secondshift 0.1.0b12__py3-none-any.whl

secondshift/jobs/admin.py

@@ -0,0 +1,83 @@
+from django.contrib import admin
+from django.http import HttpRequest
+from django.utils import timezone
+
+from secondshift.jobs.models import CapabilityRequest, Job, JobGrant
+
+
+class CapabilityRequestInline(admin.TabularInline):
+    model = CapabilityRequest
+    extra = 0
+    can_delete = False
+    readonly_fields = (
+        "binding",
+        "kind",
+        "requested_tools",
+        "required",
+        "created_at",
+        "updated_at",
+    )
+
+
+@admin.register(Job)
+class JobAdmin(admin.ModelAdmin):
+    list_display = (
+        "name",
+        "repository",
+        "cron",
+        "timezone",
+        "enabled",
+        "next_run_at",
+    )
+    list_filter = ("enabled", "timezone")
+    search_fields = ("name", "key", "repository__full_name", "skill_path")
+    readonly_fields = ("config_hash", "created_at", "updated_at")
+    inlines = [CapabilityRequestInline]
+
+
+@admin.register(CapabilityRequest)
+class CapabilityRequestAdmin(admin.ModelAdmin):
+    list_display = ("binding", "kind", "job", "required", "grant_status")
+    list_filter = ("kind", "required")
+    search_fields = ("binding", "job__name", "job__repository__full_name")
+    readonly_fields = (
+        "job",
+        "binding",
+        "kind",
+        "requested_tools",
+        "required",
+        "created_at",
+        "updated_at",
+    )
+
+    @admin.display(description="Grant")
+    def grant_status(self, request: CapabilityRequest) -> str:
+        grant = getattr(request, "grant", None)
+        return grant.status if grant else "unbound"
+
+
+@admin.register(JobGrant)
+class JobGrantAdmin(admin.ModelAdmin):
+    list_display = ("capability_request", "connection", "status", "reviewed_at")
+    list_filter = ("status", "connection__kind")
+    search_fields = (
+        "capability_request__binding",
+        "capability_request__job__name",
+        "connection__display_name",
+    )
+    readonly_fields = ("reviewed_by", "reviewed_at", "created_at", "updated_at")
+
+    def save_model(
+        self,
+        request: HttpRequest,
+        obj: JobGrant,
+        form: object,
+        change: bool,
+    ) -> None:
+        if obj.status in {JobGrant.Status.APPROVED, JobGrant.Status.DENIED}:
+            obj.reviewed_by = request.user
+            obj.reviewed_at = timezone.now()
+        else:
+            obj.reviewed_by = None
+            obj.reviewed_at = None
+        super().save_model(request, obj, form, change)

