xmas-app 1.0.0.dev1__tar.gz → 1.0.0.dev3__tar.gz

xmas_app-1.0.0.dev3/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+build/
+dist/
+*.spec
+.env
+.coverage
+*.log
+*.ipynb*
+notebooks/
+*.Identifier
+.vscode/
+*.qgs~
+.nicegui
+.pixi/tests/data/
+.devcontainer/certs/corporate-root.crt
+*.cer

{xmas_app-1.0.0.dev1 → xmas_app-1.0.0.dev3}/PKG-INFO

@@ -1,27 +1,26 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: xmas-app
-Version: 1.0.0.dev1
+Version: 1.0.0-dev.3
 Summary: The XLeitstelle model-driven application schema app.
-License: EUPL-1.2-or-later
+Project-URL: Homepage, https://gitlab.opencode.de/xleitstelle/xmas-app
+Project-URL: Issues, https://gitlab.opencode.de/xleitstelle/xmas-app/-/issues
+Author-email: Tobias Kraft <tobias.kraft@gv.hamburg.de>
+License-Expression: EUPL-1.2+
 License-File: LICENSE
-Author: Tobias Kraft
-Author-email: tobias.kraft@gv.hamburg.de
-Requires-Python: >=3.12,<3.14
 Classifier: Development Status :: 4 - Beta
 Classifier: Framework :: Pydantic :: 2
 Classifier: License :: OSI Approved :: European Union Public Licence 1.2 (EUPL 1.2)
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Requires-Dist: aiohttp (>=3.13.5)
-Requires-Dist: httpx2 (>=2.4.0,<3)
-Requires-Dist: nicegui (>=3.12,<4.0)
+Requires-Python: >=3.14
+Requires-Dist: aiohttp>=3.13.5
+Requires-Dist: httpx2<3,>=2.4.0
+Requires-Dist: nicegui<4.0,>=3.12
 Requires-Dist: pydantic-extra-types[semver]
-Requires-Dist: pydantic-settings (>=2.0,<3.0)
+Requires-Dist: pydantic-settings<3.0,>=2.0
 Requires-Dist: structlog
-Requires-Dist: tenacity (>=9.1.4,<10)
-Requires-Dist: xplan-tools (==1.24.1)
-Project-URL: Homepage, https://gitlab.opencode.de/xleitstelle/xmas-app
-Project-URL: Issues, https://gitlab.opencode.de/xleitstelle/xmas-app/-/issues
+Requires-Dist: tenacity<10,>=9.1.4
+Requires-Dist: xmas-core==2.0.0rc12
 Description-Content-Type: text/markdown
 
 # XMAS-App
@@ -30,7 +29,7 @@ Description-Content-Type: text/markdown
 [![Latest Release](https://gitlab.opencode.de/xleitstelle/xmas-app/-/badges/release.svg)](https://gitlab.opencode.de/xleitstelle/xmas-app/-/releases)
 
 The **X**Leistelle **m**odel-driven **a**pplication **s**chema app is a Python web application to edit and create data according to geo-spatial standards of the [XLeistelle](https://xleitstelle.de), e.g. XPlanung, XTrasse. It is based on [NiceGUI](https://nicegui.io/) for a graphical user interface
-and [XPlan-Tools](https://gitlab.opencode.de/xleitstelle/xplanung/xplan-tools) for the data model and respective functionality.
+and [xmas-core](https://gitlab.opencode.de/xleitstelle/xmas-core) for the data model and respective functionality.
 
 While it could be advanced to a standalone application, its current focus is [integration in QGIS](https://gitlab.opencode.de/xleitstelle/xmas-plugin) to provide attribute forms etc.
 
