simpleaudit-studio 0.2.0__tar.gz → 0.2.2__tar.gz

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/.env.example

@@ -19,9 +19,9 @@ DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
 LOG_LEVEL=INFO
 
 # --- Bootstrap (idempotent; run automatically by the web container) ----------
-BOOTSTRAP_ADMIN_USERNAME=admin
-BOOTSTRAP_ADMIN_EMAIL=admin@example.local
-BOOTSTRAP_ADMIN_PASSWORD=change-me
+BOOTSTRAP_USERNAME=studio
+BOOTSTRAP_EMAIL=admin@example.local
+BOOTSTRAP_PASSWORD=change-me
 BOOTSTRAP_PROJECT_NAME=Default
 
 # --- First-run seed (idempotent; run automatically by the web container) -----

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/.env.local.example

@@ -22,9 +22,9 @@ LOG_LEVEL=DEBUG
 
 # --- Bootstrap ----------------------------------------------------------------
 # `python manage.py bootstrap_platform` reads these on first run (idempotent).
-BOOTSTRAP_ADMIN_USERNAME=admin
-BOOTSTRAP_ADMIN_EMAIL=admin@example.local
-BOOTSTRAP_ADMIN_PASSWORD=localdevpass123
+BOOTSTRAP_USERNAME=studio
+BOOTSTRAP_EMAIL=admin@example.local
+BOOTSTRAP_PASSWORD=localdevpass123
 BOOTSTRAP_PROJECT_NAME=Default
 
 # --- Database -----------------------------------------------------------------

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/Dockerfile

@@ -53,12 +53,12 @@ ENV SIMPLEAUDIT_MINIMAL=1 \
     DJANGO_SECRET_KEY=hf-space-demo-secret-key-change-in-production \
     DJANGO_DEBUG=false \
     DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,.hf.space,.huggingface.co \
-    BOOTSTRAP_ADMIN_USERNAME=admin \
-    BOOTSTRAP_ADMIN_EMAIL=admin@example.local \
-    BOOTSTRAP_ADMIN_PASSWORD=admin123 \
+    BOOTSTRAP_USERNAME=studio \
+    BOOTSTRAP_EMAIL=studio@example.local \
+    BOOTSTRAP_PASSWORD=admin123 \
     BOOTSTRAP_PROJECT_NAME=Default \
     DEMO_MODE=true \
-    DEMO_USERNAME=admin \
+    DEMO_USERNAME=studio \
     DEMO_PASSWORD=admin123 \
     MAX_CONCURRENT_AUDITS=1 \
     MAX_SCENARIOS_PER_RUN=50

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simpleaudit-studio
-Version: 0.2.0
+Version: 0.2.2
 Summary: Production AI model audit platform — one-liner demo mode via uvx
 License: MIT
 License-File: LICENSE
@@ -52,7 +52,7 @@ A self-hostable platform for running reproducible AI model audits using the [Sim
 uvx simpleaudit-studio
 ```
 
-[`uvx`](https://docs.astral.sh/uv/#uvx) installs the [`simpleaudit-studio`](https://pypi.org/project/simpleaudit-studio/) package and runs it in an isolated environment. No Docker, no Postgres, no manual setup. Opens at http://localhost:8000 (login: `admin` / `admin12345`). A mock model server is pre-seeded so you can run an audit immediately.
+[`uvx`](https://docs.astral.sh/uv/#uvx) installs the [`simpleaudit-studio`](https://pypi.org/project/simpleaudit-studio/) package and runs it in an isolated environment. No Docker, no Postgres, no manual setup. Opens at http://localhost:8000 (login: `admin` / `admin12345`). A mock model server is pre-seeded so you can start exploring audit results immediately.
 
 🌐 Or skip the setup entirely — try the live demo: <a href="https://sushantgautam-simpleaudit-studio.hf.space" target="_blank" rel="noopener noreferrer">sushantgautam-simpleaudit-studio.hf.space</a>
 
@@ -78,7 +78,7 @@ For teams, multi-user setups, or GPU worker pools, use Docker Compose:
 git clone https://github.com/SushantGautam/SimpleAuditStudio
 cd SimpleAuditStudio
 cp .env.example .env
-# edit POSTGRES_PASSWORD and BOOTSTRAP_ADMIN_PASSWORD at minimum
+# edit POSTGRES_PASSWORD and BOOTSTRAP_PASSWORD at minimum
 docker compose up -d
 ```
 

