spaps-server-quickstart 0.8.2__tar.gz → 0.9.1__tar.gz

spaps_server_quickstart-0.9.1/.gitignore

@@ -0,0 +1,236 @@
+# Dependencies
+node_modules
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+sweet-potato-threat-model.md
+
+# Python
+**/__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.venv
+*.egg-info/
+
+# Testing
+coverage/
+coverage-*/
+**/coverage/
+**/coverage-*/
+**/.coverage
+**/.coverage.*
+**/.pytest_cache/
+**/.mypy_cache/
+**/.ruff_cache/
+**/.hypothesis/
+**/.testmondata
+**/.testmondata-shm
+**/.testmondata-wal
+packages/python-server-quickstart/tests/benchmarks/.artifacts/
+*.lcov
+**/lcov.info
+**/lcov-report/
+.nyc_output
+packages/python-client/.coverage
+
+# Production builds
+dist/
+**/dist/
+build/
+out/
+*.tsbuildinfo
+
+# Storybook
+storybook-static/
+*.storybook
+
+# Environment files
+.env
+.env.*
+*.env
+*.env.draft
+**/.env
+**/.env.*
+.env.development
+.env.production
+.env.staging
+.env.deploy
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+# Allow committed templates/examples
+!*.env.example
+!*.env.sample
+!*.env.template
+!**/.env.example
+!**/.env.sample
+!**/.env.template
+!**/.env.*.example
+!**/.env.*.sample
+!**/.env.*.template
+!**/*.env.example
+!**/*.env.sample
+!**/*.env.template
+
+# IDE
+.vscode/
+.idea/
+.codex/
+.mcp.json
+.claude/settings.local.json
+.claude/skills/
+.beads/*.db
+.beads/*.db-shm
+.beads/*.db-wal
+*.swp
+*.swo
+*.swn
+.DS_Store
+
+# Debug
+debug.log
+*.log
+
+# Temporary files
+tmp/
+temp/
+*.tmp
+packages/python-client/**/__pycache__/
+
+# Package manager files
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# Next.js specific
+.next/
+next-env.d.ts
+.vercel/
+
+# Example projects - ignore build artifacts
+examples/**/.next/
+examples/**/node_modules/
+examples/**/dist/
+examples/**/build/
+examples/**/*.log
+examples/**/.env
+examples/**/.env.local
+
+# MCP/Sweetpotato docs build
+mcp-sweetpotato-docs/node_modules/
+mcp-sweetpotato-docs/dist/
+mcp-sweetpotato-docs/build/
+mcp-sweetpotato-docs/.next/
+
+# Large test files
+*.jpg
+*.jpeg
+*.png
+*.gif
+*.bmp
+*.mp4
+*.mov
+*.avi
+*.zip
+*.tar
+*.gz
+*.rar
+
+# Database files
+*.sqlite
+*.sqlite3
+*.db
+
+# Supabase production backups (contain real user data)
+schema.sql
+roles.sql
+data.sql
+backup-feb8.sql
+
+# Stripe CLI
+.stripe-listen.pid
+
+# Local Solana Devnet keypairs
+*-devnet.json
+
+# Local modes/swarm artifacts
+.ntm/
+.skillbox/
+artifacts/openapi-contract/
+# Local-only secret inventory; canonical is docs/security/SECRET_EXPOSURE_REPORT.md
+artifacts/SECRET_EXPOSURE_REPORT.md
+MODES_ANALYSIS_PROGRESS.md
+MODES_OF_REASONING_REPORT_AND_ANALYSIS_OF_PROJECT.md
+MODE_OUTPUT_*.md
+MODES_SWARM/
+
+# OS files
+Thumbs.db
+Desktop.ini
+
+# Backup files
+*.bak
+*.backup
+*.old
+
+# Test output
+test-results/
+playwright-report/
+playwright/.cache/
+tests/artifacts/
+
+# Lock files that shouldn't be committed for libraries
+# (keep package-lock.json for applications)
+# yarn.lock
+# pnpm-lock.yaml*.tgz
+
+**/coverage.xml
+
+context.yaml
+MODES_OF_REASONING_SECOND_PASS_REPORT.md
+skillbox-config/
+
+# Simplify/refactor tool run artifacts
+refactor/
+
+# bv (beads viewer) local config and caches
+.bv/
+
+# Beads compliance audit dir (managed by /beads-compliance-and-completion-verification skill)
+/beads_compliance_audit/
+
+# Local agent ideation and graph-export artifacts
+/.agent-artifacts/
+/DUELING_*
+/WIZARD_*
+/MODE_OUTPUT_*
+/.beads-public-client-graph.sh
+.release/
+
+# Amp Orb repository hooks/config are tracked. Only generated runtime state is
+# ignored; do not blanket-ignore .agents/ or .amp/.