@@ -70,7 +69,11 @@ pixi install
 ## Running
 
 ### Preconditions
-A Postgres DB with PostGIS extension and adequate permissions for the used role. If required tables were not previously created with `xplan-tools`, they will be generated on initialization.
+A Postgres DB with PostGIS extension and adequate permissions for the used role. Missing tables are generated on initialization.
+
+A database created by `xplan-tools` (xmas-core < 2.0) cannot be upgraded: startup reports `SchemaOutdatedError`. Start with a fresh database instead, with the PostGIS extension enabled and `PGDATABASE` pointing at it, and re-import the plans through the plan manager. The app's own tables live in the same schema as the plans, so nothing of them carries over: organisations are created again on first login, plans are attributed to whoever imports them, and attachments have to be uploaded again.
+
+Plans written straight into the database, for example with `xmas convert`, get no authorization row: the app does not list them, and opening one gives a 404.
 
 ### Environment Configuration
 
@@ -126,18 +129,18 @@ Use the local-mode database settings in `.env` (`PGHOST=127.0.0.1`, `PGPORT=1543
 
 Test data can be downloaded from https://gitlab.opencode.de/xleitstelle/xplanung/testdaten, e.g. a ZIP archive with [BP_Plans in v 6.0](https://gitlab.opencode.de/xleitstelle/xplanung/testdaten/-/archive/main/testdaten-main.zip?path=valide/6_0/bp).
 
-To import all `.gml` files at once, extract the archive and use:
+To import all `.gml` files at once, extract the archive and use the commands below. They write the plans straight into the database, without the authorization rows the app needs, so the app does not show them; for plans to work with in the app, import them through the plan manager.
 
 **Linux / macOS / WSL:**
 ```bash
 for f in <path>/bp/*.gml; do
-  xplan-tools convert "$f" postgresql://postgres:postgres@localhost:55432/postgres
+  xmas convert "$f" postgresql://postgres:postgres@localhost:55432/postgres
 done
 ```
 
 **Windows:**
 ```cmd
-for %f in (*.gml) do xplan-tools convert "%f" postgresql://postgres:postgres@127.0.0.1:55432/postgres
+for %f in (*.gml) do xmas convert "%f" postgresql://postgres:postgres@127.0.0.1:55432/postgres
 ```
 
 ## Authentication
@@ -146,24 +149,70 @@ The application supports two authentication modes, controlled by the `AUTH_MODE`
 
 ### Static token
 
-Intended for development and testing only. Not suitable for production.
+Maps a bearer token to an identity record the operator writes. It is used for local development, for the `xmas-plugin` CI pipeline (which cannot run the interactive OAuth2/PKCE flow headlessly), and for self-hosted installations that do not run an identity provider. See [Static tokens in production](#static-tokens-in-production) before using it for the last of these.
 
-Set `AUTH_MODE=static` in `.env`. See `.env.example` for the token format.
+Set `AUTH_MODE=static` in `.env`.
 
 Requests must include:
 ```
 Authorization: Bearer <token>
 ```
 
-### Keycloak JWT (recommended for staging and production)
+Each token maps to a full identity record via the `AUTH_TOKENS` environment variable (JSON). The record stands in for the claims a Keycloak access token would otherwise carry:
+
+```json
+AUTH_TOKENS={"<generated-token>": {"user_name": "test-user", "user_id": "41a74c7b-dea8-42c2-bd15-9b88012b10d7", "org_id": "25459bec-0f6e-4f3a-a3f4-3b3e6a2a5d11", "email": "test@example.org", "role": "editor"}}
+```
+
+| Field | Required | Meaning |
+|---|---|---|
+| `user_name` | no | Human-readable label for whoever edits the env var (not consumed by the app) |
+| `user_id` | yes | Subject identifier; stands in for the Keycloak `sub`. Any string, see below. Persisted as `created_by` |
+| `org_id` | no* | UUID of the user's org. A `null` or absent value marks a grant-scoped external invitee |
+| `email` | no | Display / audit only. Not used as an identity key |
+| `role` | no | One of `admin`, `editor`, `viewer`. Absent or `null` is treated as no role, which denies writes |
+
+> *`org_id` is optional syntactically, but `null` means the user is treated as
+> an external invitee (grant-scoped only) and will be denied org-scoped plan
+> access. For a normal dev user, set a real org UUID. When `AUTH_MODE=static`,
+> `AUTH_TOKENS` is required, startup fails loudly if it is missing or malformed.
+
+`user_id` is not required to be a UUID. A Keycloak `sub` happens to be one, but OIDC
+defines the subject as an opaque string, so the columns storing it are `text` and any
+stable, unique-per-deployment string works here (ADR-0005, Appendix A). Records are
+parsed into `AuthenticatedUser`, the same type the Keycloak path produces.
 
