secondshift 0.1.0b12__py3-none-any.whl

secondshift/connections/api.py

@@ -0,0 +1,747 @@
+from typing import Any
+from urllib.parse import urlencode
+
+from django.conf import settings
+from django.core.exceptions import ValidationError
+from django.http import HttpRequest, HttpResponseRedirect
+from django.shortcuts import get_object_or_404
+from ninja import Router, Status
+from ninja.errors import HttpError
+from ninja.security import django_auth
+
+from secondshift.config.constants import SUMMARY_MAX_CHARS
+from secondshift.connections.agents import (
+    AgentConnectionError,
+    check_agent_connection,
+    disconnect_agent_connection,
+    reconnect_agent_connection,
+    save_agent_connection,
+)
+from secondshift.connections.dao import (
+    github_token_sources,
+    own_agent_connections,
+    workspace_agent_connections,
+    workspace_connections,
+)
+from secondshift.connections.execution import (
+    apply_model_default,
+    execution_configuration,
+    save_execution_preference,
+    use_when_nothing_runs,
+)
+from secondshift.connections.github import (
+    connect_token_source,
+    is_github_source,
+    set_attribution,
+)
+from secondshift.connections.http_api.connections import (
+    create_api_connection,
+    recheck_api_connection,
+    summarize,
+    update_api_connection,
+)
+from secondshift.connections.http_api.spec import APIError
+from secondshift.connections.mcp.base import MCPError
+from secondshift.connections.mcp.client import (
+    create_mcp_connection,
+    recheck_mcp_connection,
+    update_mcp_connection,
+)
+from secondshift.connections.mcp.oauth import inspect_server, requested_scopes
+from secondshift.connections.mcp.providers import MCP_PROVIDERS
+from secondshift.connections.mcp.signin import (
+    SignInError,
+    complete_authorization,
+    start_authorization,
+)
+from secondshift.connections.model_providers import (
+    CheckFailed,
+    ModelProviderError,
+    check_model_connection,
+    checked_api_key,
+    create_model_connection,
+    fetch_models,
+    update_model_connection,
+    validated_endpoint,
+)
+from secondshift.connections.models import AgentConnection, Connection
+from secondshift.connections.schemas import (
+    AgentConnectionInput,
+    AgentConnectionSchema,
+    AgentRunLimitInput,
+    APIConnectionCreateSchema,
+    APIConnectionUpdateSchema,
+    APISpecSchema,
+    APISpecSummarySchema,
+    AttributionSchema,
+    ConnectionSchema,
+    ConnectionTestSchema,
+    ExecutionConfigurationSchema,
+    ExecutionPreferenceSchema,
+    GitHubTokenConnectSchema,
+    MCPConnectionCreateSchema,
+    MCPConnectionUpdateSchema,
+    MCPInspectResultSchema,
+    MCPInspectSchema,
+    MCPProviderSchema,
+    MCPSettingSchema,
+    MCPSignInSchema,
+    MCPSignInStartSchema,
+    ModelConnectionCreateSchema,
+    ModelConnectionUpdateSchema,
+    WebhookConnectionCreateSchema,
+    WebhookConnectionUpdateSchema,
+    WebhookSampleSchema,
+)
+from secondshift.connections.serialization import (
+    serialize_connection,
+    with_recent_runs,
+)
+from secondshift.connections.services import (
+    ConnectionConflict,
+    create_webhook_connection,
+    revoke_connection,
+    update_webhook_connection,
+)
+from secondshift.connections.webhooks import (
+    WebhookError,
+    connection_test_payload,
+    deliver_webhook,
+)
+from secondshift.github.errors import GitHubError
+from secondshift.jobs.automatic_grants import approve_waiting_for, set_require_approval
+from secondshift.jobs.grants import delete_connection
+from secondshift.repositories.github_check import check_source
+from secondshift.runs.reporting.connection_usage import (
+    ConnectionUsage,
+    connection_usage,
+)
+from secondshift.runs.reporting.notifications import sample_run_report_payload
+from secondshift.workspaces.access import (
+    Action,
+    current_workspace,
+    require,
+)
+
+router = Router(auth=django_auth, tags=["connections"])
+
+
+@router.get("/connections", response=list[ConnectionSchema], auth=django_auth)
+def connections(request: HttpRequest) -> list[ConnectionSchema]:
+    workspace = current_workspace(request)
+    if not workspace:
+        return []
+    usage = connection_usage(workspace)
+    return [
+        serialize_connection(item, usage.get(item.pk, ConnectionUsage()))
+        for item in workspace_connections(workspace.pk)
+    ]
+
+
+@router.get(
+    "/connections/mcp-providers", response=list[MCPProviderSchema], auth=django_auth
+)
+def list_mcp_providers(request: HttpRequest) -> list[MCPProviderSchema]:
+    """The built-in MCP servers an owner can connect. Never includes secrets."""
