secondshift 0.1.0b12__py3-none-any.whl

secondshift/workspaces/api.py

@@ -0,0 +1,264 @@
+from django.conf import settings
+from django.http import HttpRequest
+from django.shortcuts import get_object_or_404
+from ninja import Router, Status
+from ninja.errors import HttpError
+from ninja.security import django_auth
+
+from secondshift.workspaces.access import (
+    Action,
+    current_workspace,
+    require,
+    select_workspace,
+    user_memberships,
+)
+from secondshift.workspaces.dao import (
+    find_membership,
+    own_tokens,
+    pending_invites,
+    workspace_members,
+)
+from secondshift.workspaces.invites import (
+    InviteError,
+    create_invite,
+    forget_invite,
+    invite_path,
+    join_pending_invite,
+    pending_invite,
+    revoke_invite,
+)
+from secondshift.workspaces.limits import LimitError, save_overrides
+from secondshift.workspaces.models import (
+    WorkspaceMembership,
+)
+from secondshift.workspaces.schemas import (
+    ApiTokenCreateSchema,
+    ApiTokenListSchema,
+    InviteCreateSchema,
+    InviteSchema,
+    MemberSchema,
+    NewApiTokenSchema,
+    NewInviteSchema,
+    PendingInviteSchema,
+    RoleChangeSchema,
+    RunLimitsUpdateSchema,
+    WorkspaceChoiceSchema,
+    WorkspaceCreateSchema,
+    WorkspaceSelectSchema,
+    WorkspaceSettingsSchema,
+)
+from secondshift.workspaces.serialization import (
+    limit_error_detail,
+    serialize_api_token,
+    serialize_choice,
+    serialize_invite,
+    serialize_member,
+    serialize_settings,
+    serialize_token_workspace,
+)
+from secondshift.workspaces.services import (
+    MembershipError,
+    WorkspaceCreationError,
+    WorkspaceCreationRefused,
+    change_role,
+    create_workspace_for,
+    members_in_order,
+    remove_member,
+)
+from secondshift.workspaces.tokens import TokenError, create_api_token, revoke_api_token
+
+router = Router(auth=django_auth, tags=["workspaces"])
+
+
+@router.get("/settings", response=WorkspaceSettingsSchema, auth=django_auth)
+def workspace_settings(request: HttpRequest) -> WorkspaceSettingsSchema:
+    return serialize_settings(request, current_workspace(request))
+
+
+@router.post("/settings/limits", response=WorkspaceSettingsSchema, auth=django_auth)
+def set_workspace_limits(
+    request: HttpRequest, payload: RunLimitsUpdateSchema
+) -> WorkspaceSettingsSchema:
+    """Change the workspace's run limits. Runs already created keep theirs."""
+    workspace = require(request, Action.CHANGE_RUN_LIMITS)
+    try:
+        save_overrides(workspace, payload.model_dump(exclude_unset=True))
+    except LimitError as error:
+        raise HttpError(422, limit_error_detail(request, error)) from error
+    return serialize_settings(request, workspace)
+
+
+@router.get("/workspaces", response=list[WorkspaceChoiceSchema])
+def workspaces(request: HttpRequest) -> list[WorkspaceChoiceSchema]:
+    """Every workspace the person belongs to, the first one joined first."""
+    current = current_workspace(request)
+    current_id = current.pk if current else None
+    return [serialize_choice(item, current_id) for item in user_memberships(request)]
+
+
+@router.post("/workspaces", response=WorkspaceChoiceSchema)
+def new_workspace(
+    request: HttpRequest, payload: WorkspaceCreateSchema
+) -> WorkspaceChoiceSchema:
+    """Create a workspace owned by the person and switch to it."""