-Validates RS256-signed access tokens issued by a Keycloak realm via the JWKS endpoint.
+See `.env.example` for the full format.
 
-Set `AUTH_MODE=keycloak` in `.env`. See `.env.example` for the required Keycloak variables.
+#### Static tokens in production
+
+Static mode is supported for self-hosted installations. It is not suitable for an installation reachable from the public internet, because it lacks what that needs:
+
+- No expiry. A token is valid until it is removed from the configuration.
+- No revocation short of editing the configuration and restarting.
+- No signature. The token is the secret itself, so anyone who sees it in transit, in a log, in a shell history or in a backup of `.env` holds the credential.
+- No rate limiting. Guessing tokens is slowed by nothing but the network.
+- Identity and role are whatever the operator wrote into `AUTH_TOKENS`.
+
+How an installation is exposed is the operating organisation's decision, and so is acting on the recommendations below (ADR-0007). An installation that has to be reachable from the internet should use Keycloak.
+
+- **Length.** With `APP_MODE=prod`, the default, startup fails if any token is shorter than 32 characters. Generate one with `python -c "import secrets; print(secrets.token_urlsafe(32))"`.
+- **One token per person.** Recommended, not enforced. With one shared token, every action is attributed to that token's identity, so the record shows the organisation rather than the person.
+- **Storage.** Treat `AUTH_TOKENS` like a password: restrict who can read `.env`, and keep tokens out of version control, tickets and chat.
+- **One place.** Set `AUTH_TOKENS` either in the environment or in `.env`, not both. The two are merged, so a token removed from one stays valid while it is still in the other.
+- **Rotation.** Edit `AUTH_TOKENS` and restart. That is the whole mechanism; there is no expiry and no revocation list.
+
+At startup in prod, the application logs that static mode is active and how many tokens are configured, never the tokens themselves.
+
+### Keycloak JWT (recommended for production)
+
+Validates RS256-signed access tokens issued by a Keycloak realm via the JWKS endpoint. This is the mode for any installation reachable from the public internet.
+
+Set `AUTH_MODE=keycloak` in `.env`. See `.env.example` for the required Keycloak variables (`KEYCLOAK_ISSUER`, `KEYCLOAK_AUDIENCE`, `KEYCLOAK_JWKS_URL`).
 
 > **Note:** `KEYCLOAK_ISSUER` must match the `iss` claim in the token exactly — including scheme, host, and port. `KEYCLOAK_JWKS_URL` is the address of the Keycloak service as seen from inside the Docker network, which may differ from the issuer URL seen by clients.
 
-The local Keycloak instance is started automatically via `compose.yaml`. A development realm (`realm-xmas-dev.json`) is imported on first start, including a test user and the required audience mapper.
+The local Keycloak instance is started automatically via `compose.yaml`. A development realm (`realm-xmas-dev.json`) is imported on first start, including a test user, the `xmas-plugin` client for the OAuth2/PKCE flow, and the required audience mapper.
 
 For Keycloak setup, Identity Provider federation (e.g. Microsoft Entra ID / SSO), and onboarding documentation, see [`keycloak/README.md`](keycloak/README.md).
 