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/README.md

@@ -25,7 +25,7 @@ A self-hostable platform for running reproducible AI model audits using the [Sim
 uvx simpleaudit-studio
 ```
 
-[`uvx`](https://docs.astral.sh/uv/#uvx) installs the [`simpleaudit-studio`](https://pypi.org/project/simpleaudit-studio/) package and runs it in an isolated environment. No Docker, no Postgres, no manual setup. Opens at http://localhost:8000 (login: `admin` / `admin12345`). A mock model server is pre-seeded so you can run an audit immediately.
+[`uvx`](https://docs.astral.sh/uv/#uvx) installs the [`simpleaudit-studio`](https://pypi.org/project/simpleaudit-studio/) package and runs it in an isolated environment. No Docker, no Postgres, no manual setup. Opens at http://localhost:8000 (login: `admin` / `admin12345`). A mock model server is pre-seeded so you can start exploring audit results immediately.
 
 🌐 Or skip the setup entirely — try the live demo: <a href="https://sushantgautam-simpleaudit-studio.hf.space" target="_blank" rel="noopener noreferrer">sushantgautam-simpleaudit-studio.hf.space</a>
 
@@ -51,7 +51,7 @@ For teams, multi-user setups, or GPU worker pools, use Docker Compose:
 git clone https://github.com/SushantGautam/SimpleAuditStudio
 cd SimpleAuditStudio
 cp .env.example .env
-# edit POSTGRES_PASSWORD and BOOTSTRAP_ADMIN_PASSWORD at minimum
+# edit POSTGRES_PASSWORD and BOOTSTRAP_PASSWORD at minimum
 docker compose up -d
 ```
 

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/accounts/services.py

@@ -24,7 +24,7 @@ def bootstrap_admin_and_default_project(
     """Idempotently create the initial admin user and default project."""
     user, created = User.objects.get_or_create(
         username=username,
-        defaults={"email": email, "is_staff": True, "is_superuser": True},
+        defaults={"email": email, "is_staff": True},
     )
     # Always ensure the admin password matches the configured value. This makes
     # the bootstrap idempotent across container restarts where the Postgres data
@@ -39,9 +39,6 @@ def bootstrap_admin_and_default_project(
     if not user.is_staff:
         user.is_staff = True
         user.save(update_fields=["is_staff"])
-    if not user.is_superuser:
-        user.is_superuser = True
-        user.save(update_fields=["is_superuser"])
 
     slug = slugify(project_name) or "default"
     default_description = "Public common workspaces visible to all users, used for demo"

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/config/settings.py

@@ -237,7 +237,7 @@ WORKOS_ENABLED = bool(WORKOS_CLIENT_ID and WORKOS_API_KEY)
 APP_BASE_URL = os.environ.get("APP_BASE_URL", "http://localhost:8000").rstrip("/")
 
 DEMO_MODE = env_bool("DEMO_MODE", False)
-DEMO_USERNAME = os.environ.get("DEMO_USERNAME", "admin")
+DEMO_USERNAME = os.environ.get("DEMO_USERNAME", "studio")
 DEMO_PASSWORD = os.environ.get("DEMO_PASSWORD", "admin123")
 
 # Framing policy:

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/deploy/e2e_smoke.py

@@ -9,7 +9,7 @@ no real API keys (the mock-model service stands in for all three endpoints).
 
 Usage:
     python deploy/e2e_smoke.py [base_url]     # default http://localhost:8000
-Reads BOOTSTRAP_ADMIN_USERNAME/EMAIL/PASSWORD from .env.
+Reads BOOTSTRAP_USERNAME/EMAIL/PASSWORD from .env.
 """
 from __future__ import annotations
 
@@ -70,10 +70,10 @@ class Client:
 def main():
     base_url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8000"
     env = _load_env()
-    username = env.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
-    password = env.get("BOOTSTRAP_ADMIN_PASSWORD", "")
+    username = env.get("BOOTSTRAP_USERNAME", "studio")
+    password = env.get("BOOTSTRAP_PASSWORD", "")
     if not password:
-        print("FATAL: BOOTSTRAP_ADMIN_PASSWORD not set in .env")
+        print("FATAL: BOOTSTRAP_PASSWORD not set in .env")
         sys.exit(2)
 
     c = Client(base_url)

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/deploy/seed_bulk.py

@@ -133,7 +133,7 @@ RUN_STATUS_DISTRIBUTION = (
 
 def main():
     project = Project.objects.get(id=1)
-    admin = User.objects.get(username="admin")
+    admin = User.objects.get(username="studio")
 
