secondshift 0.1.0b12__py3-none-any.whl

secondshift/workspaces/invites.py

@@ -0,0 +1,150 @@
+"""One-time links that let someone join a workspace with a role.
+
+An owner creates an invite and shares its link. The token appears only in
+that link. The database keeps a hash of it. A link works once, until it
+expires or an owner revokes it. Joining always needs the person to confirm
+while signed in, so opening a link alone never adds anyone to a workspace.
+"""
+
+import hashlib
+import secrets
+from dataclasses import dataclass
+from datetime import timedelta
+
+from django.contrib.auth.models import AbstractBaseUser
+from django.db import transaction
+from django.http import HttpRequest
+from django.urls import reverse
+from django.utils import timezone
+
+from secondshift.workspaces.dao import (
+    create_invite_record,
+    create_membership,
+    find_membership,
+    find_usable_invite,
+    get_or_create_workspace,
+    lock_usable_invite,
+    workspace_has_owner,
+)
+from secondshift.workspaces.models import (
+    Workspace,
+    WorkspaceInvite,
+    WorkspaceMembership,
+)
+
+INVITE_LIFETIME = timedelta(days=7)
+# An opened invite link waits in the session under this key until the person
+# confirms or dismisses it.
+PENDING_INVITE_SESSION_KEY = "secondshift.invite"
+INVITE_UNUSABLE_MESSAGE = (
+    "This invitation has expired or was already used. "
+    "Ask a workspace owner for a new one."
+)
+
+
+class InviteError(Exception):
+    pass
+
+
+class WorkspaceTaken(Exception):
+    pass
+
+
+@dataclass(frozen=True)
+class NewInvite:
+    invite: WorkspaceInvite
+    # Only here, right after creating it. It is never stored.
+    token: str
+
+
+def token_hash(token: str) -> str:
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+def invite_path(token: str) -> str:
+    return reverse("invite", args=[token])
+
+
+def create_invite(
+    workspace: Workspace,
+    role: str,
+    created_by: AbstractBaseUser | None,
+    note: str = "",
+) -> NewInvite:
+    token = secrets.token_urlsafe(32)
+    invite = create_invite_record(
+        workspace,
+        WorkspaceMembership.Role(role),
+        note,
+        token_hash(token),
+        created_by,
+        timezone.now() + INVITE_LIFETIME,
+    )
+    return NewInvite(invite, token)
+
+
+def find_invite(token: str) -> WorkspaceInvite | None:
+    """The invite for a token while it can still be accepted."""
+    return find_usable_invite(token_hash(token))
+
+
+@transaction.atomic
+def accept_invite(token: str, user: AbstractBaseUser) -> WorkspaceMembership:
+    """Add the person to the invite's workspace and use the invite up.
+
+    Someone who already belongs keeps their role, and the link stays unused.
+    """
+    invite = lock_usable_invite(token_hash(token))
+    if invite is None:
+        raise InviteError(INVITE_UNUSABLE_MESSAGE)
+    existing = find_membership(invite.workspace_id, user.pk)
+    if existing:
+        return existing
+    membership = create_membership(invite.workspace_id, user, invite.role)
+    invite.accepted_by = user
+    invite.accepted_at = timezone.now()
+    invite.save(update_fields=["accepted_by", "accepted_at"])
+    return membership
+
+
+def revoke_invite(invite: WorkspaceInvite) -> None:
+    invite.revoked_at = timezone.now()
+    invite.save(update_fields=["revoked_at"])
+
+
+def remember_invite(request: HttpRequest, token: str) -> None:
+    request.session[PENDING_INVITE_SESSION_KEY] = token
+
+
+def pending_invite(request: HttpRequest) -> WorkspaceInvite | None:
+    """The invite this browser opened, while it can still be accepted."""
+    token = request.session.get(PENDING_INVITE_SESSION_KEY)
+    return find_invite(token) if token else None
+
+
+def forget_invite(request: HttpRequest) -> None:
+    request.session.pop(PENDING_INVITE_SESSION_KEY, None)
+
+
+def join_pending_invite(request: HttpRequest) -> WorkspaceMembership:
+    """Accept the invite waiting in the session, for the signed-in person."""
+    token = request.session.get(PENDING_INVITE_SESSION_KEY)
+    forget_invite(request)
+    if not token:
+        raise InviteError(INVITE_UNUSABLE_MESSAGE)
+    return accept_invite(token, request.user)
+
+
+@transaction.atomic
+def invite_first_owner(name: str, slug: str) -> NewInvite:
+    """An owner invite for a new workspace, or one that has no owner yet.
+
+    This is how a server gets its first owner without any account existing.
+    """
+    workspace = get_or_create_workspace(slug, name)
+    if workspace_has_owner(workspace.pk):
+        raise WorkspaceTaken(
+            f"{workspace.name} already has an owner. Owners invite people "
+            "from the Settings page."
+        )
+    return create_invite(workspace, WorkspaceMembership.Role.OWNER, None)