@@ -185,6 +234,10 @@ Then run:
 pixi run pytest tests
 ```
 
+## Agentic Coding
+
+See `.devcontainer/README.md` for Claude Code setup.
+
 ## Troubleshooting
 
 ### PyJWKClientConnectionError
@@ -197,4 +250,3 @@ Make sure proxy settings aren't blocking Keycloak: add `keycloak` to the `NO_PRO
 The code in this repository is licensed under the [EUPL-1.2-or-later](https://joinup.ec.europa.eu/collection/eupl)
 
 &copy; [XLeitstelle](https://xleitstelle.de), 2025
-

{xmas_app-1.0.0.dev1 → xmas_app-1.0.0.dev3}/README.md

@@ -4,7 +4,7 @@
 [![Latest Release](https://gitlab.opencode.de/xleitstelle/xmas-app/-/badges/release.svg)](https://gitlab.opencode.de/xleitstelle/xmas-app/-/releases)
 
 The **X**Leistelle **m**odel-driven **a**pplication **s**chema app is a Python web application to edit and create data according to geo-spatial standards of the [XLeistelle](https://xleitstelle.de), e.g. XPlanung, XTrasse. It is based on [NiceGUI](https://nicegui.io/) for a graphical user interface
-and [XPlan-Tools](https://gitlab.opencode.de/xleitstelle/xplanung/xplan-tools) for the data model and respective functionality.
+and [xmas-core](https://gitlab.opencode.de/xleitstelle/xmas-core) for the data model and respective functionality.
 
 While it could be advanced to a standalone application, its current focus is [integration in QGIS](https://gitlab.opencode.de/xleitstelle/xmas-plugin) to provide attribute forms etc.
 
@@ -44,7 +44,11 @@ pixi install
 ## Running
 
 ### Preconditions
-A Postgres DB with PostGIS extension and adequate permissions for the used role. If required tables were not previously created with `xplan-tools`, they will be generated on initialization.
+A Postgres DB with PostGIS extension and adequate permissions for the used role. Missing tables are generated on initialization.
+
+A database created by `xplan-tools` (xmas-core < 2.0) cannot be upgraded: startup reports `SchemaOutdatedError`. Start with a fresh database instead, with the PostGIS extension enabled and `PGDATABASE` pointing at it, and re-import the plans through the plan manager. The app's own tables live in the same schema as the plans, so nothing of them carries over: organisations are created again on first login, plans are attributed to whoever imports them, and attachments have to be uploaded again.
+
+Plans written straight into the database, for example with `xmas convert`, get no authorization row: the app does not list them, and opening one gives a 404.
 
 ### Environment Configuration
 
@@ -100,18 +104,18 @@ Use the local-mode database settings in `.env` (`PGHOST=127.0.0.1`, `PGPORT=1543
 
 Test data can be downloaded from https://gitlab.opencode.de/xleitstelle/xplanung/testdaten, e.g. a ZIP archive with [BP_Plans in v 6.0](https://gitlab.opencode.de/xleitstelle/xplanung/testdaten/-/archive/main/testdaten-main.zip?path=valide/6_0/bp).
 
-To import all `.gml` files at once, extract the archive and use:
+To import all `.gml` files at once, extract the archive and use the commands below. They write the plans straight into the database, without the authorization rows the app needs, so the app does not show them; for plans to work with in the app, import them through the plan manager.
 
 **Linux / macOS / WSL:**
 ```bash
 for f in <path>/bp/*.gml; do
-  xplan-tools convert "$f" postgresql://postgres:postgres@localhost:55432/postgres
+  xmas convert "$f" postgresql://postgres:postgres@localhost:55432/postgres
 done
 ```
 
 **Windows:**
 ```cmd
-for %f in (*.gml) do xplan-tools convert "%f" postgresql://postgres:postgres@127.0.0.1:55432/postgres
+for %f in (*.gml) do xmas convert "%f" postgresql://postgres:postgres@127.0.0.1:55432/postgres
 ```
 
 ## Authentication
@@ -120,24 +124,70 @@ The application supports two authentication modes, controlled by the `AUTH_MODE`
 
 ### Static token
 
-Intended for development and testing only. Not suitable for production.
+Maps a bearer token to an identity record the operator writes. It is used for local development, for the `xmas-plugin` CI pipeline (which cannot run the interactive OAuth2/PKCE flow headlessly), and for self-hosted installations that do not run an identity provider. See [Static tokens in production](#static-tokens-in-production) before using it for the last of these.
 
-Set `AUTH_MODE=static` in `.env`. See `.env.example` for the token format.
+Set `AUTH_MODE=static` in `.env`.
 
 Requests must include:
 ```
 Authorization: Bearer <token>
 ```
 
-### Keycloak JWT (recommended for staging and production)
+Each token maps to a full identity record via the `AUTH_TOKENS` environment variable (JSON). The record stands in for the claims a Keycloak access token would otherwise carry:
+
+```json