     # ─── 1. Model Endpoints (15) ───────────────────────────────────────────────
     print(f"Model endpoints before: {ModelEndpoint.objects.count()}")

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/docker-compose.yml

@@ -177,7 +177,7 @@ services:
     # collection, then serve with gunicorn. The seed is safe on every start:
     # it skips anything already present. Set SEED_ON_BOOT=false to opt out.
     # Set SEED_DEMO_AUDITS=false to skip demo audit runs only.
-    command: 'sh -c "python manage.py migrate --noinput && python manage.py bootstrap_platform --username ${BOOTSTRAP_ADMIN_USERNAME:-admin} --email ${BOOTSTRAP_ADMIN_EMAIL:-admin@example.local} --password ${BOOTSTRAP_ADMIN_PASSWORD:?Set BOOTSTRAP_ADMIN_PASSWORD in .env} --project-name ${BOOTSTRAP_PROJECT_NAME:-Default} && if [ "${SEED_ON_BOOT:-true}" != "false" ]; then SEED_ARGS=\"\"; if [ \"${SEED_DEMO_AUDITS:-true}\" = \"false\" ]; then SEED_ARGS=\"--skip-demo-audits\"; fi; python manage.py seed_platform $SEED_ARGS || echo ''WARNING: seed_platform failed - continuing without seed data''; fi && python manage.py collectstatic --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 2"'
+    command: 'sh -c "python manage.py migrate --noinput && python manage.py bootstrap_platform --username ${BOOTSTRAP_USERNAME:-studio} --email ${BOOTSTRAP_EMAIL:-admin@example.local} --password ${BOOTSTRAP_PASSWORD:?Set BOOTSTRAP_PASSWORD in .env} --project-name ${BOOTSTRAP_PROJECT_NAME:-Default} && if [ "${SEED_ON_BOOT:-true}" != "false" ]; then SEED_ARGS=\"\"; if [ \"${SEED_DEMO_AUDITS:-true}\" = \"false\" ]; then SEED_ARGS=\"--skip-demo-audits\"; fi; python manage.py seed_platform $SEED_ARGS || echo ''WARNING: seed_platform failed - continuing without seed data''; fi && python manage.py collectstatic --noinput && gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 2"'
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
       interval: 30s

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/e2e/test_ui.py

@@ -7,7 +7,7 @@ with bootstrap_platform already run.
 Run locally:
     docker compose up -d
     docker compose exec web python manage.py bootstrap_platform \
-        --username admin --email admin@example.com --password e2etestpass123 \
+        --username studio --email studio@example.local --password e2etestpass123 \
         --project-name Research
     .venv/bin/python e2e/test_ui.py
 """
@@ -22,7 +22,7 @@ except ImportError:
     sys.exit(1)
 
 BASE_URL = "http://localhost:8000"
-ADMIN_USER = "admin"
+ADMIN_USER = "studio"
 ADMIN_PASS = "e2etestpass123"
 
 

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/management/commands/bootstrap_platform.py

@@ -11,9 +11,9 @@ class Command(BaseCommand):
     help = "Create initial admin user and default project if missing."
 
     def add_arguments(self, parser):
-        parser.add_argument("--username", default=os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin"))
-        parser.add_argument("--email", default=os.environ.get("BOOTSTRAP_ADMIN_EMAIL", "admin@example.local"))
-        parser.add_argument("--password", default=os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", ""))
+        parser.add_argument("--username", default=os.environ.get("BOOTSTRAP_USERNAME", "studio"))
+        parser.add_argument("--email", default=os.environ.get("BOOTSTRAP_EMAIL", "admin@example.local"))
+        parser.add_argument("--password", default=os.environ.get("BOOTSTRAP_PASSWORD", ""))
         parser.add_argument("--project-name", default=os.environ.get("BOOTSTRAP_PROJECT_NAME", "Default"))
 
     def handle(self, *args, **options):
@@ -25,7 +25,7 @@ class Command(BaseCommand):
             raise CommandError("Refusing to bootstrap with unsafe configuration.")
         if not password:
             raise CommandError(
-                "Bootstrap password is required. Set BOOTSTRAP_ADMIN_PASSWORD or pass --password."
+                "Bootstrap password is required. Set BOOTSTRAP_PASSWORD or pass --password."
             )
         user, project = bootstrap_admin_and_default_project(
             username=options["username"],

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/minimal_config.py

@@ -10,9 +10,9 @@ config:
 
 from __future__ import annotations
 
+import atexit
 import logging
 import os
-import tempfile
 import threading
 from typing import Any
 