secondshift/workspaces/limits.py

@@ -0,0 +1,197 @@
+"""Run limits: how far one run may go.
+
+Each limit has a server default and a server maximum, both set through
+environment variables. A workspace owner can choose a value for the workspace
+and for each job, up to the maximum. A job's value wins over the workspace's,
+and the workspace's wins over the default. Repository configuration cannot set
+limits.
+
+The values that apply are frozen into the run's execution plan when the run is
+created. Changing a limit never affects a run that is already queued or running.
+"""
+
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from enum import StrEnum
+
+from django.conf import settings
+
+from secondshift.workspaces.models import RunLimitOverrides, Workspace
+
+
+class RunLimit(StrEnum):
+    MAX_TURNS = "max_turns"
+    MAX_TOOL_CALLS = "max_tool_calls"
+    TOKEN_BUDGET = "token_budget"
+    TIMEOUT_SECONDS = "timeout_seconds"
+
+
+class LimitUnit(StrEnum):
+    COUNT = "count"
+    TOKENS = "tokens"
+    SECONDS = "seconds"
+
+
+@dataclass(frozen=True)
+class LimitSpec:
+    label: str
+    help: str
+    unit: LimitUnit
+    # The Django setting for the default. Its maximum adds "_CEILING".
+    setting: str
+    minimum: int
+
+    @property
+    def env(self) -> str:
+        return f"SECONDSHIFT_{self.setting}"
+
+    @property
+    def ceiling_env(self) -> str:
+        return f"{self.env}_CEILING"
+
+    def default(self) -> int:
+        return int(getattr(settings, self.setting))
+
+    def ceiling(self) -> int:
+        return int(getattr(settings, f"{self.setting}_CEILING"))
+
+
+LIMIT_SPECS = {
+    RunLimit.MAX_TURNS: LimitSpec(
+        "Model calls",
+        "Shown on runs as turns, e.g. 5/24. The last one writes the report.",
+        LimitUnit.COUNT,
+        "AGENT_MAX_TURNS",
+        minimum=1,
+    ),
+    RunLimit.MAX_TOOL_CALLS: LimitSpec(
+        "Tool calls",
+        "Reading files, searching, running commands and calling connected services.",
+        LimitUnit.COUNT,
+        "AGENT_MAX_TOOL_CALLS",
+        minimum=0,
+    ),
+    RunLimit.TOKEN_BUDGET: LimitSpec(
+        "Tokens",
+        "Input and output tokens. Cached input counts as a tenth. Model calls past this are refused.",
+        LimitUnit.TOKENS,
+        "MODEL_RUN_TOKEN_BUDGET",
+        minimum=1_000,
+    ),
+    RunLimit.TIMEOUT_SECONDS: LimitSpec(
+        "Time",
+        "Counted from when the run starts. Waiting to start does not count.",
+        LimitUnit.SECONDS,
+        "RUN_TIMEOUT_SECONDS",
+        minimum=60,
+    ),
+}
+
+
+class LimitError(ValueError):
+    def __init__(self, message: str, ceiling_env: str = "") -> None:
+        super().__init__(message)
+        # The variable that raises the maximum, for people who run the server.
+        self.ceiling_env = ceiling_env
+
+
+@dataclass(frozen=True)
+class LimitView:
+    """One limit as an owner sees it at one level (workspace or job)."""
+
+    key: str
+    label: str
+    help: str
+    unit: str
+    # What a run would get now.
+    value: int
+    # What this level chose, or None to use `inherited`.
+    override: int | None
+    # What applies when this level chooses nothing.
+    inherited: int
+    minimum: int
+    maximum: int
+
+
+def server_default(limit: RunLimit) -> int:
+    # Settings refuse a maximum below its default, so no cap is needed.
+    return LIMIT_SPECS[limit].default()
+
+
+def capped(limit: RunLimit, value: int) -> int:
+    # A maximum lowered after an owner chose a value still applies.
+    return min(value, LIMIT_SPECS[limit].ceiling())
+
+
+def workspace_value(workspace: Workspace, limit: RunLimit) -> int:
+    chosen = getattr(workspace, limit)
+    return capped(limit, chosen) if chosen is not None else server_default(limit)
+
+
+def workspace_limits(workspace: Workspace) -> dict[str, int]:
+    """The limits a run gets from the workspace alone, for its execution plan."""
+    return {str(limit): workspace_value(workspace, limit) for limit in RunLimit}
+
+
+def limit_views(
+    overrides: RunLimitOverrides, inherited: Callable[[RunLimit], int]
+) -> list[LimitView]:
+    """Each limit at one level: what it chose, and what applies without a choice."""
+    views: list[LimitView] = []
+    for limit, spec in LIMIT_SPECS.items():
+        override = getattr(overrides, limit)
+        fallback = inherited(limit)
+        views.append(
+            LimitView(
+                key=str(limit),
+                label=spec.label,
+                help=spec.help,
+                unit=str(spec.unit),
+                value=capped(limit, override) if override is not None else fallback,
+                override=override,
+                inherited=fallback,
+                minimum=spec.minimum,
+                maximum=spec.ceiling(),
+            )
+        )
+    return views
+
+
+def workspace_limit_views(workspace: Workspace) -> list[LimitView]:
+    return limit_views(workspace, server_default)
+
+
+def validate_overrides(values: Mapping[str, int | None]) -> dict[str, int | None]:
+    """Check owner input against the server bounds. Unknown keys are refused."""
+    unknown = set(values) - {str(limit) for limit in RunLimit}
+    if unknown:
+        raise LimitError(f"Unknown limit: {', '.join(sorted(unknown))}.")
+    checked: dict[str, int | None] = {}
+    for key, value in values.items():
+        spec = LIMIT_SPECS[RunLimit(key)]
+        if value is not None and not spec.minimum <= value <= spec.ceiling():
+            raise LimitError(
+                f"{spec.label} must be between {spec.minimum:,} and "
+                f"{spec.ceiling():,}.",
+                ceiling_env=spec.ceiling_env,
+            )
+        checked[key] = value
+    return checked
+
+
+def save_overrides(target: RunLimitOverrides, values: Mapping[str, int | None]) -> None:
+    checked = validate_overrides(values)
+    for key, value in checked.items():
+        setattr(target, key, value)
+    target.save(update_fields=[*checked, "updated_at"])
+
+
+def raise_hint(limit: RunLimit, value: int) -> str:
+    """How to allow more than `value`, for messages about a stopped run.
+
+    The message is stored with the run and shown to every member, so it does
+    not name the server variable. Only staff can set it.
+    """
+    if value < LIMIT_SPECS[limit].ceiling():
+        return "Raise it in the job's limits."
+    return "That is the server maximum. Whoever runs this server can raise it."

