simpleaudit-studio 0.1.0__py3-none-any.whl

accounts/admin.py

@@ -0,0 +1,29 @@
+from django.contrib import admin
+from django.contrib.auth.admin import UserAdmin
+
+from .models import Project, ProjectMembership, User
+
+
+@admin.register(User)
+class SimpleAuditUserAdmin(UserAdmin):
+    pass
+
+
+class ProjectMembershipInline(admin.TabularInline):
+    model = ProjectMembership
+    extra = 0
+
+
+@admin.register(Project)
+class ProjectAdmin(admin.ModelAdmin):
+    list_display = ("name", "slug", "created_at", "updated_at")
+    search_fields = ("name", "slug")
+    prepopulated_fields = {"slug": ("name",)}
+    inlines = [ProjectMembershipInline]
+
+
+@admin.register(ProjectMembership)
+class ProjectMembershipAdmin(admin.ModelAdmin):
+    list_display = ("user", "project", "role", "created_at")
+    list_filter = ("role", "project")
+    search_fields = ("user__username", "project__name")

accounts/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+
+
+class AccountsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "accounts"
+    verbose_name = "Accounts & Projects"

accounts/auth_urls.py

@@ -0,0 +1,9 @@
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path("register/", views.register, name="auth-register"),
+    path("token/", views.obtain_token, name="auth-token"),
+    path("me/", views.me, name="auth-me"),
+]

accounts/migrations/0001_initial.py

@@ -0,0 +1,201 @@
+# Generated by Django 5.2.4 on 2026-09-23 12:05
+
+import django.contrib.auth.models
+import django.contrib.auth.validators
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        ("auth", "0012_alter_user_first_name_max_length"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Project",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("name", models.CharField(max_length=200, unique=True)),
+                ("slug", models.SlugField(max_length=200, unique=True)),
+                ("description", models.TextField(blank=True)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                "db_table": "core_project",
+                "ordering": ["name"],
+            },
+        ),
+        migrations.CreateModel(
+            name="User",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("password", models.CharField(max_length=128, verbose_name="password")),
+                (
+                    "last_login",
+                    models.DateTimeField(
+                        blank=True, null=True, verbose_name="last login"
+                    ),
+                ),
+                (
+                    "is_superuser",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Designates that this user has all permissions without explicitly assigning them.",
+                        verbose_name="superuser status",
+                    ),
+                ),
+                (
+                    "username",
+                    models.CharField(
+                        error_messages={
+                            "unique": "A user with that username already exists."
+                        },
+                        help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
+                        max_length=150,
+                        unique=True,
+                        validators=[
+                            django.contrib.auth.validators.UnicodeUsernameValidator()
+                        ],
+                        verbose_name="username",
+                    ),
+                ),
+                (
+                    "first_name",
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="first name"
+                    ),
+                ),
+                (
+                    "last_name",
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="last name"
+                    ),
+                ),
+                (
+                    "email",
+                    models.EmailField(
+                        blank=True, max_length=254, verbose_name="email address"
+                    ),
+                ),
+                (
+                    "is_staff",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Designates whether the user can log into this admin site.",
+                        verbose_name="staff status",
+                    ),
+                ),
+                (
+                    "is_active",
+                    models.BooleanField(
+                        default=True,
+                        help_text="Designates whether this user should be treated as active. Unselect this instead of deleting accounts.",
+                        verbose_name="active",
+                    ),
+                ),
+                (
+                    "date_joined",
+                    models.DateTimeField(
+                        default=django.utils.timezone.now, verbose_name="date joined"
+                    ),
+                ),
+                (
+                    "groups",
+                    models.ManyToManyField(
+                        blank=True,
+                        related_name="core_user_groups",
+                        to="auth.group",
+                        verbose_name="groups",
+                    ),
+                ),
+                (
+                    "user_permissions",
+                    models.ManyToManyField(
+                        blank=True,
+                        related_name="core_user_permissions",
+                        to="auth.permission",
+                        verbose_name="user permissions",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "core_user",
+            },
+            managers=[
+                ("objects", django.contrib.auth.models.UserManager()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="ProjectMembership",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "role",
+                    models.CharField(
+                        choices=[
+                            ("admin", "Admin"),
+                            ("auditor", "Auditor"),
+                            ("viewer", "Viewer"),
+                        ],
+                        max_length=20,
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "project",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="memberships",
+                        to="accounts.project",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="memberships",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "core_project_membership",
+                "ordering": ["project__name", "user__username"],
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=("project", "user"), name="unique_project_user"
+                    )
+                ],
+            },
+        ),
+    ]