@@ -28,11 +28,25 @@ def is_minimal_config() -> bool:
     return os.environ.get("SIMPLEAUDIT_MINIMAL", "").strip() == "1"
 
 
+def _data_dir() -> str:
+    """Return (and create) the persistent data dir for the embedded Postgres.
+
+    A fixed location avoids re-running initdb (~218M, ~15s) on every start.
+    Override with SIMPLEAUDIT_EMBEDDED_PG_DIR if needed.
+    """
+    d = os.path.expanduser(
+        os.environ.get("SIMPLEAUDIT_EMBEDDED_PG_DIR", "~/.simpleaudit-studio/embedded-pg")
+    )
+    os.makedirs(d, exist_ok=True)
+    return d
+
+
 def start_embedded_hatchet() -> Any:
     """Start an embedded Hatchet engine and return the client.
 
     The sidecar binary downloads on first use (~53 MB) and caches at
-    ~/.hatchet/embedded/. Subsequent starts are faster.
+    ~/.hatchet/embedded/. The Postgres cluster persists in
+    ~/.simpleaudit-studio/embedded-pg/, so only the first start is slow.
 
     Returns the Hatchet client instance. Raises on failure.
     """
@@ -43,8 +57,7 @@ def start_embedded_hatchet() -> Any:
 
         from hatchet_sdk import ClientConfig, EmbeddedHatchetConfig, Hatchet
 
-        # Use a fresh temp dir per session to avoid stale postmaster.pid locks
-        data_dir = tempfile.mkdtemp(prefix="simpleaudit-hatchet-pg-")
+        data_dir = _data_dir()
         logger.info("Embedded Hatchet data dir: %s", data_dir)
 
         config = ClientConfig(
@@ -76,3 +89,7 @@ def stop_embedded_hatchet() -> None:
 def get_embedded_client() -> Any | None:
     """Return the running embedded Hatchet client, or None."""
     return _embedded_client
+
+
+# Best-effort clean shutdown even if the caller forgets to stop explicitly.
+atexit.register(stop_embedded_hatchet)

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/startup_checks.py

@@ -47,8 +47,8 @@ def validate_startup_environment(bootstrap_password: str | None = None) -> list[
             if minio_access_key in {"", "change-me"} or minio_secret_key in {"", "change-me"}:
                 errors.append("MINIO_ACCESS_KEY and MINIO_SECRET_KEY must be set when MINIO_ENDPOINT is configured.")
 
-    effective_bootstrap_password = bootstrap_password if bootstrap_password is not None else os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", "")
+    effective_bootstrap_password = bootstrap_password if bootstrap_password is not None else os.environ.get("BOOTSTRAP_PASSWORD", "")
     if effective_bootstrap_password in {"", "change-me"}:
-        errors.append("BOOTSTRAP_ADMIN_PASSWORD must be set and must not be change-me.")
+        errors.append("BOOTSTRAP_PASSWORD must be set and must not be change-me.")
 
     return errors

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/tests/test_bootstrap.py

@@ -1,11 +1,14 @@
 import os
 from contextlib import contextmanager
 
+from django.contrib.auth import get_user_model
 from django.core.management import call_command
 from django.test import TestCase
 
 from accounts.models import Project, ProjectMembership
 
+User = get_user_model()
+
 
 @contextmanager
 def _safe_env():
@@ -36,7 +39,7 @@ class BootstrapTests(TestCase):
             for _ in range(2):
                 call_command(
                     "bootstrap_platform",
-                    username="admin",
+                    username="studio",
                     email="admin@example.local",
                     password="admin-pass-123",
                     project_name="Default",
@@ -46,3 +49,20 @@ class BootstrapTests(TestCase):
         memberships = ProjectMembership.objects.filter(project=project)
         self.assertEqual(memberships.count(), 1)
         self.assertEqual(memberships.first().role, ProjectMembership.Role.ADMIN)
+
+    def test_bootstrap_admin_is_not_superuser(self):
+        """The bootstrap admin must be a normal account (is_staff only), not a
+        Django superuser. Superuser status bypasses all workspace membership
+        checks, making the admin appear as owner of every workspace."""
+        with _safe_env():
+            call_command(
+                "bootstrap_platform",
+                username="studio",
+                email="admin@example.local",
+                    password="admin-pass-123",
+                project_name="Default",
+            )
+
+        user = User.objects.get(username="studio")
+        self.assertFalse(user.is_superuser)
+        self.assertTrue(user.is_staff)

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/tests/test_minimal_config.py