+AUTH_TOKENS={"<generated-token>": {"user_name": "test-user", "user_id": "41a74c7b-dea8-42c2-bd15-9b88012b10d7", "org_id": "25459bec-0f6e-4f3a-a3f4-3b3e6a2a5d11", "email": "test@example.org", "role": "editor"}}
+```
+
+| Field | Required | Meaning |
+|---|---|---|
+| `user_name` | no | Human-readable label for whoever edits the env var (not consumed by the app) |
+| `user_id` | yes | Subject identifier; stands in for the Keycloak `sub`. Any string, see below. Persisted as `created_by` |
+| `org_id` | no* | UUID of the user's org. A `null` or absent value marks a grant-scoped external invitee |
+| `email` | no | Display / audit only. Not used as an identity key |
+| `role` | no | One of `admin`, `editor`, `viewer`. Absent or `null` is treated as no role, which denies writes |
+
+> *`org_id` is optional syntactically, but `null` means the user is treated as
+> an external invitee (grant-scoped only) and will be denied org-scoped plan
+> access. For a normal dev user, set a real org UUID. When `AUTH_MODE=static`,
+> `AUTH_TOKENS` is required, startup fails loudly if it is missing or malformed.
+
+`user_id` is not required to be a UUID. A Keycloak `sub` happens to be one, but OIDC
+defines the subject as an opaque string, so the columns storing it are `text` and any
+stable, unique-per-deployment string works here (ADR-0005, Appendix A). Records are
+parsed into `AuthenticatedUser`, the same type the Keycloak path produces.
+
+See `.env.example` for the full format.
+
+#### Static tokens in production
 
-Validates RS256-signed access tokens issued by a Keycloak realm via the JWKS endpoint.
+Static mode is supported for self-hosted installations. It is not suitable for an installation reachable from the public internet, because it lacks what that needs:
 
-Set `AUTH_MODE=keycloak` in `.env`. See `.env.example` for the required Keycloak variables.
+- No expiry. A token is valid until it is removed from the configuration.
+- No revocation short of editing the configuration and restarting.
+- No signature. The token is the secret itself, so anyone who sees it in transit, in a log, in a shell history or in a backup of `.env` holds the credential.
+- No rate limiting. Guessing tokens is slowed by nothing but the network.
+- Identity and role are whatever the operator wrote into `AUTH_TOKENS`.
+
+How an installation is exposed is the operating organisation's decision, and so is acting on the recommendations below (ADR-0007). An installation that has to be reachable from the internet should use Keycloak.
+
+- **Length.** With `APP_MODE=prod`, the default, startup fails if any token is shorter than 32 characters. Generate one with `python -c "import secrets; print(secrets.token_urlsafe(32))"`.
+- **One token per person.** Recommended, not enforced. With one shared token, every action is attributed to that token's identity, so the record shows the organisation rather than the person.
+- **Storage.** Treat `AUTH_TOKENS` like a password: restrict who can read `.env`, and keep tokens out of version control, tickets and chat.
+- **One place.** Set `AUTH_TOKENS` either in the environment or in `.env`, not both. The two are merged, so a token removed from one stays valid while it is still in the other.
+- **Rotation.** Edit `AUTH_TOKENS` and restart. That is the whole mechanism; there is no expiry and no revocation list.
+
+At startup in prod, the application logs that static mode is active and how many tokens are configured, never the tokens themselves.
+
+### Keycloak JWT (recommended for production)
+
+Validates RS256-signed access tokens issued by a Keycloak realm via the JWKS endpoint. This is the mode for any installation reachable from the public internet.
+
+Set `AUTH_MODE=keycloak` in `.env`. See `.env.example` for the required Keycloak variables (`KEYCLOAK_ISSUER`, `KEYCLOAK_AUDIENCE`, `KEYCLOAK_JWKS_URL`).
 
 > **Note:** `KEYCLOAK_ISSUER` must match the `iss` claim in the token exactly — including scheme, host, and port. `KEYCLOAK_JWKS_URL` is the address of the Keycloak service as seen from inside the Docker network, which may differ from the issuer URL seen by clients.
 
-The local Keycloak instance is started automatically via `compose.yaml`. A development realm (`realm-xmas-dev.json`) is imported on first start, including a test user and the required audience mapper.
+The local Keycloak instance is started automatically via `compose.yaml`. A development realm (`realm-xmas-dev.json`) is imported on first start, including a test user, the `xmas-plugin` client for the OAuth2/PKCE flow, and the required audience mapper.
 
 For Keycloak setup, Identity Provider federation (e.g. Microsoft Entra ID / SSO), and onboarding documentation, see [`keycloak/README.md`](keycloak/README.md).
 
@@ -159,6 +209,10 @@ Then run:
 pixi run pytest tests
 ```
 
