secondshift 0.1.0b12__py3-none-any.whl

secondshift/core/signin.py

@@ -0,0 +1,58 @@
+"""One-time sign-in links printed by `secondshift up` and `secondshift login`.
+
+A link is signed with SECRET_KEY and holds the user's last sign-in time.
+Signing in changes that time, so each link works once. Links expire after
+SIGN_IN_LINK_SECONDS. Only someone who can read the terminal gets one.
+"""
+
+from django.contrib.auth import login
+from django.contrib.auth.models import AbstractUser
+from django.core import signing
+from django.http import HttpRequest, HttpResponse, HttpResponseRedirect
+from django.urls import reverse
+from django.views.decorators.cache import never_cache
+from django.views.decorators.http import require_GET
+
+from secondshift.workspaces.dao import active_user
+
+SIGN_IN_LINK_SECONDS = 15 * 60
+SIGN_IN_SALT = "secondshift.core.signin"
+MODEL_BACKEND = "django.contrib.auth.backends.ModelBackend"
+
+
+def last_seen(user: AbstractUser) -> str:
+    return user.last_login.isoformat() if user.last_login else ""
+
+
+def make_token(user: AbstractUser) -> str:
+    return signing.dumps({"user": user.pk, "seen": last_seen(user)}, salt=SIGN_IN_SALT)
+
+
+def user_for_token(token: str) -> AbstractUser | None:
+    try:
+        data = signing.loads(token, salt=SIGN_IN_SALT, max_age=SIGN_IN_LINK_SECONDS)
+    except signing.BadSignature:
+        return None
+    user = active_user(data.get("user"))
+    if user is None or last_seen(user) != data.get("seen"):
+        return None
+    return user
+
+
+def sign_in_url(base_url: str, user: AbstractUser) -> str:
+    return base_url.rstrip("/") + reverse("sign-in", args=[make_token(user)])
+
+
+@never_cache
+@require_GET
+def sign_in(request: HttpRequest, token: str) -> HttpResponse:
+    user = user_for_token(token)
+    if user is None:
+        return HttpResponse(
+            "This sign-in link has expired or was already used. "
+            "Run `secondshift login` for a new one.",
+            status=400,
+            content_type="text/plain",
+        )
+    login(request, user, backend=MODEL_BACKEND)
+    return HttpResponseRedirect("/")

