connection.default_model,
+        is_default=connection.kind == Connection.Kind.MODEL
+        and connection.workspace.default_model_connection_id == connection.pk,
+        available_models=list(connection.metadata.get("available_models", [])),
+        last_check=connection.last_check,
+        settings=connection_settings_view(connection),
+        auth=connection_auth(connection),
+        scopes=list(connection.scopes)
+        if connection.kind == Connection.Kind.MCP
+        else [],
+        requested_scopes=requested_scopes(connection)
+        if connection.kind == Connection.Kind.MCP
+        and connection.auth_strategy == Connection.AuthStrategy.OAUTH
+        else [],
+        offered_tools=[
+            OfferedToolSchema(
+                name=name,
+                description=str(tool.get("description", ""))[:500],
+                read_only=bool(tool.get("readOnly")),
+            )
+            for name, tool in sorted(connection.offered_tools.items())
+        ],
+        require_approval=connection.require_approval,
+        attribution=is_github_source(connection) and shows_attribution(connection),
+        usage=None
+        if usage is None
+        else ConnectionUsageSchema(
+            **{**vars(usage), "spend_7d_usd": float(usage.spend_7d_usd)}
+        ),
+    )
+
+
+def with_recent_runs(
+    connections: list[AgentConnection], workspace_id: int
+) -> list[AgentConnection]:
+    """Attach each login's recent run count for AgentConnectionSchema."""
+    counts = recent_login_runs(workspace_id)
+    for connection in connections:
+        connection.recent_runs = counts[connection.pk]
+    return connections

secondshift/connections/services.py

@@ -0,0 +1,94 @@
+from django.db import IntegrityError, transaction
+
+from secondshift.connections.dao import binding_taken
+from secondshift.connections.models import Connection
+from secondshift.connections.outbound import host_label
+from secondshift.connections.webhooks import validate_webhook_url
+from secondshift.workspaces.models import Workspace
+
+
+class ConnectionConflict(ValueError):
+    pass
+
+
+def connection_target(connection: Connection) -> str:
+    """The host a connection reaches, as saved when it was set up."""
+    return str(connection.metadata.get("target", ""))
+
+
+def create_webhook_connection(
+    workspace: Workspace,
+    binding_key: str,
+    display_name: str,
+    url: str,
+) -> Connection:
+    url = validate_webhook_url(url)
+    if binding_taken(workspace.pk, binding_key):
+        raise ConnectionConflict(
+            f"A connection for {binding_key} already exists in this workspace."
+        )
+    connection = Connection(
+        workspace=workspace,
+        provider=Connection.Provider.WEBHOOK,
+        kind=Connection.Kind.NOTIFICATION,
+        binding_key=binding_key,
+        display_name=display_name.strip() or binding_key,
+        auth_strategy=Connection.AuthStrategy.NONE,
+        delivery_url=url,
+        metadata={"target": host_label(url)},
+    )
+    connection.full_clean()
+    try:
+        with transaction.atomic():
+            connection.save()
+    except IntegrityError as error:
+        raise ConnectionConflict(
+            f"A connection for {binding_key} already exists in this workspace."
+        ) from error
+    return connection
+
+
+def update_webhook_connection(
+    connection: Connection,
+    display_name: str | None,
+    url: str | None,
+) -> Connection:
+    if connection.provider != Connection.Provider.WEBHOOK:
+        raise ConnectionConflict("Only webhook connections can be edited here.")
+    if display_name is not None:
+        connection.display_name = display_name.strip() or connection.binding_key
+    if url:
+        url = validate_webhook_url(url)
+        connection.delivery_url = url
+        connection.metadata = {
+            **connection.metadata,
+            "target": host_label(url),
+        }
+        connection.status = Connection.Status.CONNECTED
+    elif connection.status == Connection.Status.REVOKED:
+        raise ConnectionConflict("Enter a new URL to reconnect this webhook.")
+    connection.full_clean()
+    connection.save()
+    return connection
+
+
+def revoke_connection(connection: Connection) -> Connection:
+    """Stop all use immediately and discard stored credentials; keep the record."""
+    connection.status = Connection.Status.REVOKED
+    connection.delivery_url = ""
+    connection.access_token = ""
+    connection.refresh_token = ""
+    connection.metadata = {
+        key: value for key, value in connection.metadata.items() if key != "target"
+    }
+    connection.save(
+        update_fields=[
+            "status",
+            "delivery_url",
+            "access_token",
+            "refresh_token",
+            "metadata",
+            "updated_at",
+        ]
+    )
+    return connection