+## Agentic Coding
+
+See `.devcontainer/README.md` for Claude Code setup.
+
 ## Troubleshooting
 
 ### PyJWKClientConnectionError

{xmas_app-1.0.0.dev1 → xmas_app-1.0.0.dev3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "xmas-app"
-version = "1.0.0-dev.1"
+dynamic = ["version"]
 description = "The XLeitstelle model-driven application schema app."
 authors = [{ name = "Tobias Kraft", email = "tobias.kraft@gv.hamburg.de" }]
 classifiers = [
@@ -11,19 +11,19 @@ classifiers = [
     "Programming Language :: Python :: 3",
 ]
 readme = "README.md"
-license = "EUPL-1.2-or-later"
+license = "EUPL-1.2+"
 license-files = ["LICENSE"]
 dependencies = [
     "pydantic-settings>=2.0,<3.0",
     "pydantic-extra-types[semver]",
-    "xplan-tools==1.24.1",
+    "xmas-core == 2.0.0rc12",
     "nicegui>=3.12,<4.0",
     "aiohttp>=3.13.5",
     "tenacity>=9.1.4,<10",
     "httpx2>=2.4.0,<3",
     "structlog",
 ]
-requires-python = ">=3.12,<3.14"
+requires-python = ">=3.14"
 
 [project.urls]
 Homepage = "https://gitlab.opencode.de/xleitstelle/xmas-app"
@@ -45,21 +45,29 @@ dev = { features = ["dev"], solve-group = "default" }
 build = { features = ["build"], solve-group = "default" }
 prod = { features = [], solve-group = "default" }
 test = { features = ["test"], solve-group = "default" }
+# Union of "dev" and "test", for the devcontainer: it needs both the lint/format
+# tooling and pytest, and "default" (the same union) is off-limits there because
+# Windows PyCharm owns that env in the shared, bind-mounted .pixi folder.
+container = { features = ["dev", "test"], solve-group = "default" }
 
 [tool.pixi.dependencies]
+python = "3.14.*"
 gdal = ">=3.13.0,<4"
 libgdal-core = ">=3.13.0,<4"
-pyjwt = ">=2.12.1,<3"
-cryptography = ">=48.0.0,<49"
-
-[tool.pixi.target.win.dependencies]
-winloop = "*"
+pyjwt = ">=2.15.1,<3"
+cryptography = "*"
 
 [tool.pixi.target.unix.dependencies]
 uvloop = "*"
 