+    return [
+        MCPProviderSchema(
+            key=provider.key,
+            label=provider.label,
+            description=provider.description,
+            default_binding=provider.default_binding,
+            token_label=provider.token_label,
+            token_hint=provider.token_hint,
+            setup_url=provider.setup_url,
+            setup_help=provider.setup_help,
+            settings=[
+                MCPSettingSchema(
+                    key=item.key,
+                    label=item.label,
+                    pattern=item.pattern,
+                    required=item.required,
+                    help=item.help,
+                    placeholder=item.placeholder,
+                )
+                for item in provider.settings
+            ],
+            tools=list(provider.tools),
+            auth_methods=list(provider.auth_methods),
+            owner_selects_tools=provider.owner_selects_tools,
+        )
+        for provider in MCP_PROVIDERS.values()
+    ]
+
+
+@router.post("/connections/github-token", response=ConnectionSchema, auth=django_auth)
+def connect_github_token(
+    request: HttpRequest, payload: GitHubTokenConnectSchema
+) -> ConnectionSchema:
+    """Reach repositories with a personal access token instead of the App."""
+    workspace = require(request, Action.ADD_GITHUB_REPOSITORIES)
+    replacing = None
+    if payload.connection_id is not None:
+        replacing = get_object_or_404(
+            github_token_sources(workspace.pk), pk=payload.connection_id
+        )
+    try:
+        connection = connect_token_source(workspace, payload.token, replacing)
+    except GitHubError as error:
+        raise HttpError(422, str(error)) from error
+    return serialize_connection(connection)
+
+
+@router.post(
+    "/connections/{connection_id}/attribution",
+    response=ConnectionSchema,
+    auth=django_auth,
+)
+def update_attribution(
+    request: HttpRequest, connection_id: int, payload: AttributionSchema
+) -> ConnectionSchema:
+    """Whether pull requests, issues and commits through this source name SecondShift."""
+    connection = owned_connection(request, connection_id, Action.EDIT_CONNECTIONS)
+    if not is_github_source(connection):
+        raise HttpError(404, "Not Found")
+    return serialize_connection(set_attribution(connection, payload.attribution))
+
+
+@router.post("/connections/mcp", response=ConnectionSchema, auth=django_auth)
+def create_mcp(
+    request: HttpRequest, payload: MCPConnectionCreateSchema
+) -> ConnectionSchema:
+    workspace = require(request, Action.ADD_MCP_CONNECTIONS)
+    try:
+        connection = create_mcp_connection(
+            workspace,
+            payload.provider,
+            payload.binding_key,
+            payload.display_name,
+            payload.token,
+            payload.settings,
+            payload.auth,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except MCPError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, "The MCP connection configuration is invalid.") from error
+    return apply_approval(connection, payload.require_approval)
+
+
+@router.post(
+    "/connections/{connection_id}/mcp",
+    response=ConnectionSchema,
+    auth=django_auth,
+)
+def update_mcp(
+    request: HttpRequest, connection_id: int, payload: MCPConnectionUpdateSchema
+) -> ConnectionSchema:
+    connection = owned_connection(request, connection_id, Action.EDIT_CONNECTIONS)
+    try:
+        connection = update_mcp_connection(
+            connection,
+            payload.display_name,
+            payload.token,
+            payload.settings,
+            payload.tools,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except MCPError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, "The MCP connection configuration is invalid.") from error
+    return apply_approval(connection, payload.require_approval)
+
+
+@router.post(
+    "/connections/api/inspect", response=APISpecSummarySchema, auth=django_auth
+)
+def inspect_api_spec(
+    request: HttpRequest, payload: APISpecSchema
+) -> APISpecSummarySchema:
+    """The spec's title, servers, and operation counts, before connecting."""