secondshift/core/static/core/account.css

@@ -0,0 +1,149 @@
+/* SecondShift theme for the sign-in, sign-up and account pages that
+   allauth renders. Its elements are plain HTML, so they are styled by tag.
+   The tokens and components copy the dashboard (dashboard/src/styles.css):
+   neutral greys, IBM Plex, and color only where it carries meaning. */
+:root {
+  color-scheme: dark;
+  --font-sans: 'IBM Plex Sans', system-ui, sans-serif;
+  --font-mono: 'IBM Plex Mono', ui-monospace, monospace;
+  --night-950: #0d0d0d;
+  --night-900: #131313;
+  --ink: #ededed;
+  --muted: #a3a3a3;
+  --subtle: #737373;
+  --focus: #a3a3a3;
+  --card-border: #232323;
+  --field: #181818;
+  --field-border: #262626;
+  --divider: #1c1c1c;
+  --mint: #71dbb6;
+  --danger: #ff778b;
+  --white-3: rgba(255,255,255,.03);
+  --white-6: rgba(255,255,255,.06);
+  --white-8: rgba(255,255,255,.08);
+  --border: var(--white-8);
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  color: var(--ink);
+  background: var(--night-900);
+  font: 14px/1.5 var(--font-sans);
+}
+
+/* The form on the left, example shifts on the right. */
+.account-page {
+  display: grid;
+  grid-template-columns: minmax(380px, 0.82fr) minmax(420px, 1.18fr);
+  min-height: 100vh;
+}
+
+.account-card {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  width: 100%;
+  max-width: 520px;
+  margin: 0 auto;
+  padding: 48px clamp(28px, 6vw, 72px);
+}
+
+.account-brand { display: inline-flex; align-items: center; gap: 10px; margin-bottom: 8px; color: var(--ink); font-size: 16px; font-weight: 600; text-decoration: none; }
+.account-eyebrow { margin-bottom: 32px; color: var(--subtle); font-size: 13px; }
+
+h1, h2 { margin: 0 0 8px; font-weight: 600; }
+h1 { font-size: 28px; letter-spacing: -0.02em; }
+h2 { font-size: 15px; }
+p { margin: 0 0 14px; color: var(--muted); }
+a { color: var(--ink); text-decoration-color: var(--subtle); text-underline-offset: 3px; }
+a:hover { text-decoration-color: var(--ink); }
+hr { margin: 22px 0; border: 0; border-top: 1px solid var(--border); }
+
+form { display: grid; gap: 4px; margin: 18px 0 0; }
+form p { display: grid; gap: 6px; margin: 0 0 10px; color: var(--ink); }
+label { color: var(--muted); font-size: 12px; font-weight: 500; }
+input[type="email"], input[type="password"], input[type="text"] {
+  width: 100%;
+  min-height: 40px;
+  padding: 8px 12px;
+  border: 1px solid var(--field-border);
+  border-radius: 8px;
+  color: var(--ink);
+  background: var(--field);
+  font: inherit;
+}
+input::placeholder { color: var(--subtle); }
+input:focus { border-color: var(--focus); outline: none; }
+input:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+form p > span, form p ul { color: var(--subtle); font-size: 12px; }
+form p > .helptext a { font-size: 12px; }
+/* Password tips. Browsers move a list out of its paragraph into the form. */
+form > ul { margin: -4px 0 10px; padding-left: 16px; color: var(--subtle); font-size: 12px; }
+form p:has(> input[type="checkbox"]) { display: flex; align-items: center; gap: 8px; }
+input[type="checkbox"] { order: -1; width: 16px; height: 16px; margin: 0; accent-color: var(--ink); }
+form p ul { margin: 0; padding-left: 16px; }
+.errorlist { margin: 0 0 6px; padding: 0; list-style: none; color: var(--danger); font-size: 12px; }
+
+/* The dashboard's primary action: a light button on the dark page. */
+button {
+  min-height: 40px;
+  margin-top: 6px;
+  padding: 0 16px;
+  border: 1px solid var(--ink);
+  border-radius: 8px;
+  color: var(--night-950);
+  background: var(--ink);
+  font: 600 13px var(--font-sans);
+  cursor: pointer;
+}
+button:hover { border-color: #fff; background: #fff; }
+button:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+
+/* Third-party sign-in, e.g. GitHub. Raised like the dashboard's secondary buttons. */
+.account-card ul:has(> li > .account-provider) { display: grid; gap: 8px; margin: 10px 0 0; padding: 0; list-style: none; }
+.account-provider {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 10px 12px;
+  border: 1px solid #2e2e2e;
+  border-radius: 8px;
+  color: var(--ink);
+  background: #242424;
+  box-shadow: 0 1px 2px rgba(0,0,0,.4);
+  font-weight: 600;
+  text-decoration: none;
+}
+.account-provider:hover { background: #2a2a2a; }
+.account-provider:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+
+/* Notices use the dashboard callout: a faint border in the notice's color. */
+.account-messages, .account-invite { margin: 0 0 18px; padding: 10px 14px; border: 1px solid var(--border); border-radius: 8px; background: rgba(255,255,255,.025); color: var(--ink); list-style: none; font-size: 13px; }
+.account-messages { border-color: color-mix(in srgb, var(--mint) 35%, transparent); }
+.account-back { display: inline-block; margin-top: 18px; font-size: 13px; }
+
+/* Example shifts, drawn as a schedule in the dashboard's own row style. */
+.account-atmosphere {
+  display: grid;
+  place-items: center;
+  padding: 48px;
+  border-left: 1px solid var(--divider);
+  background: var(--night-950);
+}
+.shift-schedule { width: min(460px, 100%); margin: 0; padding: 0; list-style: none; border-top: 1px solid var(--divider); }
+.shift-preview { display: grid; grid-template-columns: 88px minmax(0, 1fr); gap: 16px; padding: 16px 0; border-bottom: 1px solid var(--divider); }
+.shift-preview > time { padding-top: 2px; color: var(--subtle); font-family: var(--font-mono); font-size: 12px; font-variant-numeric: tabular-nums; }
+.shift-preview strong { display: block; margin-bottom: 4px; font-size: 14px; font-weight: 600; }
+.shift-preview p { margin: 0; color: var(--muted); font-size: 13px; }
+
+@media (max-width: 900px) {
+  .account-page { grid-template-columns: 1fr; }
+  .account-card { padding: 40px 16px; }
+  .account-atmosphere { display: none; }
+  /* 16px stops iPhone Safari zooming into the field. */
+  input[type="email"], input[type="password"], input[type="text"] { font-size: 16px; }
+}