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+addopts = "--tb=short"
+timeout = 180
+timeout_method = "thread"
+# setup/teardown is not charged against the timeout: the session-scoped Postgres
+# container would otherwise bill its image pull to the first integration test
+timeout_func_only = true
 filterwarnings = [
     "ignore::DeprecationWarning"
 ]
@@ -69,30 +77,21 @@ omit = [
     "xmas_app/models/migrations/*",
 ]
 
-[tool.pixi.tasks.release]
-args = [
-    { "arg" = "version", "default" = "minor" }
-]
-cmd = """
-pixi workspace version {{version}}
-&& git pull
-&& pixi lock
-&& git add pyproject.toml pixi.lock
-&& git commit -S -m "bump to $(pixi workspace version get)"
-&& git tag -s $(pixi workspace version get) -m "v$(pixi workspace version get)"
-&& git push
-&& git push --tags
-&& pixi workspace version get
-"""
+[tool.pixi.tasks]
+# tag the next release (push it yourself), parts as in version.py's `bump`: pixi run tag dev
+tag = { cmd = "python version.py {{ parts }}", args = [
+    { arg = "parts", default = "patch" },
+] }
 
 
 [dependency-groups]
 dev = ["pre-commit>=4", "ruff>=0.8", "cyclonedx-bom>=7"]
-build = ["poetry>=2.0.0"]
+build = ["uv"]
 test = [
     "pytest",
     "pytest-asyncio",
     "pytest-cov",
+    "pytest-timeout",
     "testcontainers"
 ]
 
@@ -109,5 +108,16 @@ extend-select = ["I", "D"]
 convention = "google"
 
 [build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[tool.hatch.version]
+source = "code"
+path = "version.py"
+
+# xmas_app has no __init__.py, so hatchling cannot find it by the project name
+[tool.hatch.build.targets.wheel]
+packages = ["xmas_app"]
+
+[tool.hatch.build.targets.sdist]
+include = ["xmas_app", "version.py"]