+    require(request, Action.ADD_API_CONNECTIONS)
+    try:
+        summary = summarize(payload.spec_url.strip(), payload.spec_text)
+    except APIError as error:
+        raise HttpError(422, str(error)) from error
+    return APISpecSummarySchema(
+        title=summary.title,
+        servers=list(summary.servers),
+        operations=summary.operations,
+        read_only=summary.read_only,
+    )
+
+
+@router.post("/connections/api", response=ConnectionSchema, auth=django_auth)
+def create_api(
+    request: HttpRequest, payload: APIConnectionCreateSchema
+) -> ConnectionSchema:
+    workspace = require(request, Action.ADD_API_CONNECTIONS)
+    try:
+        connection = create_api_connection(
+            workspace,
+            payload.binding_key,
+            payload.display_name,
+            payload.spec_url.strip(),
+            payload.spec_text,
+            payload.base_url,
+            payload.auth,
+            payload.header.strip(),
+            payload.token,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except APIError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, "The API connection configuration is invalid.") from error
+    return apply_approval(connection, payload.require_approval)
+
+
+@router.post(
+    "/connections/{connection_id}/api", response=ConnectionSchema, auth=django_auth
+)
+def update_api(
+    request: HttpRequest, connection_id: int, payload: APIConnectionUpdateSchema
+) -> ConnectionSchema:
+    connection = owned_connection(request, connection_id, Action.EDIT_CONNECTIONS)
+    try:
+        connection = update_api_connection(
+            connection,
+            payload.display_name,
+            payload.token,
+            payload.base_url,
+            payload.operations,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except APIError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, "The API connection configuration is invalid.") from error
+    return apply_approval(connection, payload.require_approval)
+
+
+@router.post(
+    "/connections/mcp/inspect", response=MCPInspectResultSchema, auth=django_auth
+)
+def inspect_mcp(
+    request: HttpRequest, payload: MCPInspectSchema
+) -> MCPInspectResultSchema:
+    """Whether a server offers sign-in, and which scopes it lists."""
+    require(request, Action.ADD_MCP_CONNECTIONS)
+    try:
+        server = inspect_server(payload.provider, payload.settings)
+    except MCPError as error:
+        raise HttpError(422, str(error)) from error
+    if server is None:
+        return MCPInspectResultSchema(oauth=False, scopes=[])
+    return MCPInspectResultSchema(oauth=True, scopes=list(server.scopes_supported))
+
+
+@router.post(
+    "/connections/mcp/oauth/start", response=MCPSignInStartSchema, auth=django_auth
+)
+def start_mcp_sign_in(
+    request: HttpRequest, payload: MCPSignInSchema
+) -> MCPSignInStartSchema:
+    workspace = require(request, Action.ADD_MCP_CONNECTIONS)
+    connection = (
+        get_object_or_404(
+            workspace_connections(workspace.pk, Connection.Kind.MCP),
+            pk=payload.connection_id,
+        )
+        if payload.connection_id
+        else None
+    )
+    if connection is None and not payload.binding_key:
+        raise HttpError(422, "Enter a binding.")
+    try:
+        url = start_authorization(
+            workspace,
+            request.user,
+            connection.provider if connection else payload.provider,
+            payload.binding_key,
+            payload.display_name,
+            connection.settings if connection else payload.settings,
+            requested_scopes(connection) if connection else payload.scopes,
+            connection,
+            payload.require_approval,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except MCPError as error:
+        raise HttpError(422, str(error)) from error
+    return MCPSignInStartSchema(authorize_url=url)
+
+
+@router.get("/connections/oauth/callback", auth=None, include_in_schema=False)
+def finish_mcp_sign_in(request: HttpRequest) -> HttpResponseRedirect:
+    """The browser lands here from the sign-in page. Always redirect back."""
+    back = f"{settings.FRONTEND_URL.rstrip('/')}/connections"
+    if not request.user.is_authenticated:
+        return HttpResponseRedirect(f"{back}?{urlencode({'oauth': 'invalid'})}")
+    try:
+        connection = complete_authorization(
+            request.user,
+            request.GET.get("state", "")[:200],
+            request.GET.get("code", "")[:2000],
+            request.GET.get("error", "")[:200],
+        )
+    # Only fixed codes go in the URL, so a crafted link cannot show any text.