secondshift/core/static/core/admin.css

@@ -0,0 +1,135 @@
+/* SecondShift theme for Django admin, using the dashboard's greys and Geist
+   (dashboard/src/styles.css). The dashboard is dark-only, so the palette is
+   applied regardless of the admin's light/dark/auto setting. */
+:root,
+html[data-theme] {
+  --primary: #1f1f1f;
+  --secondary: #191919;
+  --accent: #ededed;
+  --primary-fg: #ededed;
+
+  --body-fg: #c4c4c4;
+  --body-bg: #131313;
+  --body-quiet-color: #737373;
+  --body-medium-color: #a3a3a3;
+  --body-loud-color: #ededed;
+
+  --header-color: #ededed;
+  --header-branding-color: #ededed;
+  --header-bg: #0d0d0d;
+  --header-link-color: #ededed;
+
+  --breadcrumbs-fg: #737373;
+  --breadcrumbs-link-fg: #a3a3a3;
+  --breadcrumbs-bg: #131313;
+
+  --link-fg: #ededed;
+  --link-hover-color: #ffffff;
+  --link-selected-fg: #ededed;
+
+  --hairline-color: rgba(255,255,255,.06);
+  --border-color: rgba(255,255,255,.08);
+
+  --error-fg: #ff778b;
+
+  /* Messages sit on the card surface. Their color is the left edge below. */
+  --message-debug-bg: #191919;
+  --message-debug-icon: url(../admin/img/icon-debug-dark.svg);
+  --message-info-bg: #191919;
+  --message-info-icon: url(../admin/img/icon-info-dark.svg);
+  --message-success-bg: #191919;
+  --message-success-icon: url(../admin/img/icon-yes-dark.svg);
+  --message-warning-bg: #191919;
+  --message-warning-icon: url(../admin/img/icon-alert-dark.svg);
+  --message-error-bg: #191919;
+  --message-error-icon: url(../admin/img/icon-no-dark.svg);
+
+  --darkened-bg: #0d0d0d;
+  --selected-bg: #1f1f1f;
+  --selected-row: rgba(255,255,255,.06);
+
+  --button-fg: #ededed;
+  --button-bg: #262626;
+  --button-hover-bg: #313131;
+  --default-button-bg: #ededed;
+  --default-button-hover-bg: #ffffff;
+  --close-button-bg: #262626;
+  --close-button-hover-bg: #313131;
+  --delete-button-bg: #ff778b;
+  --delete-button-hover-bg: #ff8fa0;
+
+  --object-tools-fg: var(--button-fg);
+  --object-tools-bg: var(--close-button-bg);
+  --object-tools-hover-bg: var(--close-button-hover-bg);
+
+  --font-family-primary: 'Geist', system-ui, sans-serif;
+  --font-family-monospace: 'Geist Mono', ui-monospace, monospace;
+
+  color-scheme: dark;
+}
+
+/* Only one theme, so the toggle has nothing to do. */
+.theme-toggle { display: none; }
+
+body { background: var(--body-bg); }
+
+h1, h2, #site-name, .module caption { font-weight: 600; letter-spacing: -.01em; }
+
+#header { border-bottom: 1px solid #1c1c1c; }
+.ss-brand { display: inline-flex; align-items: center; gap: 10px; }
+.ss-brand img { width: 32px; height: 32px; }
+#site-name .ss-brand span { font-weight: 600; color: var(--header-branding-color); }
+#user-tools a { border-bottom-color: rgba(255,255,255,.18); }
+
+div.breadcrumbs { border-bottom: 1px solid var(--hairline-color); }
+
+/* Modules are dashboard cards. */
+#content-main .module,
+#content-related .module,
+.dashboard .module,
+fieldset.module {
+  border: 1px solid #232323;
+  border-radius: 16px;
+  overflow: hidden;
+  background: linear-gradient(180deg, #191919, #161616);
+}
+.module h2, .module caption, .inline-group h2 {
+  background: transparent;
+  border-bottom: 1px solid var(--hairline-color);
+  color: #a3a3a3;
+}
+
+input[type=text], input[type=password], input[type=email], input[type=url],
+input[type=number], input[type=tel], input[type=search], textarea, select, .vTextField {
+  background: #181818;
+  color: #ededed;
+  border: 1px solid #262626;
+  border-radius: 8px;
+}
+input:focus, textarea:focus, select:focus { border-color: #a3a3a3; outline: none; }
+input:focus-visible, textarea:focus-visible, select:focus-visible { outline: 2px solid #a3a3a3; outline-offset: 2px; }
+
+.button, input[type=submit], input[type=button], .submit-row input, a.button, button { border-radius: 8px; }
+/* Save is the dashboard's light primary action, so its text is dark. */
+.button.default, input[type=submit].default, .submit-row input.default { color: #0d0d0d; font-weight: 600; }
+.submit-row a.deletelink, .delete-confirmation form input[type=submit] { color: #2a0a12; }
+
+/* The dashboard callout: the card surface with a colored left edge. */
+ul.messagelist li { border: 1px solid var(--border-color); border-left: 2px solid #737373; border-radius: 8px; color: #ededed; }
+ul.messagelist li.success { border-left-color: #71dbb6; }
+ul.messagelist li.warning { border-left-color: #ffb454; }
+ul.messagelist li.error { border-left-color: #ff778b; }
+
+/* Login page: a centered card like the dashboard sign-in. */
+body.login #container {
+  border: 1px solid #232323;
+  border-radius: 16px;
+  background: linear-gradient(180deg, #191919, #161616);
+  box-shadow: 0 24px 64px rgba(0,0,0,.5);
+}
+body.login #header { padding: 24px 16px 12px; background: transparent; border-bottom: 0; }
+body.login #site-name .ss-brand { flex-direction: column; gap: 12px; }
+body.login .ss-brand img { width: 56px; height: 56px; }
+body.login #site-name .ss-brand span { font-size: 1.35rem; }
+body.login .submit-row input { width: 100%; padding: 11px; color: #0d0d0d; background: #ededed; font-weight: 600; }
+body.login .submit-row input:hover { background: #fff; }