secondshift/jobs/api.py

@@ -0,0 +1,184 @@
+from django.http import HttpRequest
+from django.shortcuts import get_object_or_404
+from ninja import Router
+from ninja.errors import HttpError
+from ninja.security import django_auth
+
+from secondshift.connections.dao import workspace_connections
+from secondshift.connections.serialization import serialize_connection
+from secondshift.jobs.access import job_for_request
+from secondshift.jobs.dao import job_requests
+from secondshift.jobs.grants import GrantError, decide_grant
+from secondshift.jobs.models import JOB_REMOVED
+from secondshift.jobs.needs import capability_needs
+from secondshift.jobs.planning import build_execution_plan
+from secondshift.jobs.readiness import execution_problems
+from secondshift.jobs.scheduling import restart_schedules
+from secondshift.jobs.schemas import (
+    CapabilityNeedSchema,
+    GrantDecisionSchema,
+    JobDetailSchema,
+    JobEnabledSchema,
+    JobSchema,
+    NeedJobSchema,
+    SkillInspectionInput,
+    SkillInspectionSchema,
+)
+from secondshift.jobs.serialization import (
+    serialize_inspection,
+    serialize_job,
+    serialize_job_detail,
+    serialize_workspace_jobs,
+)
+from secondshift.jobs.skill_needs import inspect_external_skill
+from secondshift.repositories.access import repository_for_request
+from secondshift.repositories.external_skills import ExternalSkillError
+from secondshift.workspaces.access import (
+    Action,
+    allows,
+    current_workspace,
+    require,
+)
+from secondshift.workspaces.limits import LimitError, save_overrides
+from secondshift.workspaces.schemas import RunLimitsUpdateSchema
+from secondshift.workspaces.serialization import limit_error_detail
+
+router = Router(auth=django_auth, tags=["jobs"])
+
+
+@router.get("/capability-needs", response=list[CapabilityNeedSchema], auth=django_auth)
+def needs(request: HttpRequest) -> list[CapabilityNeedSchema]:
+    workspace = current_workspace(request)
+    if not workspace:
+        return []
+    return [
+        CapabilityNeedSchema(
+            binding=need.binding,
+            kind=need.kind,
+            required=need.required,
+            requested_tools=need.requested_tools,
+            status=need.status,
+            detail=need.detail,
+            connection=(
+                serialize_connection(need.connection) if need.connection else None
+            ),
+            jobs=[
+                NeedJobSchema(
+                    **{
+                        **vars(job),
+                        "access": vars(job.access) if job.access else None,
+                    }
+                )
+                for job in need.jobs
+            ],
+        )
+        for need in capability_needs(workspace)
+    ]
+
+
+@router.get("/jobs", response=list[JobSchema])
+def jobs(request: HttpRequest) -> list[JobSchema]:
+    workspace = current_workspace(request)
+    return serialize_workspace_jobs(workspace) if workspace else []
+
+
+@router.get("/jobs/{job_id}", response=JobDetailSchema)
+def job_detail(request: HttpRequest, job_id: int) -> JobDetailSchema:
+    job = job_for_request(request, job_id)
+    return serialize_job_detail(job, allows(request, Action.CHANGE_RUN_LIMITS))
+
+
+@router.post("/jobs/{job_id}/limits", response=JobDetailSchema)
+def set_job_limits(
+    request: HttpRequest, job_id: int, payload: RunLimitsUpdateSchema
+) -> JobDetailSchema:
+    """Change the run limits of one job. Runs already created keep theirs."""
+    job = job_for_request(request, job_id)
+    require(request, Action.CHANGE_RUN_LIMITS)
+    try:
+        save_overrides(job, payload.model_dump(exclude_unset=True))
+    except LimitError as error:
+        raise HttpError(422, limit_error_detail(request, error)) from error
+    return serialize_job_detail(job_for_request(request, job_id), True)
+
+
+@router.post("/jobs/{job_id}/enabled", response=JobSchema)
+def set_job_enabled(
+    request: HttpRequest, job_id: int, payload: JobEnabledSchema
+) -> JobSchema:
+    job = job_for_request(request, job_id)
+    require(request, Action.ENABLE_JOBS)
+    if payload.enabled:
+        if job.removed_at is not None:
+            raise HttpError(409, JOB_REMOVED)
+        if not job.cron:
+            raise HttpError(409, "This job has no schedule. Use Run now to run it.")
+        if not job.repository.accepts_runs:
+            raise HttpError(409, "Enable the repository before enabling this job.")
+        plan = build_execution_plan(job)
+        if not plan.ready:
+            raise HttpError(409, " ".join(execution_problems(job.repository, plan)))
+    turned_on = payload.enabled and not job.enabled
+    job.enabled = payload.enabled
+    job.save(update_fields=["enabled", "updated_at"])
+    if turned_on:
+        restart_schedules([job])
+    return serialize_job(job_for_request(request, job_id))
+
+
+@router.post("/jobs/{job_id}/capabilities/{capability_id}/grant", response=JobSchema)
+def review_job_capability(
+    request: HttpRequest,
+    job_id: int,
+    capability_id: int,
+    payload: GrantDecisionSchema,
+) -> JobSchema:
+    job = job_for_request(request, job_id)
+    require(request, Action.REVIEW_CAPABILITIES)
+    capability = get_object_or_404(job_requests(job), pk=capability_id)
+    connection = (
+        None
+        if payload.connection_id is None
+        else get_object_or_404(
+            workspace_connections(job.workspace_id), pk=payload.connection_id
+        )
+    )
+    try:
+        decide_grant(
+            capability,
+            payload.decision,
+            connection,
+            payload.allowed_tools,
+            request.user,
+            (
+                None
+                if payload.tool_rules is None
+                else {
+                    tool: {name: rule.dict() for name, rule in rules.items()}
+                    for tool, rules in payload.tool_rules.items()
+                }
+            ),
+        )
+    except GrantError as error:
+        raise HttpError(error.status, str(error)) from error
+    return serialize_job(job_for_request(request, job_id))
+
+
+@router.post("/skills/inspect", response=SkillInspectionSchema)
+def inspect_skill(
+    request: HttpRequest, payload: SkillInspectionInput
+) -> SkillInspectionSchema:
+    """Fetch a skill from another public repository and show what it needs."""
+    workspace = require(request, Action.RUN_JOBS)
+    target = (
+        repository_for_request(request, payload.repository_id)
+        if payload.repository_id is not None
+        else None
+    )
+    try:
+        inspection = inspect_external_skill(
+            workspace, payload.repository, payload.path, payload.ref, target
+        )
+    except ExternalSkillError as error:
+        raise HttpError(422, str(error)) from error
+    return serialize_inspection(inspection)