accounts/migrations/0002_user_workos_user_id.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.4 on 2026-09-24 13:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="workos_user_id",
+            field=models.CharField(blank=True, max_length=64, null=True, unique=True),
+        ),
+    ]

accounts/models.py

@@ -0,0 +1,83 @@
+"""Foundation models for users, projects, and project membership.
+
+Phase 1 intentionally keeps the domain surface small. Scenario, model registry,
+audit run, event, artifact, and comparison models are introduced in later phases
+so migrations can be reviewed against the approved domain model.
+"""
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+
+# Django only auto-imports <app>/models.py. The domain models live in sibling
+# modules, so they must be imported here to register with the app registry.
+# Imported after the base classes below are defined to avoid circular imports.
+
+
+class User(AbstractUser):
+    """Studio user with stable identity for audit attribution.
+
+    This is the AUTH_USER_MODEL. The inherited M2M fields are given explicit
+    related_names so they do not clash with auth.User's reverse accessors.
+    """
+
+    # Stable WorkOS AuthKit user id; null for locally-created accounts.
+    workos_user_id = models.CharField(max_length=64, unique=True, null=True, blank=True)
+
+    groups = models.ManyToManyField(
+        "auth.Group",
+        blank=True,
+        related_name="core_user_groups",
+        verbose_name="groups",
+    )
+    user_permissions = models.ManyToManyField(
+        "auth.Permission",
+        blank=True,
+        related_name="core_user_permissions",
+        verbose_name="user permissions",
+    )
+
+    class Meta:
+        db_table = "core_user"
+
+
+class Project(models.Model):
+    """Tenant-like scope for scenarios, models, audits, and comparisons."""
+
+    name = models.CharField(max_length=200, unique=True)
+    slug = models.SlugField(max_length=200, unique=True)
+    description = models.TextField(blank=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = "core_project"
+        ordering = ["name"]
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class ProjectMembership(models.Model):
+    """Role-based access to a project."""
+
+    class Role(models.TextChoices):
+        ADMIN = "admin", "Admin"
+        AUDITOR = "auditor", "Auditor"
+        VIEWER = "viewer", "Viewer"
+
+    project = models.ForeignKey(Project, on_delete=models.CASCADE, related_name="memberships")
+    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="memberships")
+    role = models.CharField(max_length=20, choices=Role.choices)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        db_table = "core_project_membership"
+        constraints = [
+            models.UniqueConstraint(fields=["project", "user"], name="unique_project_user"),
+        ]
+        ordering = ["project__name", "user__username"]
+
+    def __str__(self) -> str:
+        return f"{self.user.username} -> {self.project.slug}:{self.role}"
+
+
+

accounts/project_urls.py

@@ -0,0 +1,17 @@
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path("", views.list_workspaces, name="workspace-list"),
+    path("create/", views.create_workspace_view, name="workspace-create"),
+    path("switch/", views.switch_workspace, name="workspace-switch"),
+    path("<int:project_id>/", views.workspace_detail, name="workspace-detail"),
+    path("<int:project_id>/members/", views.list_members, name="workspace-members"),
+    path("<int:project_id>/members/add/", views.add_member, name="workspace-member-add"),
+    path(
+        "<int:project_id>/members/<int:user_id>/",
+        views.update_or_remove_member,
+        name="workspace-member-update",
+    ),
+]

