secondshift 0.1.0b12__py3-none-any.whl

secondshift/workspaces/models.py

@@ -0,0 +1,169 @@
+from django.conf import settings
+from django.db import models
+
+
+class RunLimitOverrides(models.Model):
+    """Run limits an owner chose. Empty means the next level up decides.
+
+    A job falls back to its workspace, and a workspace to the server defaults.
+    The server maximums cap every value (see secondshift.workspaces.limits).
+    """
+
+    max_turns = models.PositiveIntegerField(null=True, blank=True)
+    max_tool_calls = models.PositiveIntegerField(null=True, blank=True)
+    token_budget = models.PositiveBigIntegerField(null=True, blank=True)
+    timeout_seconds = models.PositiveIntegerField(null=True, blank=True)
+
+    class Meta:
+        abstract = True
+
+
+class Workspace(RunLimitOverrides):
+    """Who belongs and with which role is kept in WorkspaceMembership only."""
+
+    # What runs the jobs: one model key or one subscription login, never both.
+    # Neither set means nothing is chosen and runs cannot start.
+    default_model_connection = models.ForeignKey(
+        "connections.Connection",
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        limit_choices_to={"kind": "model"},
+        related_name="default_workspaces",
+    )
+    default_agent_connection = models.ForeignKey(
+        "connections.AgentConnection",
+        on_delete=models.RESTRICT,
+        null=True,
+        blank=True,
+        related_name="default_workspaces",
+    )
+    name = models.CharField(max_length=160)
+    slug = models.SlugField(unique=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta(RunLimitOverrides.Meta):
+        ordering = ["name"]
+        constraints = [
+            models.CheckConstraint(
+                condition=models.Q(default_model_connection__isnull=True)
+                | models.Q(default_agent_connection__isnull=True),
+                name="workspace_one_execution_default",
+            )
+        ]
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class WorkspaceMembership(models.Model):
+    class Role(models.TextChoices):
+        OWNER = "owner", "Owner"
+        ADMIN = "admin", "Admin"
+        MEMBER = "member", "Member"
+
+    workspace = models.ForeignKey(
+        Workspace,
+        on_delete=models.CASCADE,
+        related_name="memberships",
+    )
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="workspace_memberships",
+    )
+    role = models.CharField(max_length=16, choices=Role.choices, default=Role.MEMBER)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["workspace", "user"],
+                name="unique_workspace_membership",
+            )
+        ]
+
+    def __str__(self) -> str:
+        return f"{self.user} in {self.workspace}"
+
+
+class WorkspaceInvite(models.Model):
+    """A one-time link that lets someone join a workspace with a role.
+
+    Only a hash of the link's token is stored, so the database alone cannot
+    be used to join. See secondshift.workspaces.invites.
+    """
+
+    workspace = models.ForeignKey(
+        Workspace,
+        on_delete=models.CASCADE,
+        related_name="invites",
+    )
+    role = models.CharField(
+        max_length=16,
+        choices=WorkspaceMembership.Role.choices,
+        default=WorkspaceMembership.Role.MEMBER,
+    )
+    # Who the link is for, so owners can tell pending invites apart.
+    note = models.CharField(max_length=160, blank=True)
+    token_hash = models.CharField(max_length=64, unique=True)
+    created_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="+",
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField()
+    accepted_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+        related_name="+",
+    )
+    accepted_at = models.DateTimeField(null=True, blank=True)
+    revoked_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ["-created_at", "-pk"]
+
+    def __str__(self) -> str:
+        return f"{self.get_role_display()} invite to {self.workspace}"
+
+
+class ApiToken(models.Model):
+    """A bearer token for the MCP server, for one person in one workspace.
+
+    Only a hash of the token is stored. See secondshift.workspaces.tokens.
+    """
+
+    class Scope(models.TextChoices):
+        READ = "read", "Read"
+        RUN = "run", "Read and run"
+
+    workspace = models.ForeignKey(
+        Workspace,
+        on_delete=models.CASCADE,
+        related_name="api_tokens",
+    )
+    created_by = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="api_tokens",
+    )
+    name = models.CharField(max_length=160)
+    scope = models.CharField(max_length=16, choices=Scope.choices, default=Scope.READ)
+    token_hash = models.CharField(max_length=64, unique=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField()
+    last_used_at = models.DateTimeField(null=True, blank=True)
+    revoked_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ["-created_at", "-pk"]
+
+    def __str__(self) -> str:
+        return f"{self.name} ({self.get_scope_display()})"