+/.agents/cache/
+/.agents/skills/
+/.agents/logs/
+/.agents/state/
+/.agents/tools/
+/.agents/amp-context/__pycache__/
+/.amp/live-sync.pid
+/.amp/portals/
+/.amp/resume-last-ran.txt
+
+# Production environment drafts belong in the out-of-tree environment manager.
+python-prod.env.draft
+**/python-prod.env.draft
+
+# Generated Authentication reference app (see packages/spaps/scripts/serve-auth-reference.mjs)
+packages/spaps/.auth-reference/

spaps_server_quickstart-0.9.1/CHANGELOG.md

@@ -0,0 +1,341 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+- No changes yet.
+
+## [0.9.1] - 2026-10-24
+
+**Unpublished source candidate.** Prepared alongside Python client `0.8.3`
+([54a0059a](https://github.com/build000r/sweet-potato/commit/54a0059aba568f750da284496c4863a0db695cf4)).
+This date records candidate preparation, not registry publication or deployment.
+
+- Add authenticated CFO action journeys with invitations, scoped claims and
+  acknowledgements, and server-side verification. Hosted QBO configuration,
+  provider consent, and connection proof remain separate acceptance gates.
+- Retry uncertain notification sends automatically within the configured delay
+  and attempt limit while preserving each message's saved outcome.
+- Persist expired checkout attempts before renewal, then revalidate the original
+  caller before creating another generation on the same purchase journey.
+- Add current-application capability discovery to session context; route
+  authorization still reads current membership independently.
+- Use one typed capability dependency on the three project-grant management
+  routes. Require fresh exact-app human membership or explicit verified
+  platform authority; service tokens retain locked current-policy checks.
+  Ordinary global admin roles alone no longer authorize grant management.
+- Keep Apple revocation custody pending unless the provider confirms with an
+  empty HTTP 200; redirects, error responses and unexpected bodies retain retry
+  custody.
+- Authenticate normal encrypted-field reads, reject invalid message data, and
+  refuse historical purchase-reference reconstruction without a surviving
+  authenticated mapping. Master-key ring startup remains blocked pending the
+  complete maintenance and restore contract.
+- Bind maintenance pages to private capsule custody and database-authoritative
+  progress; commit data and original counts together. Retire the arbitrary
+  callback/cursor driver and remove secret-derived report fingerprints. Complete
+  restore/retirement acceptance and key-ring startup remain gated.
+- Support maintenance with one current key and current-first inventories,
+  including durable already-current claim pages. Require current
+  dedicated Apple custody without a retired PII fallback; missing historical
+  custody refuses. This does not authorize key removal or application startup.
+- Add private archive custody bound to an independent database/schema anchor.
+  Verify actual restored data and guards; preserve inner debt during outer
+  rewrap and verify a second distinct restore before publishing replacement.
+  Journal exact disposal and retain interruption debt. Local retirement
+  assessment inspects the complete registered set before a fresh live scan;
+  application startup and key removal remain gated.
+- Retain immutable rollback-reader test fixtures and verify isolated library
+  reads and writes against actual restored data. Defer the audit service import
+  so fresh configured imports reach the explicit startup guard; preserve audit
+  fallback and WebAuthn error handling.