+    try:
+        workspace = create_workspace_for(request.user, payload.name)
+    except WorkspaceCreationRefused as error:
+        raise HttpError(403, str(error)) from error
+    except WorkspaceCreationError as error:
+        raise HttpError(400, str(error)) from error
+    membership = select_workspace(request, workspace.pk)
+    assert membership is not None
+    return serialize_choice(membership, workspace.pk)
+
+
+@router.post("/workspaces/current", response=WorkspaceChoiceSchema)
+def choose_workspace(
+    request: HttpRequest, payload: WorkspaceSelectSchema
+) -> WorkspaceChoiceSchema:
+    """Work in another workspace for the rest of this session."""
+    membership = select_workspace(request, payload.workspace_id)
+    if membership is None:
+        raise HttpError(404, "Not found")
+    return serialize_choice(membership, membership.workspace_id)
+
+
+@router.get("/invites/pending", response=PendingInviteSchema | None)
+def show_pending_invite(request: HttpRequest) -> PendingInviteSchema | None:
+    """The invite this browser opened, for the person to confirm or dismiss."""
+    invite = pending_invite(request)
+    if invite is None:
+        return None
+    if find_membership(invite.workspace_id, request.user.pk):
+        # Nothing to confirm: they already belong.
+        forget_invite(request)
+        return None
+    inviter = invite.created_by
+    return PendingInviteSchema(
+        workspace_name=invite.workspace.name,
+        role=invite.role,
+        invited_by=(inviter.email or inviter.get_username()) if inviter else None,
+    )
+
+
+@router.post("/invites/pending/accept", response=WorkspaceChoiceSchema)
+def accept_pending_invite(request: HttpRequest) -> WorkspaceChoiceSchema:
+    """Join the invite's workspace and switch to it."""
+    try:
+        membership = join_pending_invite(request)
+    except InviteError as error:
+        raise HttpError(409, str(error)) from error
+    select_workspace(request, membership.workspace_id)
+    return serialize_choice(membership, membership.workspace_id)
+
+
+@router.post("/invites/pending/dismiss", response={204: None})
+def dismiss_pending_invite(request: HttpRequest) -> Status[None]:
+    forget_invite(request)
+    return Status(204, None)
+
+
+@router.get("/invites", response=list[InviteSchema])
+def invites(request: HttpRequest) -> list[InviteSchema]:
+    """Invites in the current workspace that can still be accepted."""
+    workspace = require(request, Action.INVITE_PEOPLE)
+    queryset = pending_invites(workspace)
+    return [serialize_invite(invite) for invite in queryset]
+
+
+@router.post("/invites", response=NewInviteSchema)
+def invite_person(request: HttpRequest, payload: InviteCreateSchema) -> NewInviteSchema:
+    workspace = require(request, Action.INVITE_PEOPLE)
+    new = create_invite(workspace, payload.role, request.user, payload.note.strip())
+    return NewInviteSchema(
+        **serialize_invite(new.invite).model_dump(),
+        link=request.build_absolute_uri(invite_path(new.token)),
+    )
+
+
+@router.delete("/invites/{invite_id}", response={204: None})
+def cancel_invite(request: HttpRequest, invite_id: int) -> Status[None]:
+    workspace = require(request, Action.INVITE_PEOPLE)
+    revoke_invite(get_object_or_404(pending_invites(workspace), pk=invite_id))
+    return Status(204, None)
+
+
+def membership_for_request(
+    request: HttpRequest, membership_id: int
+) -> WorkspaceMembership:
+    workspace = require(request, Action.MANAGE_MEMBERS)
+    return get_object_or_404(workspace_members(workspace), pk=membership_id)
+
+
+@router.get("/members", response=list[MemberSchema])
+def members(request: HttpRequest) -> list[MemberSchema]:
+    """Everyone in the current workspace. Any member can see who belongs."""