secondshift/core/templatetags/accounts.py

@@ -0,0 +1,20 @@
+from django import template
+from django.conf import settings
+from django.urls import reverse
+from django.utils.html import format_html
+from django.utils.safestring import SafeString
+from django.utils.translation import gettext as _
+
+register = template.Library()
+
+
+@register.simple_tag
+def password_reset_link() -> SafeString | str:
+    """The sign-in form's reset link, only when the reset email can arrive."""
+    if not settings.EMAIL_DELIVERED:
+        return ""
+    return format_html(
+        '<a href="{}">{}</a>',
+        reverse("account_reset_password"),
+        _("Forgot your password?"),
+    )

secondshift/core/terminal.py

@@ -0,0 +1,27 @@
+"""Styles for the messages the local CLI prints itself.
+
+Click drops the styles when output is not a terminal.
+"""
+
+import click
+
+
+def heading(text: str) -> None:
+    click.secho(text, bold=True)
+
+
+def done(text: str, detail: str = "") -> None:
+    """A finished step, with an optional dimmed detail."""
+    line = f"{click.style('✓', fg='green', bold=True)} {text}"
+    if detail:
+        line += f"  {click.style(detail, dim=True)}"
+    click.echo(line)
+
+
+def note(text: str) -> None:
+    """Progress and hints that matter less than the steps."""
+    click.secho(text, dim=True)
+
+
+def link(url: str) -> str:
+    return click.style(url, fg="cyan", underline=True)

secondshift/core/views.py

@@ -0,0 +1,10 @@
+from allauth.account.views import password_reset as allauth_password_reset
+from django.conf import settings
+from django.http import Http404, HttpRequest, HttpResponse
+
+
+def password_reset(request: HttpRequest) -> HttpResponse:
+    """allauth's reset page, unless the reset email could not reach anyone."""
+    if not settings.EMAIL_DELIVERED:
+        raise Http404("Password resets need email. Set EMAIL_URL.")
+    return allauth_password_reset(request)

secondshift/gateway/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class GatewayConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "secondshift.gateway"