+    except SignInError as error:
+        return HttpResponseRedirect(f"{back}?{urlencode({'oauth': error.code})}")
+    except ConnectionConflict:
+        return HttpResponseRedirect(f"{back}?{urlencode({'oauth': 'taken'})}")
+    except (MCPError, ValidationError):
+        return HttpResponseRedirect(f"{back}?{urlencode({'oauth': 'failed'})}")
+    approve_waiting_for(connection)
+    query = {"oauth": "connected", "capability": connection.binding_key}
+    return HttpResponseRedirect(f"{back}?{urlencode(query)}")
+
+
+@router.post("/connections/webhook", response=ConnectionSchema, auth=django_auth)
+def create_webhook(
+    request: HttpRequest,
+    payload: WebhookConnectionCreateSchema,
+) -> ConnectionSchema:
+    workspace = require(request, Action.ADD_CONNECTIONS)
+    try:
+        connection = create_webhook_connection(
+            workspace,
+            payload.binding_key,
+            payload.display_name,
+            payload.url,
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except WebhookError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, " ".join(error.messages)) from error
+    return apply_approval(connection, payload.require_approval)
+
+
+def apply_approval(
+    connection: Connection, require_approval: bool | None
+) -> ConnectionSchema:
+    """Save the owner's approval choice and approve requests it now allows."""
+    if require_approval is None:
+        approve_waiting_for(connection)
+    else:
+        set_require_approval(connection, require_approval)
+    return serialize_connection(connection)
+
+
+def owned_connection(
+    request: HttpRequest, connection_id: int, action: Action
+) -> Connection:
+    workspace = require(request, action)
+    return get_object_or_404(workspace_connections(workspace.pk), pk=connection_id)
+
+
+@router.post(
+    "/connections/{connection_id}/webhook",
+    response=ConnectionSchema,
+    auth=django_auth,
+)
+def update_webhook(
+    request: HttpRequest,
+    connection_id: int,
+    payload: WebhookConnectionUpdateSchema,
+) -> ConnectionSchema:
+    connection = owned_connection(request, connection_id, Action.EDIT_CONNECTIONS)
+    try:
+        connection = update_webhook_connection(
+            connection, payload.display_name, payload.url
+        )
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    except WebhookError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, " ".join(error.messages)) from error
+    return apply_approval(connection, payload.require_approval)
+
+
+@router.post("/connections/model/models", response=list[str], auth=django_auth)
+def discover_model_provider_models(
+    request: HttpRequest, payload: ModelConnectionCreateSchema
+) -> list[str]:
+    require(request, Action.ADD_MODEL_PROVIDERS)
+    try:
+        connection = Connection(
+            provider=payload.provider,
+            endpoint_url=validated_endpoint(payload.provider, payload.base_url),
+            access_token=checked_api_key(payload.provider, payload.api_key),
+        )
+        return fetch_models(connection)
+    except (ModelProviderError, CheckFailed) as error:
+        raise HttpError(422, str(error)) from error
+
+
+@router.post(
+    "/connections/{connection_id}/model/models", response=list[str], auth=django_auth
+)
+def refresh_model_provider_models(
+    request: HttpRequest, connection_id: int, payload: ModelConnectionUpdateSchema
+) -> list[str]:
+    connection = owned_connection(request, connection_id, Action.EDIT_MODEL_PROVIDERS)
+    if connection.kind != Connection.Kind.MODEL:
+        raise HttpError(422, "This is not a model provider connection.")
+    try:
+        # Preview changes without saving credentials, settings, or discovery results.
