utim-cli 1.44.5__tar.gz → 1.44.7__tar.gz

{utim_cli-1.44.5 → utim_cli-1.44.7}/MANIFEST.in

@@ -10,8 +10,7 @@ include pyproject.toml
 # ── Include the JSON data file bundled with the package ───────────────────────
 include utim_cli/mcp_registry.json
 
-# ── Exclude server sub-package (runs on Railway, not on user machines) ─────────
-prune utim_cli/server
+# ── Exclude server sub-package (NO LONGER EXCLUDED - REQUIRED BY CLI HISTORY) ─────────
 
 # ── Exclude tests, landing site, build artifacts ──────────────────────────────
 prune tests

{utim_cli-1.44.5/utim_cli.egg-info → utim_cli-1.44.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: utim-cli
-Version: 1.44.5
+Version: 1.44.7
 Summary: UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal.
 License: MIT
 Project-URL: Homepage, https://utim.dev

{utim_cli-1.44.5 → utim_cli-1.44.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "utim-cli"
-version = "1.44.5"
+version = "1.44.7"
 description = "UTIM – Universal Terminal Intelligence Manager. A powerful agentic AI coding assistant for your terminal."
 readme = "README.md"
 requires-python = ">=3.9"

utim_cli-1.44.7/utim_cli/server/__init__.py

@@ -0,0 +1,4 @@
+"""UTIM Production Server package."""
+from .router import app
+
+__all__ = ["app"]