secondshift/workspaces/owners.py

@@ -0,0 +1,58 @@
+"""The first account on a single-host install and the workspace it owns."""
+
+from django.contrib.auth.models import AbstractUser
+
+from secondshift.workspaces.dao import (
+    create_workspace,
+    ensure_membership,
+    find_workspace_by_slug,
+    get_or_create_user,
+    get_workspace_by_slug,
+    workspace_owner,
+    workspace_slug_has_owner,
+)
+from secondshift.workspaces.models import Workspace, WorkspaceMembership
+
+WORKSPACE_SLUG = "secondshift"
+WORKSPACE_NAME = "SecondShift"
+# The owner's username when `secondshift up` creates it without asking.
+LOCAL_OWNER_USERNAME = "owner"
+
+
+def has_owner() -> bool:
+    return workspace_slug_has_owner(WORKSPACE_SLUG)
+
+
+def get_owner() -> AbstractUser:
+    return workspace_owner(get_workspace_by_slug(WORKSPACE_SLUG))  # type: ignore[return-value]
+
+
+def ensure_owner(email: str = "", password: str | None = None) -> Workspace:
+    """Create the owner and the workspace when they do not exist yet.
+
+    Without a password the owner can only sign in with a link from
+    `secondshift up` or `secondshift login`.
+    """
+    user, created = get_or_create_user(
+        email or LOCAL_OWNER_USERNAME,
+        {"email": email, "is_staff": True, "is_superuser": True},
+    )
+    if created:
+        if password:
+            user.set_password(password)
+        else:
+            user.set_unusable_password()
+        user.save()
+    workspace = find_workspace_by_slug(WORKSPACE_SLUG)
+    if workspace is None:
+        return create_workspace(WORKSPACE_NAME, WORKSPACE_SLUG, user)
+    ensure_membership(workspace, user, WorkspaceMembership.Role.OWNER)
+    return workspace
+
+
+def set_owner_credentials(email: str, password: str) -> None:
+    """Let the owner sign in with an email and password too."""
+    user = get_owner()
+    user.email = email
+    user.set_password(password)
+    user.save()

secondshift/workspaces/schemas.py

@@ -0,0 +1,149 @@
+from datetime import datetime
+from typing import Literal
+
+from ninja import Schema
+from pydantic import Field
+
+
+class LimitSchema(Schema):
+    key: str
+    label: str
+    help: str
+    unit: str
+    value: int
+    override: int | None
+    inherited: int
+    minimum: int
+    maximum: int
+
+
+class RunLimitsUpdateSchema(Schema):
+    """Fields left out stay as they are. Null uses the inherited value."""
+
+    max_turns: int | None = None
+    max_tool_calls: int | None = None
+    token_budget: int | None = None
+    timeout_seconds: int | None = None
+
+
+class SettingValueSchema(Schema):
+    label: str
+    value: str
+    env: str
+    help: str
+
+
+class SettingGroupSchema(Schema):
+    title: str
+    items: list[SettingValueSchema]
+
+
+class WorkspaceSettingsSchema(Schema):
+    workspace_name: str | None
+    workspace_slug: str | None
+    environment: str
+    sandbox: str
+    groups: list[SettingGroupSchema]
+    # Run limits for the whole workspace. Each job can choose its own.
+    limits: list[LimitSchema]
+    can_edit_limits: bool
+
+
+class WorkspaceChoiceSchema(Schema):
+    id: int
+    name: str
+    slug: str
+    role: str
+    current: bool
+
+
+class WorkspaceSelectSchema(Schema):
+    workspace_id: int
+
+
+class WorkspaceCreateSchema(Schema):
+    name: str = Field(max_length=160)
+
+
+class MemberSchema(Schema):
+    id: int
+    email: str
+    role: str
+    joined_at: datetime
+    you: bool
+
+
+RoleName = Literal["owner", "admin", "member"]
+
+
+class RoleChangeSchema(Schema):
+    role: RoleName
+
+
+class InviteCreateSchema(Schema):
+    role: RoleName = "member"
+    note: str = Field("", max_length=160)
+
+
+class InviteSchema(Schema):
+    id: int
+    role: str
+    note: str
+    created_by: str | None
+    created_at: datetime
+    expires_at: datetime
+
+
+class NewInviteSchema(InviteSchema):
+    # Shown once, right after creating it. It cannot be looked up later.
+    link: str
+
+
+class PendingInviteSchema(Schema):
+    workspace_name: str
+    role: str
+    invited_by: str | None
+
+
+ScopeName = Literal["read", "run"]
+
+
+class ApiTokenSchema(Schema):
+    id: int
+    name: str
+    scope: str
+    workspace_id: int
+    workspace_name: str
+    workspace_slug: str
+    created_at: datetime
+    expires_at: datetime
+    last_used_at: datetime | None
+
+
+class TokenWorkspaceSchema(Schema):
+    """A workspace the person can create a token for."""
+
+    id: int
+    name: str
+    slug: str
+    current: bool
+    can_create_run_tokens: bool
+
+
+class ApiTokenListSchema(Schema):
+    items: list[ApiTokenSchema]
+    workspaces: list[TokenWorkspaceSchema]
+    # The longest expiry, in days, a new token can have.
+    max_days: int
+
+
+class ApiTokenCreateSchema(Schema):
+    workspace_id: int
+    name: str = Field(min_length=1, max_length=160)
+    scope: ScopeName = "read"
+    expires_in_days: int
+
+
+class NewApiTokenSchema(ApiTokenSchema):
+    # Shown once, right after creating it. It cannot be looked up later.
+    token: str