+        preview = Connection(
+            provider=connection.provider,
+            endpoint_url=validated_endpoint(
+                connection.provider,
+                payload.base_url
+                if payload.base_url is not None
+                else connection.endpoint_url,
+            ),
+            access_token=payload.api_key.strip()
+            if payload.api_key and payload.api_key.strip()
+            else connection.access_token,
+        )
+        return fetch_models(preview)
+    except (ModelProviderError, CheckFailed) as error:
+        raise HttpError(422, str(error)) from error
+
+
+@router.post("/connections/model", response=ConnectionSchema, auth=django_auth)
+def create_model_provider(
+    request: HttpRequest,
+    payload: ModelConnectionCreateSchema,
+) -> ConnectionSchema:
+    workspace = require(request, Action.ADD_MODEL_PROVIDERS)
+    try:
+        connection = create_model_connection(
+            workspace,
+            payload.provider,
+            payload.display_name,
+            payload.api_key,
+            endpoint_url=payload.base_url,
+            allowed_models=payload.allowed_models,
+            default_model=payload.default_model,
+        )
+    except ModelProviderError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, " ".join(error.messages)) from error
+    apply_model_default(connection, payload.is_default)
+    return serialize_connection(connection)
+
+
+@router.post(
+    "/connections/{connection_id}/model",
+    response=ConnectionSchema,
+    auth=django_auth,
+)
+def update_model_provider(
+    request: HttpRequest,
+    connection_id: int,
+    payload: ModelConnectionUpdateSchema,
+) -> ConnectionSchema:
+    connection = owned_connection(request, connection_id, Action.EDIT_MODEL_PROVIDERS)
+    try:
+        connection = update_model_connection(
+            connection,
+            display_name=payload.display_name,
+            api_key=payload.api_key,
+            endpoint_url=payload.base_url,
+            allowed_models=payload.allowed_models,
+            default_model=payload.default_model,
+        )
+    except ModelProviderError as error:
+        raise HttpError(422, str(error)) from error
+    except ValidationError as error:
+        raise HttpError(422, " ".join(error.messages)) from error
+    apply_model_default(connection, payload.is_default)
+    return serialize_connection(connection)
+
+
+@router.post(
+    "/connections/{connection_id}/revoke",
+    response=ConnectionSchema,
+    auth=django_auth,
+)
+def revoke(request: HttpRequest, connection_id: int) -> ConnectionSchema:
+    connection = owned_connection(request, connection_id, Action.DISCONNECT_CONNECTIONS)
+    return serialize_connection(revoke_connection(connection))
+
+
+@router.delete(
+    "/connections/{connection_id}",
+    response={204: None},
+    auth=django_auth,
+)
+def remove_connection(request: HttpRequest, connection_id: int) -> Status[None]:
+    connection = owned_connection(request, connection_id, Action.DELETE_CONNECTIONS)
+    try:
+        delete_connection(connection)
+    except ConnectionConflict as error:
+        raise HttpError(409, str(error)) from error
+    return Status(204, None)
+
+
+@router.post(
+    "/connections/{connection_id}/test",
+    response=ConnectionTestSchema,
+    auth=django_auth,
+)
+def test_connection(request: HttpRequest, connection_id: int) -> ConnectionTestSchema:
+    connection = owned_connection(request, connection_id, Action.TEST_CONNECTIONS)
+    if connection.kind == Connection.Kind.MCP:
+        try:
+            message = recheck_mcp_connection(connection)
+        except MCPError as error:
+            return ConnectionTestSchema(ok=False, status_code=None, message=str(error))
+        return ConnectionTestSchema(ok=True, status_code=None, message=message)
+    if connection.kind == Connection.Kind.API:
+        try:
+            message = recheck_api_connection(connection)
+        except APIError as error:
+            return ConnectionTestSchema(ok=False, status_code=None, message=str(error))
+        return ConnectionTestSchema(ok=True, status_code=None, message=message)
+    if connection.kind == Connection.Kind.MODEL:
+        check = check_model_connection(connection)
+        return ConnectionTestSchema(
+            ok=check.ok, status_code=None, message=check.message, models=check.models
+        )
+    if (
+        connection.kind == Connection.Kind.SOURCE
+        and connection.provider == Connection.Provider.GITHUB
+    ):
+        check = check_source(connection)
+        return ConnectionTestSchema(
+            ok=check.ok, status_code=None, message=check.message
+        )
+    if connection.provider != Connection.Provider.WEBHOOK:
+        raise HttpError(400, "Testing is not available for this connection yet.")
+    delivery = deliver_webhook(connection, connection_test_payload(connection))
+    return ConnectionTestSchema(
+        ok=delivery.ok,
+        status_code=delivery.status_code,
+        message=delivery.message,
+    )
+
+
+@router.get(
+    "/connections/webhook/sample", response=WebhookSampleSchema, auth=django_auth
+)
+def webhook_sample(request: HttpRequest) -> WebhookSampleSchema:
+    """What a webhook connection will receive after each run."""