secondshift/workspaces/management/commands/create_workspace.py

@@ -0,0 +1,39 @@
+import djclick as click
+from django.conf import settings
+from django.utils.text import slugify
+
+from secondshift.workspaces.invites import (
+    INVITE_LIFETIME,
+    WorkspaceTaken,
+    invite_first_owner,
+    invite_path,
+)
+
+
+@click.command()
+@click.argument("name")
+@click.option("--slug", help="Short name used in the database. From NAME by default.")
+@click.option(
+    "--url",
+    default=settings.FRONTEND_URL,
+    show_default=True,
+    help="Where people open SecondShift.",
+)
+def command(name: str, slug: str | None, url: str) -> None:
+    """Create a workspace and print a link that makes its first owner.
+
+    Run it again for a workspace whose link expired before anyone used it.
+    """
+    slug = slug or slugify(name)
+    if not slug:
+        raise click.ClickException("Choose a --slug with letters or numbers.")
+    try:
+        new = invite_first_owner(name, slug)
+    except WorkspaceTaken as error:
+        raise click.ClickException(str(error)) from error
+    click.echo(f"Workspace {new.invite.workspace.name} ({slug}) is ready.")
+    click.echo(
+        f"Open this link to sign in or sign up as its owner. "
+        f"It works once, within {INVITE_LIFETIME.days} days:"
+    )
+    click.echo(f"  {url.rstrip('/')}{invite_path(new.token)}")