+- Preserve same-request checkout resume without eager claim-row locking. Bound
+  sibling claim/release lock waits and return the existing in-progress response
+  on PostgreSQL lock timeout while preserving caller transactions. Repair the
+  historical CFO test graph; static downgrade lint no longer selects a rollback
+  target, while execution still requires an unambiguous plan.
+- Connect Swagger and ReDoc to the canonical schema, including mounted server
+  prefixes; replace stale endpoint documentation pointers.
+- Return real super-admin application/product inventory counts and report
+  `linked: false` after repeated Apple disconnection.
+- Exercise payment-to-portal provisioning and real refresh rotation in local
+  proofs; strengthen test collection failures and private failure reporting.
+
+These are source-candidate changes. Local checks do not establish publication,
+hosted behavior, provider success, fleet cutover, or Apple release acceptance.
+
+## [0.9.0] - 2026-10-11
+
+**Unpublished source candidate.** Registry publication and cold-install evidence remain separate release gates.
+
+- Add tenant-bound Apple purchase reconciliation and resumable application-account erasure, disabled until trusted application configuration is admitted.
+- Add migrations 148 and 149 while preserving existing grants without a start date.
+- Include current session, capability, dashboard and release-runner hardening from the combined source candidate.
+
+## [0.8.2+parkedcfo.1] - 2026-10-03
+
+Local source variant introduced by
+[e0d73d77](https://github.com/build000r/sweet-potato/commit/e0d73d7733de4ad2892082dea3f5ce9f824055c4).
+This entry records the source change; it establishes no package or hosted release.
+
+- Preserve legacy CFO initiation and encrypted runtime custody while the
+  cutover is parked; retain relay denial, authority fences, and historical
+  tombstones.
+
+## [0.8.2] - 2026-10-01
+
+Source candidate recorded on this date, superseding tagged but unpublished
+`0.8.1`. [PyPI's 0.8.2 artifact](https://pypi.org/project/spaps-server-quickstart/0.8.2/)
+was uploaded on 2026-10-02. That archive does not establish publication of the
+later parked variant or the working-tree changes above.
+
+- Repack the reviewed source cohort after the artifact scanner rejected public auth scope and synthetic test fixtures.
+
+## [0.8.1] - 2026-09-30
+
+**Unpublished source candidate.** Supersedes the tagged but unpublished
+`0.8.0` candidate in the coordinated package release.
+
+## [0.8.0] - 2026-09-30
+
+Source candidate recorded as unpublished on this date. `0.8.0` also includes
+the changes recorded under the unpublished `0.7.x` checkpoints below; this
+historical entry does not describe the current registry inventory.
+
+### Added
+
+- Include the current first-class passkey, restricted recovery, session-authority,
+  and trusted step-up contracts together with their migrations and diagnostics.
+- Include current device-flow, application-capability, and consumer-grant
+  integration surfaces for server consumers.
+
+### Upgrade
+
+- Run the bundled database migrations and recheck application origin, RP-ID,
+  and strict session-validation settings before activating the new auth flows.
+- Eleven legacy `/api/cfo/*` custody routes now return `410
+  cfo_legacy_custody_retired`. Migrate any caller still using generate/revoke,
+  runtime-token, connect/exchange, or user-connection endpoints to the current
+  custody flow before upgrading its server.
+
+## [0.7.1] - 2026-07-21
+
+### Added
+
+- Exported the async `TrustedServiceNonceStore.claim(...)` replay-store contract
+  and `InMemoryTrustedServiceNonceStore` through the package SDK and top-level API.
+- Added optional `APPLE_TOKEN_CUSTODY_KEYS` and
+  `APPLE_TOKEN_CUSTODY_WRITE_VERSION` settings so operators can retain prior
+  Apple custody keys for reads while selecting a newer key version for writes.
+
+### Security
+
+- Trusted-service middleware now verifies signatures and assertions before
+  atomically claiming a nonce, accepts an injectable shared replay store for
+  multi-worker deployments, rejects reused nonces, and fails closed when the
+  replay store is unavailable. Nonce claims for accepted future-dated assertions
+  are retained through the assertion's complete validity window.