xmas_app-1.0.0.dev3/version.py

@@ -0,0 +1,88 @@
+"""Package version for hatchling (`[tool.hatch.version] source = "code"`).
+
+The git tag is the only source. CI_COMMIT_TAG wins: tag pipelines and the Docker build have
+no usable git. Otherwise `git describe`: on a tag that is the tag, past it a local version
+`<tag>+<n>.g<sha>` (sorts after the tag, refused by PyPI); no git or no tag gives 0.0.0.dev0.
+A tag must be semver whose prerelease is also valid PEP 440 (-dev.N/-rc.N): GitLab's
+changelog API and the CI prerelease regexes read it as semver. alpha/beta are left out:
+semver sorts them before dev, PEP 440 after it.
+
+`python version.py PART...` (`pixi run tag dev`) tags the commit with the tag after
+the last one, like `uv version --bump`, see `bump`. Here, not in the pixi task:
+its shell carries on after a failed `$(...)`, tagging an empty name.
+"""
+
+import os
+import re
+import subprocess  # nosec B404 - runs git only
+import sys
+
+_TAG = re.compile(r"(\d+)\.(\d+)\.(\d+)(?:-(dev|rc)\.(\d+))?")
+_PRE = ("dev", "rc")
+
+
+def _version() -> str:
+    """The version of the checkout: CI_COMMIT_TAG, else from `git describe`."""
+    if tag := os.environ.get("CI_COMMIT_TAG"):
+        if not _TAG.fullmatch(tag):
+            raise ValueError(f"tag {tag!r} is not X.Y.Z or X.Y.Z-(dev|rc).N")
+        return tag
+    try:
+        out = subprocess.run(  # nosec B603 B607 - fixed argv, git from PATH
+            ["git", "describe", "--tags", "--long", "--match", "[0-9]*"],
+            capture_output=True,
+            text=True,
+            check=True,
+            cwd=os.path.dirname(os.path.abspath(__file__)),
+        ).stdout.strip()
+    except OSError, subprocess.CalledProcessError:
+        return "0.0.0.dev0"
+    tag, n, sha = out.rsplit("-", 2)
+    return tag if n == "0" else f"{tag}+{n}.{sha}"
+
+
+def bump(tag: str, *parts: str) -> str:
+    """The tag after `tag`, each part applied in order.
+
+    major/minor/patch raise that component and drop the prerelease, stable drops it,
+    dev/rc count up (dev.1 -> dev.2) or move forward (dev.2 -> rc.1). A prerelease of a
+    released tag needs a release part first (`major dev`: 0.18.6 -> 1.0.0-dev.1), else it
+    would sort before the tag it follows.
+    """
+    m = _TAG.fullmatch(tag)
+    if not m:
+        raise ValueError(f"tag {tag!r} is not X.Y.Z or X.Y.Z-(dev|rc).N")
+    major, minor, patch = map(int, m.group(1, 2, 3))
+    pre, n = m[4], int(m[5] or 0)
+    released = pre is None
+    for part in parts:
+        match part:
+            case "major":
+                major, minor, patch, pre, released = major + 1, 0, 0, None, False
+            case "minor":
+                minor, patch, pre, released = minor + 1, 0, None, False
+            case "patch":
+                patch, pre, released = patch + 1, None, False
+            case "stable":
+                pre = None
+            case "dev" | "rc" if released:
+                raise ValueError(
+                    f"{tag} is released: bump major, minor or patch before {part}"
+                )
+            case "dev" | "rc" if part == pre:
+                n += 1
+            case "dev" | "rc" if pre is None or _PRE.index(part) > _PRE.index(pre):
+                pre, n = part, 1
+            case _:
+                raise ValueError(f"cannot bump {tag} by {part!r}")
+    return f"{major}.{minor}.{patch}" + (f"-{pre}.{n}" if pre else "")
+
+
+__version__ = _version()
+
+if __name__ == "__main__":
+    tag = bump(__version__.split("+")[0], *sys.argv[1:])
+    subprocess.run(  # nosec B603 B607 - fixed argv, git from PATH
+        ["git", "tag", "-s", tag, "-m", f"v{tag}"], check=True
+    )
+    print(f"tagged {tag}; release with: git push origin {tag}")

{xmas_app-1.0.0.dev1 → xmas_app-1.0.0.dev3}/xmas_app/components/association.py

@@ -147,11 +147,13 @@ class AssociationList(ui.button):
             case "existing":
                 if self.ref_objects is None:
                     self.table_existing.props("loading")
-                    self.ref_objects = await get_ref_objects(
-                        self.refs,
-                        extra_props=self._form._mappings.association_table.extra_property,
-                        repo=self._form.repo,
-                    )
+                    async with self._form.sessionmaker.begin() as session:
+                        self.ref_objects = await get_ref_objects(
+                            self.refs,
+                            self._form.plan_id,
+                            extra_props=self._form._mappings.association_table.extra_property,
+                            session=session,
+                        )
                     self.table_existing.rows = self.ref_objects
                     self.table_existing.selected = self.ref_objects
                     self.table_existing.props(
@@ -161,14 +163,15 @@ class AssociationList(ui.button):
             case "candidates":
                 if self.ref_candidates is None:
                     self.table_candidates.props("loading")
-                    self.ref_candidates = await get_ref_candidates(
-                        self.refs,
-                        self._form.plan_id,
-                        self._form.model,
-                        self.rel,
-                        extra_props=self._form._mappings.association_table.extra_property,
-                        repo=self._form.repo,
-                    )
+                    async with self._form.sessionmaker.begin() as session:
+                        self.ref_candidates = await get_ref_candidates(
+                            self.refs,
+                            self._form.plan_id,
+                            self._form.model,
+                            self.rel,
+                            extra_props=self._form._mappings.association_table.extra_property,
+                            session=session,
+                        )
                     self.table_candidates.rows = self.ref_candidates
                     self.table_candidates.props(
                         f":selected-rows-label='(numberOfRows) => `${{ numberOfRows }} von {len(self.ref_candidates)} Referenzen selektiert`'"