+    return WebhookSampleSchema(
+        payload=sample_run_report_payload(), summary_max_chars=SUMMARY_MAX_CHARS
+    )
+
+
+@router.get("/agent-connections", response=list[AgentConnectionSchema])
+def agent_connections(request: HttpRequest) -> list[AgentConnection]:
+    workspace = current_workspace(request)
+    if not workspace:
+        return []
+    return with_recent_runs(workspace_agent_connections(workspace), workspace.pk)
+
+
+@router.post("/agent-connections", response=AgentConnectionSchema)
+def connect_agent(
+    request: HttpRequest, payload: AgentConnectionInput
+) -> AgentConnection:
+    workspace = require(request, Action.ADD_CONNECTIONS)
+    try:
+        connection = save_agent_connection(
+            workspace,
+            request.user,
+            payload.backend,
+            payload.display_name,
+            payload.auth.get_secret_value(),
+        )
+    except AgentConnectionError as error:
+        raise HttpError(422, str(error)) from None
+    use_when_nothing_runs(workspace, login=connection)
+    return connection
+
+
+@router.post("/agent-connections/{connection_id}", response=AgentConnectionSchema)
+def reconnect_agent(
+    request: HttpRequest, connection_id: int, payload: AgentConnectionInput
+) -> AgentConnection:
+    workspace = require(request, Action.EDIT_CONNECTIONS)
+    connection = get_object_or_404(
+        own_agent_connections(workspace, request.user), pk=connection_id
+    )
+    try:
+        return reconnect_agent_connection(
+            connection,
+            request.user,
+            payload.backend,
+            payload.display_name,
+            payload.auth.get_secret_value(),
+        )
+    except AgentConnectionError as error:
+        raise HttpError(422, str(error)) from None
+
+
+@router.post("/agent-connections/{connection_id}/check", response=AgentConnectionSchema)
+def check_agent(request: HttpRequest, connection_id: int) -> AgentConnection:
+    """Only the login's owner checks it. The check uses their plan's allowance."""
+    workspace = require(request, Action.TEST_CONNECTIONS)
+    connection = get_object_or_404(
+        own_agent_connections(workspace, request.user), pk=connection_id
+    )
+    try:
+        check_agent_connection(connection)
+    except AgentConnectionError as error:
+        raise HttpError(409, str(error)) from None
+    return connection
+
+
+@router.post(
+    "/agent-connections/{connection_id}/run-limit", response=AgentConnectionSchema
+)
+def set_agent_run_limit(
+    request: HttpRequest, connection_id: int, payload: AgentRunLimitInput
+) -> AgentConnection:
+    """Only the login's owner sets its cap. It is their subscription."""
+    workspace = require(request, Action.EDIT_CONNECTIONS)
+    connection = get_object_or_404(
+        own_agent_connections(workspace, request.user), pk=connection_id
+    )
+    connection.max_runs_per_day = payload.max_runs_per_day
+    connection.save(update_fields=["max_runs_per_day", "updated_at"])
+    return connection
+
+
+@router.delete("/agent-connections/{connection_id}", response={204: None})
+def disconnect_agent(request: HttpRequest, connection_id: int) -> Status[None]:
+    workspace = require(request, Action.DISCONNECT_CONNECTIONS)
+    connection = get_object_or_404(
+        own_agent_connections(workspace, request.user), pk=connection_id
+    )
+    # A cached copy the runner keeps is removed by the worker.
+    disconnect_agent_connection(connection)
+    return Status(204, None)
+
+
+@router.get("/settings/agent", response=ExecutionConfigurationSchema)
+def default_agent(request: HttpRequest) -> dict[str, Any]:
+    workspace = current_workspace(request)
+    if workspace is None:
+        raise HttpError(404, "Choose a workspace first.")
+    return execution_configuration(workspace, request.user)
+
+
+@router.post("/settings/agent", response=ExecutionConfigurationSchema)
+def set_default_agent(
+    request: HttpRequest, payload: ExecutionPreferenceSchema
+) -> dict[str, Any]:
+    workspace = require(request, Action.REVIEW_CAPABILITIES)
+    try:
+        save_execution_preference(workspace, payload.key, request.user)
+    except ValidationError as error:
+        raise HttpError(422, error.messages[0]) from None
+    return execution_configuration(workspace, request.user)