secondshift/workspaces/serialization.py

@@ -0,0 +1,138 @@
+from django.http import HttpRequest
+
+from secondshift.workspaces.access import (
+    Action,
+    allows,
+    is_operator,
+)
+from secondshift.workspaces.limits import LimitError, LimitView, workspace_limit_views
+from secondshift.workspaces.models import (
+    ApiToken,
+    Workspace,
+    WorkspaceInvite,
+    WorkspaceMembership,
+)
+from secondshift.workspaces.schemas import (
+    ApiTokenSchema,
+    InviteSchema,
+    LimitSchema,
+    MemberSchema,
+    SettingGroupSchema,
+    SettingValueSchema,
+    TokenWorkspaceSchema,
+    WorkspaceChoiceSchema,
+    WorkspaceSettingsSchema,
+)
+from secondshift.workspaces.server_settings import (
+    SettingValue,
+    environment_label,
+    sandbox_label,
+    setting_groups,
+)
+from secondshift.workspaces.tokens import scope_allowed
+
+
+def serialize_setting(request: HttpRequest, item: SettingValue) -> SettingValueSchema:
+    # Only people who run the server can set the variable, so only they see it.
+    env = item.env if is_operator(request) else ""
+    return SettingValueSchema(**{**vars(item), "env": env})
+
+
+def serialize_settings(
+    request: HttpRequest, workspace: Workspace | None
+) -> WorkspaceSettingsSchema:
+    return WorkspaceSettingsSchema(
+        workspace_name=workspace.name if workspace else None,
+        workspace_slug=workspace.slug if workspace else None,
+        environment=environment_label(),
+        sandbox=sandbox_label(),
+        groups=[
+            SettingGroupSchema(
+                title=group.title,
+                items=[serialize_setting(request, item) for item in group.items],
+            )
+            for group in setting_groups()
+        ],
+        limits=serialize_limits(workspace_limit_views(workspace)) if workspace else [],
+        can_edit_limits=allows(request, Action.CHANGE_RUN_LIMITS),
+    )
+
+
+def serialize_choice(
+    membership: WorkspaceMembership, current_id: int | None
+) -> WorkspaceChoiceSchema:
+    workspace = membership.workspace
+    return WorkspaceChoiceSchema(
+        id=workspace.pk,
+        name=workspace.name,
+        slug=workspace.slug,
+        role=membership.role,
+        current=workspace.pk == current_id,
+    )
+
+
+def person_label(user: object | None) -> str | None:
+    if user is None:
+        return None
+    return getattr(user, "email", "") or user.get_username()
+
+
+def serialize_invite(invite: WorkspaceInvite) -> InviteSchema:
+    return InviteSchema(
+        id=invite.pk,
+        role=invite.role,
+        note=invite.note,
+        created_by=person_label(invite.created_by),
+        created_at=invite.created_at,
+        expires_at=invite.expires_at,
+    )
+
+
+def serialize_member(
+    request: HttpRequest, membership: WorkspaceMembership
+) -> MemberSchema:
+    return MemberSchema(
+        id=membership.pk,
+        email=person_label(membership.user) or "",
+        role=membership.role,
+        joined_at=membership.created_at,
+        you=membership.user_id == request.user.pk,
+    )
+
+
+def serialize_api_token(token: ApiToken) -> ApiTokenSchema:
+    return ApiTokenSchema(
+        id=token.pk,
+        name=token.name,
+        scope=token.scope,
+        workspace_id=token.workspace_id,
+        workspace_name=token.workspace.name,
+        workspace_slug=token.workspace.slug,
+        created_at=token.created_at,
+        expires_at=token.expires_at,
+        last_used_at=token.last_used_at,
+    )
+
+
+def serialize_token_workspace(
+    membership: WorkspaceMembership, current_id: int | None
+) -> TokenWorkspaceSchema:
+    workspace = membership.workspace
+    return TokenWorkspaceSchema(
+        id=workspace.pk,
+        name=workspace.name,
+        slug=workspace.slug,
+        current=workspace.pk == current_id,
+        can_create_run_tokens=scope_allowed(membership.role, ApiToken.Scope.RUN),
+    )
+
+
+def serialize_limits(views: list[LimitView]) -> list[LimitSchema]:
+    return [LimitSchema(**vars(view)) for view in views]
+
+
+def limit_error_detail(request: HttpRequest, error: LimitError) -> str:
+    """Only people who run the server can raise a maximum, so only they get the hint."""
+    if error.ceiling_env and is_operator(request):
+        return f"{error} Set {error.ceiling_env} to allow more."
+    return str(error)