accounts/serializers.py

@@ -0,0 +1,95 @@
+from django.contrib.auth.password_validation import validate_password
+from rest_framework import serializers
+
+from accounts.models import Project, ProjectMembership, User
+
+
+class UserSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = User
+        fields = ("id", "username", "email", "first_name", "last_name", "is_active")
+        read_only_fields = ("id",)
+
+
+class RegisterSerializer(serializers.Serializer):
+    username = serializers.CharField(max_length=150)
+    email = serializers.EmailField()
+    password = serializers.CharField(write_only=True, style={"input_type": "password"})
+    first_name = serializers.CharField(required=False, allow_blank=True, default="")
+    last_name = serializers.CharField(required=False, allow_blank=True, default="")
+
+    def validate_username(self, value):
+        if User.objects.filter(username__iexact=value).exists():
+            raise serializers.ValidationError("Username already exists.")
+        return value
+
+    def validate_email(self, value):
+        if User.objects.filter(email__iexact=value).exists():
+            raise serializers.ValidationError("Email already exists.")
+        return value
+
+    def validate_password(self, value):
+        validate_password(value)
+        return value
+
+    def create(self, validated_data):
+        return User.objects.create_user(**validated_data)
+
+
+class ProjectSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Project
+        fields = ("id", "name", "slug", "description", "created_at", "updated_at")
+        read_only_fields = ("id", "created_at", "updated_at")
+
+
+class WorkspaceItemSerializer(serializers.ModelSerializer):
+    """Workspace as shown in lists/detail, including whether the requesting
+    user can administer it (drives UI affordances)."""
+
+    is_admin = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Project
+        fields = ("id", "name", "slug", "description", "is_admin", "created_at", "updated_at")
+        read_only_fields = fields
+
+    def get_is_admin(self, obj) -> bool:
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+        if user is None or not user.is_authenticated:
+            return False
+        if user.is_superuser:
+            return True
+        return ProjectMembership.objects.filter(
+            project=obj, user=user, role=ProjectMembership.Role.ADMIN
+        ).exists()
+
+
+class WorkspaceCreateSerializer(serializers.Serializer):
+    name = serializers.CharField(max_length=200)
+    description = serializers.CharField(required=False, allow_blank=True, default="")
+
+
+class WorkspaceUpdateSerializer(serializers.Serializer):
+    name = serializers.CharField(max_length=200, required=False)
+    description = serializers.CharField(required=False, allow_blank=True)
+
+
+class MemberAddSerializer(serializers.Serializer):
+    username = serializers.CharField(max_length=150)
+    role = serializers.ChoiceField(choices=ProjectMembership.Role.choices, default=ProjectMembership.Role.VIEWER)
+
+
+class MemberRoleSerializer(serializers.Serializer):
+    role = serializers.ChoiceField(choices=ProjectMembership.Role.choices)
+
+
+class ProjectMembershipSerializer(serializers.ModelSerializer):
+    username = serializers.CharField(source="user.username", read_only=True)
+    email = serializers.EmailField(source="user.email", read_only=True)
+
+    class Meta:
+        model = ProjectMembership
+        fields = ("id", "project", "user", "username", "email", "role", "created_at")
+        read_only_fields = ("id", "created_at")