+- Every Apple sign-in, linking, refresh, transfer, and revocation custody path
+  now uses the configured versioned key ring. Existing version-1 ciphertext
+  remains readable while new writes and transfer re-seals use the configured
+  write version.
+
+## [0.7.0] - 2026-07-15
+
+### Added
+
+- Added publishable-key-safe, exact application/origin/RP passkey ceremonies;
+  passkey-first bootstrap; credential lifecycle; restricted recovery; action-
+  bound step-up; administrator RP profiles; and passkey observability controls.
+- Passkey profiles now version a `resident_key` policy (`preferred` by default,
+  or `required`) and apply it consistently to standard, bootstrap, and recovery
+  registrations so newly created credentials intentionally support
+  discoverable and conditional sign-in.
+
+### Security
+
+- WebSocket connect tickets minted for one application are no longer redeemable
+  through callers that omit `application_id`; unscoped WebSocket ticket
+  consumers now only accept tokens stored without an application binding.
+
+## [0.6.5] - 2026-07-13
+
+### Fixed
+
+- `RequestLoggingMiddleware` now emits a single `request.failed` structured log
+  (status 500, request id, duration, exception type) when an unhandled exception
+  escapes a request, re-raises the original exception, and no longer emits
+  `request.completed` with a null status on the failure path. Exception message
+  text is never included in the failure log fields. Its pure-ASGI implementation
+  preserves cancellation instead of converting it to a synthetic 500, and
+  unsafe/unbounded inbound request IDs are replaced before logging or response
+  propagation. It also rejects secret-shaped request IDs, overwrites conflicting
+  downstream response headers with the canonical ID, and treats an ASGI app
+  that returns without starting a response as a failed request.
+- The deploy-time CORS contract reader now retrieves every paginated application
+  row instead of silently comparing only the first page.
+
+## [0.6.4] - 2026-06-27
+
+### Added
+
+- Exposes the public auth-channel magic-link contract with `confirm_url` plus
+  signup identity fields (`full_name`, `date_of_birth`, `terms_accepted`, and
+  `terms_text_version`) forwarded through
+  `SpapsAuthChannelService.send_magic_link(...)`, so downstream services can
+  remove private client fallbacks.
+
+## [0.6.3] - 2026-06-04
+
+### Fixed
+
+- `entitlements.grant_entitlement` now treats a partial-UNIQUE-index violation (the Stripe entitlement dedupe indexes from migration `000000000044`) as the idempotent "already granted" case: it rolls back the aborted transaction, re-fetches the winning row, and returns it with `created=False`. Previously a concurrent grant for the same checkout/subscription raised an unhandled `IntegrityError` that poisoned the DB session and could wedge Stripe webhook processing (the event was never marked processed, so Stripe retried indefinitely). A genuine non-dedupe integrity error still fails closed (re-raises). (sp-entitlement-grant-integrityerror-idempotency-b5sl)
+
+## [0.6.2] - 2026-06-01
+
+### Changed
+
+- Raised the FastAPI lower bound to `>=0.120.0` and added an explicit `starlette>=0.49.1,<2.0` dependency floor so downstream services can resolve Starlette security fixes without audit ignores.
+- Raised the `cryptography` lower bound to `>=46.0.7` and relaxed the upper bound to `<49.0` so downstream services can adopt current CVE-fixed releases.
+
+## [0.6.1] - 2026-06-01
+
+### Changed
+
+- Relaxed the FastAPI upper bound to `<0.120` so downstream services can adopt FastAPI 0.119 and Starlette security fixes.
+- Relaxed the `cryptography` upper bound to `<46.0` so downstream services can resolve CVE-fixed releases without local pip-audit ignores.
+
+## [0.6.0] - 2026-05-29
+
+### Added
+
+- Shared WebSocket connect-auth: `mint_ws_ticket`, `consume_ws_ticket`, and the `resolve_ws_identity` WebSocket helper, plus a `POST /realtime/ws-ticket` route. Browsers cannot set the WebSocket `Authorization` header, so apps mint a short-lived, single-use connection ticket over authenticated HTTP and present it on the socket query string. Built on the existing one-time `AuthToken` primitive (`type="ws_connect"`) — no new table.