+    workspace = current_workspace(request)
+    if workspace is None:
+        return []
+    return [serialize_member(request, item) for item in members_in_order(workspace)]
+
+
+@router.post("/members/{membership_id}/role", response=MemberSchema)
+def set_member_role(
+    request: HttpRequest, membership_id: int, payload: RoleChangeSchema
+) -> MemberSchema:
+    membership = membership_for_request(request, membership_id)
+    try:
+        change_role(membership, payload.role)
+    except MembershipError as error:
+        raise HttpError(409, str(error)) from error
+    return serialize_member(request, membership)
+
+
+@router.delete("/members/{membership_id}", response={204: None})
+def remove_person(request: HttpRequest, membership_id: int) -> Status[None]:
+    membership = membership_for_request(request, membership_id)
+    try:
+        remove_member(membership)
+    except MembershipError as error:
+        raise HttpError(409, str(error)) from error
+    return Status(204, None)
+
+
+# API tokens belong to the person and are managed from their account. Each
+# works in one workspace, chosen when it is created. These endpoints accept
+# only a signed-in browser session, so a token cannot create or extend another.
+
+
+@router.get("/account/api-tokens", response=ApiTokenListSchema)
+def api_tokens(request: HttpRequest) -> ApiTokenListSchema:
+    current = current_workspace(request)
+    current_id = current.pk if current else None
+    return ApiTokenListSchema(
+        items=[serialize_api_token(token) for token in own_tokens(request.user)],
+        workspaces=[
+            serialize_token_workspace(membership, current_id)
+            for membership in user_memberships(request)
+        ],
+        max_days=settings.API_TOKEN_MAX_DAYS,
+    )
+
+
+@router.post("/account/api-tokens", response=NewApiTokenSchema)
+def new_api_token(
+    request: HttpRequest, payload: ApiTokenCreateSchema
+) -> NewApiTokenSchema:
+    membership = get_object_or_404(
+        user_memberships(request), workspace_id=payload.workspace_id
+    )
+    try:
+        new = create_api_token(
+            membership, payload.name.strip(), payload.scope, payload.expires_in_days
+        )
+    except TokenError as error:
+        raise HttpError(422, str(error)) from error
+    return NewApiTokenSchema(
+        **serialize_api_token(new.token).model_dump(), token=new.secret
+    )
+
+
+@router.delete("/account/api-tokens/{token_id}", response={204: None})
+def revoke_token(request: HttpRequest, token_id: int) -> Status[None]:
+    revoke_api_token(get_object_or_404(own_tokens(request.user), pk=token_id))
+    return Status(204, None)

secondshift/workspaces/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class WorkspacesConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "secondshift.workspaces"

secondshift/workspaces/context_processors.py

@@ -0,0 +1,11 @@
+from django.http import HttpRequest
+
+from secondshift.workspaces.invites import pending_invite
+from secondshift.workspaces.models import WorkspaceInvite
+
+
+def invite(request: HttpRequest) -> dict[str, WorkspaceInvite | None]:
+    """The invite this browser opened, so sign-in pages can name it."""
+    if not hasattr(request, "session"):
+        return {"pending_invite": None}
+    return {"pending_invite": pending_invite(request)}

secondshift/workspaces/dao.py

@@ -0,0 +1,281 @@
+"""Queries and writes on people, workspaces, memberships, invites and API tokens."""
+
+from datetime import datetime
+from typing import Any
+
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import AbstractBaseUser
+from django.db import transaction
+from django.db.models import F, Q, QuerySet
+from django.utils import timezone
+
+from secondshift.workspaces.models import (
+    ApiToken,
+    Workspace,
+    WorkspaceInvite,
+    WorkspaceMembership,
+)
+
+Role = WorkspaceMembership.Role
+
+
+# People
+
+
+def active_user(user_id: object) -> AbstractBaseUser | None:
+    """The active account with this id, if there is one."""
+    return get_user_model().objects.filter(pk=user_id, is_active=True).first()
+
+
+def get_or_create_user(
+    username: str, defaults: dict[str, Any]
+) -> tuple[AbstractBaseUser, bool]:
+    return get_user_model().objects.get_or_create(username=username, defaults=defaults)
+
+
+# Workspaces
+
+
+@transaction.atomic
+def create_workspace(name: str, slug: str, owner: AbstractBaseUser) -> Workspace:
+    """A new workspace, with this person as its owner."""