@@ -26,12 +26,12 @@ class TestDemoBootSequence(TestCase):
         from model_registry.models import ModelEndpoint
 
         user, project = bootstrap_admin_and_default_project(
-            username="admin",
+            username="studio",
             email="admin@localhost",
             password="admin12345",
             project_name="Demo Project",
         )
-        self.assertEqual(user.username, "admin")
+        self.assertEqual(user.username, "studio")
         self.assertEqual(project.name, "Demo Project")
 
         call_command("seed_platform", project=project.id, verbosity=0)
@@ -56,7 +56,7 @@ class TestDemoBootSequence(TestCase):
         from model_registry.models import ModelEndpoint
 
         _, project = bootstrap_admin_and_default_project(
-            username="admin", email="admin@localhost", password="admin12345",
+            username="studio", email="admin@localhost", password="admin12345",
             project_name="Demo Project",
         )
         call_command("seed_platform", project=project.id, verbosity=0)
@@ -85,6 +85,30 @@ class TestEmbeddedHatchetLifecycle(TestCase):
     (~15s first run) but verify the full lifecycle works.
     """
 
+    def test_data_dir_is_persistent(self):
+        """The embedded Postgres data dir is a fixed location, not a temp dir."""
+        from infra.minimal_config import _data_dir
+
+        d1 = _data_dir()
+        d2 = _data_dir()
+        self.assertEqual(d1, d2)
+        self.assertTrue(os.path.isdir(d1))
+        # Must not be a per-run temp dir (the old leak: 37 x 218M in $TMPDIR)
+        self.assertNotIn("simpleaudit-hatchet-pg-", os.path.basename(d1))
+
+    def test_data_dir_env_override(self):
+        """SIMPLEAUDIT_EMBEDDED_PG_DIR overrides the default location."""
+        import tempfile as _tempfile
+
+        from infra.minimal_config import _data_dir
+
+        with patch.dict(os.environ, {"SIMPLEAUDIT_EMBEDDED_PG_DIR": "/tmp/custom-pg-dir-test"}):
+            d = _data_dir()
+        self.assertEqual(d, "/tmp/custom-pg-dir-test")
+        self.assertTrue(os.path.isdir(d))
+        import shutil
+        shutil.rmtree("/tmp/custom-pg-dir-test", ignore_errors=True)
+
     def test_start_and_stop(self):
         from infra.minimal_config import start_embedded_hatchet, stop_embedded_hatchet
 

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/infra/tests/test_seed_platform.py

@@ -35,7 +35,7 @@ def _safe_env():
 class SeedPlatformTests(TestCase):
     def setUp(self):
         self.user = User.objects.create_superuser(
-            username="admin", email="admin@example.local", password="pass12345"
+            username="studio", email="admin@example.local", password="pass12345"
         )
         self.project = Project.objects.create(name="Default", slug="default")
         ProjectMembership.objects.create(

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "simpleaudit-studio"
-version = "0.2.0"
+version = "0.2.2"
 description = "Production AI model audit platform — one-liner demo mode via uvx"
 readme = "README.md"
 requires-python = ">=3.11"

{simpleaudit_studio-0.2.0 → simpleaudit_studio-0.2.2}/simpleaudit_studio/cli.py

@@ -99,8 +99,8 @@ def main() -> None:
     # Give the web server a moment to bind
     time.sleep(1)
 
-    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
-    password = os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", "admin12345")
+    username = os.environ.get("BOOTSTRAP_USERNAME", "studio")
+    password = os.environ.get("BOOTSTRAP_PASSWORD", "admin12345")
 
     print("┌─────────────────────────────────────────────────────────┐")
     print("│                                                         │")
@@ -140,9 +140,9 @@ def _seed_demo_data() -> None:
     from django.core.management import call_command
 
     # Respect env vars (set by Dockerfile for HF Space, or defaults for local)
-    username = os.environ.get("BOOTSTRAP_ADMIN_USERNAME", "admin")
-    email = os.environ.get("BOOTSTRAP_ADMIN_EMAIL", "admin@localhost")
-    password = os.environ.get("BOOTSTRAP_ADMIN_PASSWORD", "admin12345")
+    username = os.environ.get("BOOTSTRAP_USERNAME", "studio")
+    email = os.environ.get("BOOTSTRAP_EMAIL", "admin@localhost")
+    password = os.environ.get("BOOTSTRAP_PASSWORD", "admin12345")
     project_name = os.environ.get("BOOTSTRAP_PROJECT_NAME", "Demo Project")
 
     user, project = bootstrap_admin_and_default_project(