secondshift/connections/tools.py

@@ -0,0 +1,38 @@
+"""What a connection's server offers, and which of those tools jobs may use."""
+
+from typing import Any
+
+from secondshift.connections.models import Connection
+
+
+class UnknownTools(ValueError):
+    pass
+
+
+def store_tools(
+    connection: Connection,
+    offered: dict[str, Any],
+    selected: list[str] | None,
+    *,
+    owner_selects: bool = True,
+) -> None:
+    """Save the offered tools and the ones jobs may use.
+
+    When the owner chooses, tools marked read-only start chosen. Otherwise
+    jobs may use every offered tool. Raises UnknownTools for a name the server
+    does not offer.
+    """
+    if not owner_selects:
+        chosen = set(offered)
+    elif selected is None:
+        chosen = {name for name, tool in offered.items() if tool.get("readOnly")}
+    elif set(selected) - set(offered):
+        raise UnknownTools
+    else:
+        chosen = set(selected)
+    connection.available_tools = sorted(chosen)
+    connection.metadata = {
+        **connection.metadata,
+        "tools": {name: offered[name] for name in sorted(chosen)},
+        "offered_tools": offered if owner_selects else {},
+    }

secondshift/connections/webhooks.py

@@ -0,0 +1,107 @@
+import logging
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+from django.conf import settings
+
+from secondshift.connections.checks import record_check
+from secondshift.connections.models import Connection
+from secondshift.connections.outbound import (
+    OutboundUrlError,
+    PinnedSyncTransport,
+    validate_outbound_url,
+)
+
+logger = logging.getLogger(__name__)
+
+USER_AGENT = "SecondShift-Webhook/1"
+
+
+WebhookError = OutboundUrlError
+
+
+@dataclass(frozen=True)
+class WebhookDelivery:
+    ok: bool
+    status_code: int | None
+    message: str
+    retryable: bool = False
+
+
+def validate_webhook_url(url: str) -> str:
+    return validate_outbound_url(url, "webhook URL")
+
+
+def webhook_transport() -> httpx.BaseTransport:
+    # Connects only to the addresses it checked, so DNS cannot rebind
+    # between the check and the request.
+    return PinnedSyncTransport()
+
+
+def deliver_webhook(connection: Connection, payload: dict[str, Any]) -> WebhookDelivery:
+    """Send the payload and keep the result, so the dashboard shows the last delivery."""
+    delivery = post_webhook(connection, payload)
+    if connection.pk:
+        record_check(connection, delivery.ok, delivery.message)
+    return delivery
+
+
+def post_webhook(connection: Connection, payload: dict[str, Any]) -> WebhookDelivery:
+    if (
+        connection.provider != Connection.Provider.WEBHOOK
+        or not connection.delivery_url
+    ):
+        return WebhookDelivery(False, None, "This connection has no webhook URL.")
+    try:
+        # Validated again at send time: DNS answers can change after saving.
+        url = validate_webhook_url(connection.delivery_url)
+    except WebhookError as error:
+        return WebhookDelivery(False, None, str(error))
+    try:
+        with httpx.Client(
+            transport=webhook_transport(),
+            timeout=settings.OUTBOUND_TIMEOUT_SECONDS,
+            follow_redirects=False,
+        ) as client:
+            response = client.post(
+                url, json=payload, headers={"User-Agent": USER_AGENT}
+            )
+    except httpx.TimeoutException:
+        return WebhookDelivery(False, None, "The webhook timed out.", retryable=True)
+    except httpx.HTTPError as error:
+        # Exception text includes the URL, which may embed a token.
+        logger.warning(
+            "webhook delivery to connection %s failed: %s",
+            connection.pk,
+            type(error).__name__,
+        )
+        return WebhookDelivery(
+            False, None, "The webhook could not be reached.", retryable=True
+        )
+    status = response.status_code
+    if 200 <= status < 300:
+        return WebhookDelivery(True, status, f"Delivered (HTTP {status}).")
+    if 300 <= status < 400:
+        return WebhookDelivery(
+            False,
+            status,
+            f"The webhook redirected (HTTP {status}); redirects are not followed.",
+        )
+    return WebhookDelivery(
+        False,
+        status,
+        f"The webhook answered HTTP {status}.",
+        retryable=status == 429 or status >= 500,
+    )
+
+
+def connection_test_payload(connection: Connection) -> dict[str, Any]:
+    return {
+        "event": "connection.test",
+        "text": (
+            f"SecondShift test message for {connection.binding_key}. "
+            "Run reports for jobs using this binding will arrive here."
+        ),
+        "binding": connection.binding_key,
+    }

secondshift/core/adapters.py

@@ -0,0 +1,38 @@
+from typing import Any
+
+from allauth.account.adapter import DefaultAccountAdapter
+from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
+from allauth.socialaccount.models import SocialLogin
+from django.conf import settings
+from django.http import HttpRequest
+
+from secondshift.workspaces.invites import pending_invite
+
+
+def signup_open(request: HttpRequest) -> bool:
+    """Open to everyone when enabled, else only to someone with an invite."""
+    return settings.SIGNUP_ENABLED or pending_invite(request) is not None
+
+
+class AccountAdapter(DefaultAccountAdapter):
+    def is_open_for_signup(self, request: HttpRequest) -> bool:
+        return signup_open(request)
+
+    def add_message(
+        self,
+        request: HttpRequest,
+        level: int,
+        message_template: str | None = None,
+        message_context: dict[str, Any] | None = None,
+        extra_tags: str = "",
+        message: str | None = None,
+    ) -> None:
+        """Drop the message: most flows end in the dashboard, which never
+        shows them, so they piled up and appeared stale on a later page."""
+
+
+class SocialAccountAdapter(DefaultSocialAccountAdapter):
+    def is_open_for_signup(
+        self, request: HttpRequest, sociallogin: SocialLogin
+    ) -> bool:
+        return signup_open(request)