+    workspace = Workspace.objects.create(name=name, slug=slug)
+    WorkspaceMembership.objects.create(workspace=workspace, user=owner, role=Role.OWNER)
+    return workspace
+
+
+def get_or_create_workspace(slug: str, name: str) -> Workspace:
+    workspace, _ = Workspace.objects.get_or_create(slug=slug, defaults={"name": name})
+    return workspace
+
+
+def get_workspace_by_slug(slug: str) -> Workspace:
+    """The workspace. Raises Workspace.DoesNotExist when there is none."""
+    return Workspace.objects.get(slug=slug)
+
+
+def find_workspace_by_slug(slug: str) -> Workspace | None:
+    return Workspace.objects.filter(slug=slug).first()
+
+
+def slug_taken(slug: str) -> bool:
+    return Workspace.objects.filter(slug=slug).exists()
+
+
+# Memberships
+
+
+def workspace_has_owner(workspace_id: int) -> bool:
+    return WorkspaceMembership.objects.filter(
+        workspace_id=workspace_id, role=Role.OWNER
+    ).exists()
+
+
+def workspace_slug_has_owner(slug: str) -> bool:
+    return WorkspaceMembership.objects.filter(
+        workspace__slug=slug, role=Role.OWNER
+    ).exists()
+
+
+def workspace_owner(workspace: Workspace) -> AbstractBaseUser:
+    """The workspace's first owner. Raises when it has none."""
+    return (
+        WorkspaceMembership.objects.select_related("user")
+        .filter(workspace=workspace, role=Role.OWNER)
+        .earliest("created_at", "pk")
+        .user
+    )
+
+
+def is_owner(workspace_id: int, user_id: int) -> bool:
+    return WorkspaceMembership.objects.filter(
+        workspace_id=workspace_id, user_id=user_id, role=Role.OWNER
+    ).exists()
+
+
+def find_membership(workspace_id: int, user_id: int) -> WorkspaceMembership | None:
+    return WorkspaceMembership.objects.filter(
+        workspace_id=workspace_id, user_id=user_id
+    ).first()
+
+
+def active_member_role(workspace_id: int, user_id: int | None) -> str | None:
+    """The person's role in the workspace while their account is active."""
+    return (
+        WorkspaceMembership.objects.filter(
+            workspace_id=workspace_id, user_id=user_id, user__is_active=True
+        )
+        .values_list("role", flat=True)
+        .first()
+    )
+
+
+def membership_in(user_id: int, workspace_id: int) -> WorkspaceMembership | None:
+    return memberships_for_user(user_id).filter(workspace_id=workspace_id).first()
+
+
+def first_membership(user_id: int) -> WorkspaceMembership | None:
+    return memberships_for_user(user_id).first()
+
+
+def memberships_for_user(user_id: int) -> QuerySet[WorkspaceMembership]:
+    """The person's memberships with their workspaces, the first one joined first."""
+    return (
+        WorkspaceMembership.objects.filter(user_id=user_id)
+        .select_related("workspace")
+        .order_by("created_at", "pk")
+    )
+
+
+def workspace_members(workspace: Workspace) -> QuerySet[WorkspaceMembership]:
+    """The workspace's memberships with their people, in the order they joined."""
+    return (
+        WorkspaceMembership.objects.filter(workspace=workspace)
+        .select_related("user")
+        .order_by("created_at", "pk")
+    )
+
+
+def create_membership(
+    workspace_id: int, user: AbstractBaseUser, role: str
+) -> WorkspaceMembership:
+    return WorkspaceMembership.objects.create(
+        workspace_id=workspace_id, user=user, role=role
+    )
+
+
+def ensure_membership(
+    workspace: Workspace, user: AbstractBaseUser, role: str
+) -> WorkspaceMembership:
+    """The person's membership, created with this role when missing."""
+    membership, _ = WorkspaceMembership.objects.get_or_create(
+        workspace=workspace, user=user, defaults={"role": role}
+    )
+    return membership
+
+
+def owned_workspace_count(user: AbstractBaseUser) -> int:
+    return WorkspaceMembership.objects.filter(user=user, role=Role.OWNER).count()
+
+
+def lock_other_owners_exist(membership: WorkspaceMembership) -> bool:
+    """Lock the workspace's other owners and say whether there are any."""