accounts/services.py

@@ -0,0 +1,154 @@
+"""Business logic for foundation operations.
+
+Views should call these services rather than containing authorization or
+bootstrap rules directly.
+"""
+from django.contrib.auth import get_user_model
+from django.db import IntegrityError, transaction
+from django.utils.text import slugify
+
+from accounts.models import Project, ProjectMembership
+from infra.exceptions import StableAPIError
+
+User = get_user_model()
+
+
+@transaction.atomic
+def bootstrap_admin_and_default_project(
+    *,
+    username: str,
+    email: str,
+    password: str,
+    project_name: str = "Default",
+) -> tuple[User, Project]:
+    """Idempotently create the initial admin user and default project."""
+    user, created = User.objects.get_or_create(
+        username=username,
+        defaults={"email": email, "is_staff": True, "is_superuser": True},
+    )
+    # Always ensure the admin password matches the configured value. This makes
+    # the bootstrap idempotent across container restarts where the Postgres data
+    # volume persists (e.g. HF Spaces with non-ephemeral storage). Without this,
+    # a pre-existing admin user created with a different password would never be
+    # corrected, breaking login on subsequent starts.
+    user.set_password(password)
+    user.save(update_fields=["password"])
+    if not user.is_active:
+        user.is_active = True
+        user.save(update_fields=["is_active"])
+    if not user.is_staff:
+        user.is_staff = True
+        user.save(update_fields=["is_staff"])
+    if not user.is_superuser:
+        user.is_superuser = True
+        user.save(update_fields=["is_superuser"])
+
+    slug = slugify(project_name) or "default"
+    project, _ = Project.objects.get_or_create(slug=slug, defaults={"name": project_name})
+    ProjectMembership.objects.get_or_create(
+        project=project,
+        user=user,
+        defaults={"role": ProjectMembership.Role.ADMIN},
+    )
+    return user, project
+
+
+#: Slug of the shared workspace visible to every authenticated user.
+DEFAULT_PROJECT_SLUG = "default"
+
+
+def ensure_project_access(user, project) -> bool:
+    if not user or not user.is_authenticated:
+        return False
+    if user.is_superuser:
+        return True
+    # The Default workspace is always accessible to all users.
+    if project.slug == DEFAULT_PROJECT_SLUG:
+        return True
+    return ProjectMembership.objects.filter(project=project, user=user).exists()
+
+
+def _require_workspace_admin(user, project) -> None:
+    """Raise 403 unless the user is a superuser or ADMIN member of THIS workspace."""
+    if not user or not user.is_authenticated:
+        raise StableAPIError(detail="Authentication required.", code="authentication_required", http_status=401)
+    if user.is_superuser:
+        return
+    if not ProjectMembership.objects.filter(
+        project=project, user=user, role=ProjectMembership.Role.ADMIN
+    ).exists():
+        raise StableAPIError(detail="Workspace admin role required.", code="workspace_admin_required", http_status=403)
+
+
+@transaction.atomic
+def create_workspace(*, user, name: str, description: str = "") -> Project:
+    """Create a workspace; the creator becomes its ADMIN member.
+
+    Any authenticated user may create a workspace — this is how new users
+    bootstrap their own space without needing an existing admin to invite them.
+    """
+    if not user or not user.is_authenticated:
+        raise StableAPIError(detail="Authentication required.", code="authentication_required", http_status=401)
+
+    clean_name = (name or "").strip()
+    if not clean_name:
+        raise StableAPIError(detail="Workspace name is required.", code="invalid_workspace_name")
+
+    base_slug = slugify(clean_name) or "workspace"
+    for attempt in range(5):
+        candidate = base_slug if attempt == 0 else f"{base_slug}-{attempt + 1}"
+        try:
+            with transaction.atomic():
+                project = Project.objects.create(name=clean_name, slug=candidate, description=(description or "").strip())
+                ProjectMembership.objects.create(project=project, user=user, role=ProjectMembership.Role.ADMIN)
+            return project
+        except IntegrityError:
+            if attempt == 4:
+                raise StableAPIError(detail="A workspace with this name already exists.", code="workspace_name_conflict", http_status=409)
+            continue
+    raise StableAPIError(detail="A workspace with this name already exists.", code="workspace_name_conflict", http_status=409)
+
+
+@transaction.atomic
+def update_workspace(*, user, project: Project, name: str | None = None, description: str | None = None) -> Project:
+    """Rename or re-describe a workspace. The slug is immutable — it is part
+    of frozen audit provenance and must never change after creation."""
+    _require_workspace_admin(user, project)
+    if name is not None:
+        clean_name = name.strip()
+        if not clean_name:
+            raise StableAPIError(detail="Workspace name cannot be empty.", code="invalid_workspace_name")
+        project.name = clean_name
+    if description is not None:
+        project.description = description.strip()
+    try:
+        project.save()
+    except IntegrityError as exc:
+        raise StableAPIError(detail="A workspace with this name already exists.", code="workspace_name_conflict", http_status=409) from exc
+    return project
+
+
+def delete_workspace(*, user, project: Project) -> None:
+    """Delete an EMPTY workspace. Refuses while any audit content exists so a
+    mistaken click can never destroy experiment history."""
+    _require_workspace_admin(user, project)
+
+    from audits.models import AuditRun
+    from model_registry.models import ModelConnection, ModelEndpoint
+    from scenarios.models import Scenario, ScenarioSet
+
+    blockers = {
+        "scenarios": Scenario.objects.filter(project=project).exists(),
+        "scenario sets": ScenarioSet.objects.filter(project=project).exists(),
+        "model endpoints": ModelEndpoint.objects.filter(project=project).exists(),
+        "model connections": ModelConnection.objects.filter(project=project).exists(),
+        "audit runs": AuditRun.objects.filter(project=project).exists(),
+    }
+    present = [label for label, found in blockers.items() if found]
+    if present:
+        raise StableAPIError(
+            detail=f"This workspace still contains: {', '.join(present)}. Remove them first.",
+            code="workspace_not_empty",
+            http_status=409,
+        )
+    project.delete()