secondshift/jobs/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class JobsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "secondshift.jobs"

secondshift/jobs/automatic_grants.py

@@ -0,0 +1,115 @@
+"""Grants approved without an owner, for connections that do not require approval.
+
+When a connection's owner turns approval off, merging `.secondshift.yaml` is
+the review. A job still gets only tools the owner allowed on the connection.
+Anything else waits for an owner, as before. Owner decisions are kept: an
+approved or denied grant is never changed here.
+"""
+
+from django.db import transaction
+from django.utils import timezone
+
+from secondshift.connections.dao import auto_approved_connections
+from secondshift.connections.external import external_access
+from secondshift.connections.models import Connection
+from secondshift.jobs.capabilities import RequestedCapability
+from secondshift.jobs.dao import (
+    binding_active_requests,
+    create_grants,
+    save_grant_reviews,
+)
+from secondshift.jobs.models import CapabilityRequest, JobGrant
+from secondshift.repositories.github import repository_ref
+from secondshift.repositories.models import Repository
+
+
+def approves_automatically(
+    request: CapabilityRequest | RequestedCapability,
+    connection: Connection,
+    repository: Repository,
+) -> bool:
+    if connection.workspace_id != repository.workspace_id:
+        return False
+    if connection.require_approval:
+        return False
+    if not connection.is_connected:
+        return False
+    if connection.kind != request.kind or connection.binding_key != request.binding:
+        return False
+    if set(request.requested_tools) - set(connection.available_tools):
+        return False
+    access = external_access(connection, repository_ref(repository))
+    return access is None or access.ok
+
+
+def automatic_approval(
+    request: CapabilityRequest, connection: Connection, repository: Repository
+) -> dict[str, object] | None:
+    """The grant fields that approve the request, or None if it must wait."""
+    if not approves_automatically(request, connection, repository):
+        return None
+    return {
+        "connection_id": connection.pk,
+        "status": JobGrant.Status.APPROVED,
+        "allowed_tools": sorted(request.requested_tools),
+        "reviewed_by_id": None,
+        "reviewed_at": timezone.now(),
+    }
+
+
+def approve_waiting(loaded: list[CapabilityRequest]) -> int:
+    """Approve the waiting requests that their connections allow. Returns how many.
+
+    Each request needs its grant and its job's repository loaded.
+    """
+    if not loaded:
+        return 0
+    connections = {
+        (connection.workspace_id, connection.binding_key): connection
+        for connection in auto_approved_connections(
+            {request.job.workspace_id for request in loaded},
+            {request.binding for request in loaded},
+        )
+    }
+    now = timezone.now()
+    created: list[JobGrant] = []
+    updated: list[JobGrant] = []
+    for request in loaded:
+        grant = getattr(request, "grant", None)
+        if grant is not None and grant.status != JobGrant.Status.PENDING:
+            continue
+        connection = connections.get((request.job.workspace_id, request.binding))
+        if connection is None:
+            continue
+        fields = automatic_approval(request, connection, request.job.repository)
+        if fields is None:
+            continue
+        if grant is None:
+            grant = JobGrant(capability_request=request)
+            created.append(grant)
+        else:
+            updated.append(grant)
+        for name, value in {**fields, "updated_at": now}.items():
+            setattr(grant, name, value)
+    create_grants(created)
+    save_grant_reviews(updated)
+    return len(created) + len(updated)
+
+
+def approve_waiting_for(connection: Connection) -> int:
+    """Approve requests that were waiting for this connection."""
+    if connection.require_approval or not connection.binding_key:
+        return 0
+    return approve_waiting(
+        binding_active_requests(connection.workspace_id, connection.binding_key)
+    )
+
+
+@transaction.atomic
+def set_require_approval(connection: Connection, require: bool) -> Connection:
+    """Change the setting. Existing grants stay."""
+    if connection.require_approval != require:
+        connection.require_approval = require
+        connection.save(update_fields=["require_approval", "updated_at"])
+    approve_waiting_for(connection)
+    return connection