secondshift/gateway/dao.py

@@ -0,0 +1,137 @@
+"""Queries and writes on gateway tokens and model usage."""
+
+from datetime import datetime
+from decimal import Decimal
+from typing import Any
+
+from django.db.models import Count, F, Max, Q, QuerySet, Sum
+from django.utils import timezone
+
+from secondshift.connections.models import Connection
+from secondshift.gateway.models import ModelUsage, RunToken
+
+
+def create_run_token(
+    run_id: int,
+    connection: Connection,
+    token_hash: str,
+    expires_at: datetime,
+    budget_tokens: int,
+) -> RunToken:
+    """Store a run's gateway token by its hash."""
+    return RunToken.objects.create(
+        run_id=run_id,
+        connection=connection,
+        token_hash=token_hash,
+        expires_at=expires_at,
+        budget_tokens=budget_tokens,
+    )
+
+
+def revoke_run_tokens(run_id: int) -> int:
+    """Revoke the run's tokens that are still live. Returns how many."""
+    return RunToken.objects.filter(run_id=run_id, revoked_at__isnull=True).update(
+        revoked_at=timezone.now()
+    )
+
+
+def active_tokens(token_hash: str) -> QuerySet[RunToken]:
+    """Live tokens with this hash, for a connected model.
+
+    A run's tokens are revoked when it finishes, in the same transaction.
+    """
+    return RunToken.objects.select_related(
+        "connection", "run__job", "run__task__repository"
+    ).filter(
+        token_hash=token_hash,
+        revoked_at__isnull=True,
+        expires_at__gt=timezone.now(),
+        connection__status=Connection.Status.CONNECTED,
+        connection__kind=Connection.Kind.MODEL,
+    )
+
+
+def active_token(token_hash: str) -> RunToken | None:
+    return active_tokens(token_hash).first()
+
+
+async def aactive_token(token_hash: str) -> RunToken | None:
+    return await active_tokens(token_hash).afirst()
+
+
+async def acreate_model_usage(
+    run_token: RunToken,
+    provider: str,
+    model: str,
+    status_code: int,
+    tokens: dict[str, int],
+    cost_usd: Decimal | None,
+) -> ModelUsage:
+    """Record one model request made with this token.
+
+    `tokens` holds input_tokens, output_tokens, cache_read_tokens and
+    cache_write_tokens.
+    """
+    return await ModelUsage.objects.acreate(
+        run_id=run_token.run_id,
+        connection_id=run_token.connection_id,
+        provider=provider,
+        model=model,
+        status_code=status_code,
+        cost_usd=cost_usd,
+        **tokens,
+    )
+
+
+async def aadd_used_tokens(run_token: RunToken, tokens: int) -> None:
+    """Count tokens against the token's budget."""
+    await RunToken.objects.filter(pk=run_token.pk).aupdate(
+        used_tokens=F("used_tokens") + tokens
+    )
+
+
+def usage_by_connection(
+    workspace_id: int, since: datetime
+) -> dict[int, dict[str, Any]]:
+    """Per connection: runs, spend and unpriced requests since then, and last use."""
+    recent = Q(created_at__gte=since)
+    return {
+        row["connection_id"]: row
+        for row in ModelUsage.objects.filter(connection__workspace_id=workspace_id)
+        .values("connection_id")
+        .annotate(
+            runs=Count("run_id", distinct=True, filter=recent),
+            spend=Sum("cost_usd", filter=recent),
+            unpriced=Count("pk", filter=recent & Q(cost_usd__isnull=True)),
+            last=Max("created_at"),
+        )
+        .order_by()
+    }
+
+
+def spend_totals(runs: Q, start: datetime, previous_start: datetime) -> dict[str, Any]:
+    """Spend since `start`, spend in the window before it, and unpriced requests.
+
+    `runs` picks the usage by its run, with lookups that start at `run__`.
+    """
+    return ModelUsage.objects.filter(runs, created_at__gte=previous_start).aggregate(
+        spend=Sum("cost_usd", filter=Q(created_at__gte=start)),
+        previous=Sum("cost_usd", filter=Q(created_at__lt=start)),
+        unpriced=Count("pk", filter=Q(created_at__gte=start, cost_usd__isnull=True)),
+    )
+
+
+def spend_per_job(workspace_id: int, since: datetime) -> list[dict[str, Any]]:
+    """Per job: spend, runs and unpriced requests since then."""
+    return list(
+        ModelUsage.objects.filter(
+            run__job__workspace_id=workspace_id, created_at__gte=since
+        )
+        .values("run__job_id")
+        .annotate(
+            spend=Sum("cost_usd"),
+            runs=Count("run_id", distinct=True),
+            unpriced=Count("pk", filter=Q(cost_usd__isnull=True)),
+        )
+        .order_by()
+    )