secondshift/workspaces/server_settings.py

@@ -0,0 +1,140 @@
+"""The settings page: what the server enforces.
+
+Runner settings are server-owned (see AGENTS.md), so they are shown with the
+environment variable that changes them rather than edited here. Run limits are
+edited on the page within server maximums (see secondshift.workspaces.limits).
+Nothing secret is included: no keys, connection URLs or filesystem paths.
+"""
+
+from dataclasses import dataclass
+
+from django.conf import settings
+
+from secondshift.config.constants import (
+    DEFAULT_SANDBOX_IMAGE,
+    AppEnv,
+    ArtifactStorage,
+    Environment,
+    SandboxRuntime,
+)
+from secondshift.config.formatting import duration_label
+
+
+@dataclass(frozen=True)
+class SettingValue:
+    label: str
+    value: str
+    env: str
+    help: str
+
+
+@dataclass(frozen=True)
+class SettingGroup:
+    title: str
+    items: list[SettingValue]
+
+
+def size_label(value: int) -> str:
+    for unit, factor in (("MB", 1024 * 1024), ("KB", 1024)):
+        if value >= factor and value % factor == 0:
+            return f"{value // factor} {unit}"
+    return f"{value:,} bytes"
+
+
+def environment_label() -> str:
+    return {Environment.DEV: "Development", Environment.LOCAL: "This computer"}.get(
+        settings.ENVIRONMENT, "Production"
+    )
+
+
+def sandbox_label() -> str:
+    """How command sandboxes are isolated, in words."""
+    if settings.RUNNER_RUNTIME == SandboxRuntime.GVISOR:
+        return "gVisor sandbox"
+    return "Trusted Docker"
+
+
+def image_label(image: str) -> str:
+    """The image name with a short digest, e.g. python:3.13-slim @ 57b29a7c050c."""
+    name, _, digest = image.partition("@sha256:")
+    return f"{name} @ {digest[:12]}" if digest else image
+
+
+def repository_groups() -> list[SettingGroup]:
+    """Background sync applies only to local repositories."""
+    if not settings.LOCAL_REPOSITORIES_ENABLED:
+        return []
+    interval = settings.REPOSITORY_SYNC_INTERVAL_SECONDS
+    return [
+        SettingGroup(
+            "Repositories",
+            [
+                SettingValue(
+                    "Background sync",
+                    f"Every {duration_label(interval)}" if interval > 0 else "Off",
+                    AppEnv.REPOSITORY_SYNC_INTERVAL_SECONDS,
+                    "New commits on a repository's branch apply on their own. "
+                    "Each repository can turn this off.",
+                ),
+            ],
+        )
+    ]
+
+
+def setting_groups() -> list[SettingGroup]:
+    retention = settings.RUN_RETENTION_DAYS
+    return [
+        SettingGroup(
+            "Runs",
+            [
+                SettingValue(
+                    "History kept for",
+                    f"{retention} days" if retention > 0 else "Forever",
+                    AppEnv.RUN_RETENTION_DAYS,
+                    "Finished runs and their files are deleted after this.",
+                ),
+                SettingValue(
+                    "Largest stored output",
+                    size_label(settings.RUN_OUTPUT_MAX_BYTES),
+                    AppEnv.RUN_OUTPUT_MAX_BYTES,
+                    "Longer reports keep their start and end.",
+                ),
+                SettingValue(
+                    "File storage",
+                    "Object storage (S3)"
+                    if settings.ARTIFACT_STORAGE == ArtifactStorage.S3
+                    else "Server filesystem",
+                    AppEnv.ARTIFACT_STORAGE,
+                    "Where run input and output files are kept.",
+                ),
+            ],
+        ),
+        *repository_groups(),
+        SettingGroup(
+            "Sandbox",
+            [
+                SettingValue(
+                    "Isolation",
+                    sandbox_label(),
+                    AppEnv.RUNNER_RUNTIME,
+                    "Production requires gVisor and refuses to start without it.",
+                ),
+                SettingValue(
+                    "Network",
+                    "None",
+                    "",
+                    "Skills cannot reach the network. Model and approved MCP "
+                    "calls go through SecondShift.",
+                ),
+                SettingValue(
+                    "Image",
+                    image_label(settings.RUNNER_IMAGE),
+                    AppEnv.RUNNER_IMAGE,
+                    "Repositories cannot choose the image."
+                    if settings.RUNNER_IMAGE != DEFAULT_SANDBOX_IMAGE
+                    else "Docker's official Python image, pinned. "
+                    "Repositories cannot choose the image.",
+                ),
+            ],
+        ),
+    ]