+- Added reusable hosted-asset storage adapters and issue-reporting screenshot attachment routes backed by private hosted objects.
+
+## [0.5.1] - 2026-04-25
+
+### Fixed
+
+- Hardened request middleware for API keys, key scopes, origin validation, rate limiting, webhook delivery, and self-service access paths.
+
+## [0.5.0] - 2026-03-29
+
+### Added
+
+- End-user issue-reporting flows, runtime token admin support, and support-telemetry helpers for downstream FastAPI services.
+- Browser-friendly device-flow verification and expanded reusable database helper surface.
+
+### Fixed
+
+- Magic-link redirect handling, stale session admin-email behavior, and related auth/session hardening.
+- Hotspot complexity and coverage gaps across webhook, auth, and session paths.
+
+## [0.4.0] - 2026-02-11
+
+### Added
+
+- Full domain rewrite covering auth, sessions, users, wallets, payments, entitlements, dayrate, agent approvals, affiliate referrals, email templates, and related operational domains.
+- Approval capability gates and governance health endpoint.
+
+### Changed
+
+- Production cutover to Python SPAPS stack (CI/CD, Docker Compose, deploy scripts).
+- Consolidated SPAPS integration patterns into published packages.
+
+### Security
+
+- Rate limiting by client IP.
+- PII encryption startup checks.
+- Webhook authentication hardening.
+- Row-level locking on refresh tokens.
+- Fail-closed settings defaults.
+
+## [0.3.0] - 2026-02-08
+
+### Added
+
+- Contract tests and shared testing module.
+- Health endpoint enhancements.
+
+### Changed
+
+- Expanded coverage across settings, middleware, database, Celery, and auth helpers.
+
+## [0.2.3] - 2026-01-12
+
+### Fixed
+
+- `SpapsAuthMiddleware` now skips execution when `authenticated_user` is already populated.
+
+## [0.2.2] - 2026-01-11
+
+### Added
+
+- `fnmatch` glob support for `spaps_auth_exempt_paths`.
+- Set-password endpoint support for authenticated users.
+- Stripe webhook admin tooling for entitlement workflows.
+- Tier 3 templates: seeds, tests, domain examples, docs.
+- Startup validation, Alembic templates, and CI/CD workflow scaffolding.
+
+## [0.2.1] - 2025-12-01
+
+### Added
+
+- Shared pgvector dev scripts: `start-db.sh`, `stop-db.sh`, `await_db.py`.
+- Dynamic DNS resolver support for Docker reverse-proxy setups.
+
+### Fixed
+
+- nginx DNS caching behavior.
+- HTMA rate-limiting exemption handling.
+
+## [0.2.0] - 2025-10-15
+
+### Added
+
+- Local auth bypass mode with pre-configured admin/user personas.
+- Deployment check scripts (`pre-deploy`, `post-deploy`).
+- Database caching workflow for local debug loops.
+- Operational templates (Makefile, GHCR deploy, compose/reverse-proxy stubs).
+
+### Security
+
+- Production guardrails for local-auth bypass mode.
+
+## [0.1.2] - 2025-10-15
+
+### Fixed
+
+- CI pipeline trigger scoping and quickstart build stability.
+
+## [0.1.1] - 2025-10-14
+
+### Changed
+
+- Maintenance release to unblock automated PyPI publishing workflow.
+
+## [0.1.0] - 2025-10-14
+
+### Added
+
+- FastAPI lifespan handling for SPAPS auth cleanup.
+- Migration and upgrading guidance for downstream services.
+- Shared refresh-cookie configuration and browser helper exports.
+- Expanded package exports for auth helpers and operational templates.
+- RBAC role helpers and sample domain routers.
+- Comprehensive unit tests across settings, middleware, DB, Celery, and auth helpers.
+
+## [0.0.2] - 2025-10-12
+
+### Added
+
+- Declared the `spaps` Python client dependency for downstream installs and CI runs.
+
+## [0.0.1] - 2025-10-14
+
+### Added
+
+- Initial `spaps-server-quickstart` scaffold with shared FastAPI/Celery/database utilities.