utim_cli-1.44.7/utim_cli/server/auth.py

@@ -0,0 +1,294 @@
+"""
+UTIM Production Server — Auth Layer
+API-key authentication using X-API-Key or Authorization: Bearer headers.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import uuid
+import datetime
+from typing import Optional
+
+from fastapi import Depends, Header, HTTPException, status
+from sqlalchemy.orm import Session
+
+from .db import User, Credit, UserSubscription, QuotaUsage, get_db
+
+logger = logging.getLogger("utim.auth")
+
+# ── Master admin key (set in Railway env vars) ────────────────────────────────
+MASTER_KEY = os.environ.get("UTIM_MASTER_KEY", None)
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+def process_user_refills(db: Session, user_id: str) -> None:
+    """
+    Catch-up and process any pending 5-hour quota refills for the user's active subscription.
+    Max refills per 30-day billing cycle = 144.
+    """
+    import datetime
+    import uuid
+    from .db import UserSubscription, Credit, Transaction
+    
+    sub = db.query(UserSubscription).filter(
+        UserSubscription.user_id == user_id,
+        UserSubscription.status == "active"
+    ).first()
+    
+    now = datetime.datetime.utcnow()
+    
+    if not sub or not sub.plan:
+        return
+
+    if sub.plan_id == "free":
+        # Handle monthly cycle end — reset the counter
+        if now >= sub.current_period_end:
+            sub.current_period_start = now
+            sub.current_period_end = now + datetime.timedelta(days=30)
+            sub.refills_processed = 0
+
+        elapsed_seconds = (now - sub.current_period_start).total_seconds()
+        max_due = int(elapsed_seconds // (5 * 3600))
+
+        due = max_due - sub.refills_processed
+        if due > 0:
+            credit = db.query(Credit).filter(Credit.user_id == user_id).first()
+            if credit:
+                # No rollover — each 5h slot resets the tank back to full 100.0
+                credit.balance = 100.0
+            sub.refills_processed = max_due
+            sub.last_refill_at = now
+            db.commit()
+        return
+    
+    # Calculate how many 5-hour refills should have been processed by now
+    cycle_days = (sub.current_period_end - sub.current_period_start).days
+    is_yearly = cycle_days > 45
+    max_refills = 1728 if is_yearly else 144
+
+    if now >= sub.current_period_end:
+        max_due = max_refills
+    else:
+        elapsed_seconds = (now - sub.current_period_start).total_seconds()
+        max_due = min(max_refills, int(elapsed_seconds // (5 * 3600)))
+        
+    due = max_due - sub.refills_processed
+    if due > 0:
+        plan = sub.plan
+        cycle_allowance = plan.credits_per_month / 144.0
+        
+        # Unused quota from the first due cycle (which had sub.current_cycle_used accumulated)
+        # plus the full allowance of any subsequent due cycles where the user didn't make requests
+        current_cycle_used = sub.current_cycle_used or 0.0
+        unused_credits = max(0.0, cycle_allowance - current_cycle_used)
+        if due > 1:
+            unused_credits += cycle_allowance * (due - 1)
+        
+        credit = db.query(Credit).filter(Credit.user_id == user_id).first()
+        if not credit:
+            credit = Credit(user_id=user_id, balance=0.0, total_spent=0.0, total_topped_up=0.0)
+            db.add(credit)
+            db.flush()
+            
+        max_limit = plan.credits_per_month * 2.0
+        old_balance = credit.balance
+        new_balance = min(max_limit, credit.balance + unused_credits)
+        
+        if new_balance > old_balance:
+            credit.balance = new_balance
+            tx = Transaction(
+                id=str(uuid.uuid4()),
+                user_id=user_id,
+                kind="refill",
+                amount=new_balance - old_balance,
+                balance_after=new_balance,
+                description=f"Refill of {due} cycles ({plan.name.title()} Plan)"
+            )
+            db.add(tx)
+            
+        sub.current_cycle_used = 0.0
+        sub.refills_processed = max_due
+        sub.last_refill_at = now
+        db.commit()
+
+
+def _extract_token(
+    x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
+    authorization: Optional[str] = Header(None),
+) -> Optional[str]:
+    """Pull the raw key/token from headers."""
+    if x_api_key:
+        return x_api_key
+    if authorization:
+        parts = authorization.split()
+        if len(parts) == 2 and parts[0].lower() == "bearer":
+            return parts[1]
+    return None
+
+
+def get_current_user(
+    token: Optional[str] = Depends(_extract_token),
+    db: Session = Depends(get_db),
+) -> User:
+    """
+    Resolve the authenticated user from an API key.
+    Raises 401 if missing / invalid.
+    """
+    if not token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing API key. Pass X-API-Key or Authorization: Bearer <key>.",
+        )
+
+    user = db.query(User).filter(User.api_key == token, User.is_active == True).first()
+    if not user:
+        logger.warning("auth_failed", extra={"token_prefix": token[:8]})
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or revoked API key.",
+        )
+
+    _bootstrap_welcome_email(db, user)
+    process_user_refills(db, user.id)
+    return user
+
+
+def get_admin_user(
+    token: Optional[str] = Depends(_extract_token),
+    db: Session = Depends(get_db),
+) -> User:
+    """Require the UTIM_MASTER_KEY for admin operations."""
+    if not MASTER_KEY:
+        raise HTTPException(status_code=500, detail="Master key not configured on server.")
+    if token != MASTER_KEY:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required.")
+    return None  # admin endpoints don't return a user object
+
+
+def get_current_firebase_user(
+    x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
+    authorization: Optional[str] = Header(None),
+    db: Session = Depends(get_db)
+) -> User:
+    token = x_api_key
+    if not token and authorization:
+        parts = authorization.split()
+        if len(parts) == 2 and parts[0].lower() == "bearer":
+            token = parts[1]
+            
+    if not token:
+        raise HTTPException(status_code=401, detail="Authorization token missing.")
+        
+    # Check if token is a direct UTIM API Key
+    user_by_key = db.query(User).filter(User.api_key == token, User.is_active == True).first()
+    if user_by_key:
+        _bootstrap_welcome_email(db, user_by_key)
+        process_user_refills(db, user_by_key.id)
+        return user_by_key
+
+    # Verify as Firebase JWT Token
+    from .firebase import verify_firebase_token
+    try:
+        payload = verify_firebase_token(token)
+    except ValueError as exc:
+        logger.warning(f"firebase_token_auth_failed: {exc}")
+        raise HTTPException(status_code=401, detail=str(exc))
+        
+    email = payload.email or f"{payload.uid}@firebase.user"
+    user = db.query(User).filter(User.email == email).first()
+    if not user:
+        user = create_user(db, email=email, display_name=payload.name)
+    else:
+        _bootstrap_welcome_email(db, user)
+    process_user_refills(db, user.id)
+    return user
+
+
+
+# ── Provisioning ──────────────────────────────────────────────────────────────
+
+def create_user(db: Session, email: str, display_name: str = "") -> User:
+    """Create a new user with initial credits and quota subscription. Idempotent by email."""
+    existing = db.query(User).filter(User.email == email).first()
+    if existing:
+        return existing
+
+    user = User(
+        id=str(uuid.uuid4()),
+        email=email,
+        display_name=display_name or email.split("@")[0],
+        api_key=f"utim-{uuid.uuid4().hex}",
+        is_active=True,
+    )
+    db.add(user)
+    db.flush()  # get user.id
+
+    # Create credit row for backward compatibility
+    credit = Credit(user_id=user.id, balance=100.0, total_topped_up=0.0)
+    db.add(credit)
+
+    # Provision Free plan subscription
+    now = datetime.datetime.utcnow()
+    end_date = now + datetime.timedelta(days=30)
+    sub = UserSubscription(
+        user_id=user.id,
+        plan_id="free",
+        status="active",
+        current_period_start=now,
+        current_period_end=end_date,
+    )
+    db.add(sub)
+
+    # Create initial quota usage
+    quota = QuotaUsage(
+        user_id=user.id,
+        period_start=now,
+        period_end=end_date,
+        credits_used=0.0,
+        credits_limit=100,  # Free limit: 100 credits
+        reset_at=end_date,
+    )
+    db.add(quota)
+
+    db.commit()
+    db.refresh(user)
+    
+    _bootstrap_welcome_email(db, user)
+
+    logger.info("user_created", extra={"email": email, "user_id": user.id})
+    return user
+
+
+def _bootstrap_welcome_email(db: Session, user: User) -> None:
+    """Ensure user has an EmailTracking row and triggers their welcome email if not already sent."""
+    from .db import EmailTracking
+    tracking = db.query(EmailTracking).filter(EmailTracking.user_id == user.id).first()
+    if not tracking:
+        tracking = EmailTracking(
+            user_id=user.id,
+            email=user.email,
+            display_name=user.display_name or user.email.split("@")[0],
+            welcome_email_sent=False
+        )
+        db.add(tracking)
+        db.commit()
+
+    if not tracking.welcome_email_sent:
+        from .email_utils import send_welcome_email
+        import threading
+        def send_bg():
+            from .db import SessionLocal
+            thread_db = SessionLocal()
+            try:
+                success = send_welcome_email(user.email, user.display_name or user.email.split("@")[0])
+                if success:
+                    thread_tracking = thread_db.query(EmailTracking).filter(EmailTracking.user_id == user.id).first()
+                    if thread_tracking:
+                        thread_tracking.welcome_email_sent = True
+                        thread_db.commit()
+            except Exception as e:
+                logger.error(f"Error sending welcome email in thread: {e}")
+            finally:
+                thread_db.close()
+        threading.Thread(target=send_bg, daemon=True).start()