+    return (
+        WorkspaceMembership.objects.select_for_update()
+        .filter(workspace_id=membership.workspace_id, role=Role.OWNER)
+        .exclude(pk=membership.pk)
+        .exists()
+    )
+
+
+# Invites
+
+
+def usable_invites() -> QuerySet[WorkspaceInvite]:
+    """Invites that were not accepted, revoked or left to expire."""
+    return WorkspaceInvite.objects.filter(
+        accepted_at__isnull=True,
+        revoked_at__isnull=True,
+        expires_at__gt=timezone.now(),
+    )
+
+
+def pending_invites(workspace: Workspace) -> QuerySet[WorkspaceInvite]:
+    """Invites that can still be accepted, with who sent them."""
+    return usable_invites().filter(workspace=workspace).select_related("created_by")
+
+
+def find_usable_invite(token_hash: str) -> WorkspaceInvite | None:
+    """The usable invite with this hash, with its workspace and inviter."""
+    return (
+        usable_invites()
+        .select_related("workspace", "created_by")
+        .filter(token_hash=token_hash)
+        .first()
+    )
+
+
+def lock_usable_invite(token_hash: str) -> WorkspaceInvite | None:
+    """Lock the usable invite with this hash for this transaction."""
+    return usable_invites().select_for_update().filter(token_hash=token_hash).first()
+
+
+def create_invite_record(
+    workspace: Workspace,
+    role: str,
+    note: str,
+    token_hash: str,
+    created_by: AbstractBaseUser | None,
+    expires_at: datetime,
+) -> WorkspaceInvite:
+    return WorkspaceInvite.objects.create(
+        workspace=workspace,
+        role=role,
+        note=note,
+        token_hash=token_hash,
+        created_by=created_by,
+        expires_at=expires_at,
+    )
+
+
+# API tokens
+
+
+def usable_tokens() -> QuerySet[ApiToken]:
+    """Tokens that were not revoked and have not expired."""
+    return ApiToken.objects.filter(
+        revoked_at__isnull=True, expires_at__gt=timezone.now()
+    )
+
+
+def has_own_token(user: AbstractBaseUser, workspace: Workspace) -> bool:
+    return own_tokens(user).filter(workspace=workspace).exists()
+
+
+def own_tokens(user: AbstractBaseUser) -> QuerySet[ApiToken]:
+    """The person's usable tokens, in workspaces they still belong to."""
+    return (
+        usable_tokens()
+        .filter(
+            created_by_id=user.pk,
+            created_by__workspace_memberships__workspace_id=F("workspace_id"),
+        )
+        .select_related("workspace")
+    )
+
+
+def api_token_by_hash(token_hash: str) -> ApiToken | None:
+    """The usable token with this hash, while its creator is an active member."""
+    return (
+        usable_tokens()
+        .filter(
+            token_hash=token_hash,
+            created_by__is_active=True,
+            created_by__workspace_memberships__workspace_id=F("workspace_id"),
+        )
+        .select_related("created_by", "workspace")
+        .first()
+    )
+
+
+def create_token_record(
+    membership: WorkspaceMembership,
+    name: str,
+    scope: str,
+    token_hash: str,
+    expires_at: datetime,
+) -> ApiToken:
+    return ApiToken.objects.create(
+        workspace_id=membership.workspace_id,
+        created_by_id=membership.user_id,
+        name=name,
+        scope=scope,
+        token_hash=token_hash,
+        expires_at=expires_at,
+    )
+
+
+def touch_token(token: ApiToken, now: datetime, stale_before: datetime) -> None:
+    """Set the token's last use, unless it was already set after `stale_before`."""
+    stale = Q(last_used_at__isnull=True) | Q(last_used_at__lt=stale_before)
+    ApiToken.objects.filter(stale, pk=token.pk).update(last_used_at=now)