secondshift/jobs/autosync.py

@@ -0,0 +1,78 @@
+"""Sync repositories whose branch moved, so merged changes apply.
+
+Syncing only applies what is committed on the branch. New access a job
+requests still waits for an owner's approval. A repository added before it
+had a valid configuration is checked even while disabled, so the first
+committed .secondshift.yaml shows up without a manual Resync.
+"""
+
+import logging
+from pathlib import Path
+
+from django.conf import settings
+
+from secondshift.connections.dao import has_github_token_sources
+from secondshift.connections.github import can_check
+from secondshift.github import repos
+from secondshift.github.app import configured
+from secondshift.github.errors import GitHubError
+from secondshift.jobs.repository_sync import sync_repository
+from secondshift.repositories.dao import repositories_to_sync, set_sync_error
+from secondshift.repositories.github_access import github_access
+from secondshift.repositories.github_check import check_after_failure
+from secondshift.repositories.local import (
+    LocalRepositoryError,
+    branch_revision,
+)
+from secondshift.repositories.models import Repository
+
+logger = logging.getLogger(__name__)
+
+
+def server_syncs() -> bool:
+    """Whether the worker syncs at all on this server."""
+    return bool(
+        (
+            settings.LOCAL_REPOSITORIES_ENABLED
+            or configured()
+            or has_github_token_sources()
+        )
+        and settings.REPOSITORY_SYNC_INTERVAL_SECONDS > 0
+    )
+
+
+def branch_head(repository: Repository) -> str:
+    if repository.source_type == Repository.SourceType.GITHUB:
+        access = github_access(repository)
+        return repos.branch_head(
+            access.token, access.repository_id, repository.default_branch
+        )
+    return branch_revision(Path(repository.local_path), repository.default_branch)
+
+
+def sync_moved_repositories() -> int:
+    """Sync each repository whose branch has a new commit. Returns how many."""
+    synced = 0
+    for repository in repositories_to_sync(settings.LOCAL_REPOSITORIES_ENABLED):
+        is_github = repository.source_type == Repository.SourceType.GITHUB
+        if is_github and not can_check(repository.github_connection):
+            continue
+        try:
+            if branch_head(repository) == repository.checked_sha:
+                continue
+            result = sync_repository(repository)
+        except (LocalRepositoryError, GitHubError) as error:
+            # The repository page shows the same problem when opened. Runs
+            # keep using the last good sync until it is fixed.
+            set_sync_error(repository.pk, str(error))
+            logger.warning("could not sync %s: %s", repository.display_name, error)
+            if is_github:
+                check_after_failure(repository.github_connection)
+            continue
+        if result.last_sync_error:
+            logger.warning(
+                "could not sync %s: %s", repository.display_name, result.last_sync_error
+            )
+            continue
+        synced += 1
+    return synced

secondshift/jobs/capabilities.py

@@ -0,0 +1,43 @@
+"""Logical capability requests, independent of a saved job or its grants."""
+
+from dataclasses import dataclass
+
+from secondshift.jobs.manifest import JobManifest
+from secondshift.jobs.models import CapabilityRequest
+
+
+@dataclass(frozen=True)
+class RequestedCapability:
+    binding: str
+    kind: str
+    requested_tools: tuple[str, ...]
+    required: bool = True
+
+
+def manifest_capabilities(definition: JobManifest) -> list[RequestedCapability]:
+    return [
+        *(
+            RequestedCapability(
+                item.binding,
+                CapabilityRequest.Kind.MCP,
+                tuple(item.tools),
+                item.required,
+            )
+            for item in definition.requires.mcps
+        ),
+        *(
+            RequestedCapability(
+                item.binding,
+                CapabilityRequest.Kind.API,
+                tuple(item.tools),
+                item.required,
+            )
+            for item in definition.requires.apis
+        ),
+        *(
+            RequestedCapability(
+                item.binding, CapabilityRequest.Kind.NOTIFICATION, (), item.required
+            )
+            for item in definition.notify
+        ),
+    ]