secondshift/workspaces/migrations/0001_initial.py

@@ -0,0 +1,67 @@
+# Generated by Django 6.0.9 on 2026-10-26 14:22
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Workspace',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('max_turns', models.PositiveIntegerField(blank=True, null=True)),
+                ('max_tool_calls', models.PositiveIntegerField(blank=True, null=True)),
+                ('token_budget', models.PositiveBigIntegerField(blank=True, null=True)),
+                ('timeout_seconds', models.PositiveIntegerField(blank=True, null=True)),
+                ('name', models.CharField(max_length=160)),
+                ('slug', models.SlugField(unique=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                'ordering': ['name'],
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='WorkspaceInvite',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('role', models.CharField(choices=[('owner', 'Owner'), ('admin', 'Admin'), ('member', 'Member')], default='member', max_length=16)),
+                ('note', models.CharField(blank=True, max_length=160)),
+                ('token_hash', models.CharField(max_length=64, unique=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('expires_at', models.DateTimeField()),
+                ('accepted_at', models.DateTimeField(blank=True, null=True)),
+                ('revoked_at', models.DateTimeField(blank=True, null=True)),
+                ('accepted_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('created_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invites', to='workspaces.workspace')),
+            ],
+            options={
+                'ordering': ['-created_at', '-pk'],
+            },
+        ),
+        migrations.CreateModel(
+            name='WorkspaceMembership',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('role', models.CharField(choices=[('owner', 'Owner'), ('admin', 'Admin'), ('member', 'Member')], default='member', max_length=16)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='workspace_memberships', to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='memberships', to='workspaces.workspace')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('workspace', 'user'), name='unique_workspace_membership')],
+            },
+        ),
+    ]

secondshift/workspaces/migrations/0002_api_token.py

@@ -0,0 +1,34 @@
+# Generated by Django 6.0.9 on 2026-10-29 07:44
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('workspaces', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ApiToken',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=160)),
+                ('scope', models.CharField(choices=[('read', 'Read'), ('run', 'Read and run')], default='read', max_length=16)),
+                ('token_hash', models.CharField(max_length=64, unique=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('expires_at', models.DateTimeField()),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('revoked_at', models.DateTimeField(blank=True, null=True)),
+                ('created_by', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_tokens', to=settings.AUTH_USER_MODEL)),
+                ('workspace', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_tokens', to='workspaces.workspace')),
+            ],
+            options={
+                'ordering': ['-created_at', '-pk'],
+            },
+        ),
+    ]

secondshift/workspaces/migrations/0003_execution_default.py

@@ -0,0 +1,29 @@
+# Generated by Django 6.0.9 on 2026-11-03 14:14
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('connections', '0005_agentconnection'),
+        ('workspaces', '0002_api_token'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='workspace',
+            name='default_agent_connection',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.RESTRICT, related_name='default_workspaces', to='connections.agentconnection'),
+        ),
+        migrations.AddField(
+            model_name='workspace',
+            name='default_model_connection',
+            field=models.ForeignKey(blank=True, limit_choices_to={'kind': 'model'}, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='default_workspaces', to='connections.connection'),
+        ),
+        migrations.AddConstraint(
+            model_name='workspace',
+            constraint=models.CheckConstraint(condition=models.Q(('default_model_connection__isnull', True), ('default_agent_connection__isnull', True), _connector='OR'), name='workspace_one_execution_default'),
+        ),
+    ]

secondshift/workspaces/migrations/0004_copy_default_model_key.py

@@ -0,0 +1,26 @@
+# Generated by Django 6.0.9 on 2026-11-03 14:14
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def copy_default_model_key(apps: Apps, schema_editor: BaseDatabaseSchemaEditor) -> None:
+    """Released installs marked their default model key on the key itself."""
+    Connection = apps.get_model("connections", "Connection")
+    Workspace = apps.get_model("workspaces", "Workspace")
+    for connection in Connection.objects.filter(is_default=True):
+        Workspace.objects.filter(pk=connection.workspace_id).update(
+            default_model_connection=connection
+        )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('workspaces', '0003_execution_default'),
+    ]
+
+    operations = [
+        migrations.RunPython(copy_default_model_key, migrations.RunPython.noop),
+    ]