secondshift/core/admin.py

@@ -0,0 +1,5 @@
+from django.contrib import admin
+
+admin.site.site_header = "SecondShift Admin"
+admin.site.site_title = "SecondShift Admin"
+admin.site.index_title = "Administration"

secondshift/core/api.py

@@ -0,0 +1,104 @@
+from django.conf import settings
+from django.http import HttpRequest
+from django.utils import timezone
+from ninja import Router
+from ninja.security import django_auth
+
+from secondshift.connections.dao import connected_count
+from secondshift.connections.execution import execution_status
+from secondshift.core.schemas import (
+    FailingJobSchema,
+    JobSpendSchema,
+    OverviewSchema,
+    RunDaySchema,
+    UserSchema,
+)
+from secondshift.github.app import configured as github_app_configured
+from secondshift.jobs.dao import enabled_job_count
+from secondshift.repositories.dao import active_repositories
+from secondshift.repositories.models import Repository
+from secondshift.runs.dao import run_counts_today
+from secondshift.runs.reporting.health import (
+    failing_jobs,
+    runs_by_day,
+    spend_by_job,
+    week_summary,
+)
+from secondshift.workspaces.access import (
+    current_membership,
+    current_workspace,
+    is_operator,
+    permitted_actions,
+)
+from secondshift.workspaces.dao import has_own_token
+from secondshift.workspaces.server_settings import (
+    environment_label,
+    sandbox_label,
+)
+from secondshift.workspaces.services import can_create_workspace
+
+router = Router(auth=django_auth, tags=["core"])
+
+
+@router.get("/me", response=UserSchema, auth=django_auth)
+def me(request: HttpRequest) -> UserSchema:
+    membership = current_membership(request)
+    workspace = membership.workspace if membership else None
+    return UserSchema(
+        email=request.user.email or request.user.get_username(),
+        workspace_name=workspace.name if workspace else None,
+        workspace_slug=workspace.slug if workspace else None,
+        role=membership.role if membership else None,
+        permissions=permitted_actions(request),
+        can_use_admin=is_operator(request),
+        can_create_workspace=can_create_workspace(request.user),
+        local_repositories_enabled=settings.LOCAL_REPOSITORIES_ENABLED,
+        github_app_configured=github_app_configured(),
+        environment=environment_label(),
+        sandbox=sandbox_label(),
+    )
+
+
+@router.get("/overview", response=OverviewSchema, auth=django_auth)
+def overview(request: HttpRequest) -> OverviewSchema:
+    workspace = current_workspace(request)
+    if not workspace:
+        return OverviewSchema(
+            repositories=0,
+            local_repositories=0,
+            enabled_jobs=0,
+            runs_today=0,
+            failed_runs=0,
+            connected_services=0,
+        )
+    today = timezone.localdate()
+    repositories = active_repositories(workspace.pk)
+    counts = run_counts_today(workspace.pk, today)
+    week = week_summary(workspace)
+    return OverviewSchema(
+        repositories=repositories.count(),
+        local_repositories=repositories.filter(
+            source_type=Repository.SourceType.LOCAL
+        ).count(),
+        enabled_jobs=enabled_job_count(workspace.pk),
+        runs_today=counts["today"],
+        failed_runs=counts["failed"],
+        connected_services=connected_count(workspace.pk),
+        failing_jobs=[
+            FailingJobSchema(**vars(failing)) for failing in failing_jobs(workspace)
+        ],
+        runs_7d=week.runs,
+        runs_previous_7d=week.previous_runs,
+        finished_7d=week.finished,
+        succeeded_7d=week.succeeded,
+        spend_7d_usd=float(week.spend_usd),
+        spend_previous_7d_usd=float(week.previous_spend_usd),
+        spend_partial=week.spend_partial,
+        spend_by_job=[
+            JobSpendSchema(**{**vars(row), "spend_usd": float(row.spend_usd)})
+            for row in spend_by_job(workspace)
+        ],
+        run_days=[RunDaySchema(**vars(day)) for day in runs_by_day(workspace)],
+        execution=execution_status(workspace),
+        has_agent_token=has_own_token(request.user, workspace),
+    )

secondshift/core/apps.py

@@ -0,0 +1,20 @@
+from typing import Any
+
+from django.apps import AppConfig
+from django.core.management import call_command
+from django.db.models.signals import post_migrate
+
+
+def create_cache_tables(using: str, **kwargs: Any) -> None:
+    """Create the database cache table, so every migrate leaves it ready."""
+    call_command("createcachetable", database=using, verbosity=0)
+
+
+class CoreConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "secondshift.core"
+
+    def ready(self) -> None:
+        # Django sends post_migrate only for apps with models, and core has
+        # none. Listen to every app. The command skips a table that exists.
+        post_migrate.connect(create_cache_tables, dispatch_uid="create_cache_tables")