This squashes 13 commits from ma/staging plus a small docstring translation
into a single coherent unit. Three workstreams.
== RBAC v13 redesign ==
- Drops core.viewer/analyst/km_admin/admin hierarchy and the
internal_roles / group_mappings / user_role_grants / plugin_access tables.
- Replaced by user_group_members + resource_grants. Atomic v12→v13 backfill
wrapped in BEGIN/COMMIT; ROLLBACK leaves schema_version at 12 for retry.
- Two authorization primitives in app.auth.access:
require_admin — Admin-group god-mode
require_resource_access(rt, "{path}") — entity-scoped grants
Single DB lookup per request; no session cache; no implies BFS.
- /admin/access UI (single page) replaces /admin/role-mapping +
/admin/plugin-access. CLI `da admin group/grant *` replaces
`da admin role/mapping/grant-role/revoke-role/effective-roles`.
- ResourceType.TABLE listing-only — admins can record table grants,
runtime enforcement still flows through legacy dataset_permissions
(migration plan in docs/TODO-rbac-data-enforcement.md).
== Claude Code marketplace ==
- Aggregated /marketplace.zip + /marketplace.git/* (PAT-gated,
RBAC-filtered, content-addressed cache via dulwich).
- Admin god-mode dropped on the marketplace surface — admins curate
their own view via grants like everyone else.
- Bare-repo cache materializes per RBAC-filtered ETag; stale entries
not pruned in this iteration (disclaimed in git_backend.py docstring).
== #81 #83 #44 security/ops hardening ==
- #81 Group A — orchestrator ATTACH allow-listing (extension/url/alias).
- #81 Group B — Keboola extractor 3-state exit codes:
0 success / 1 total fail / 2 PARTIAL fail
Sync API logs PARTIAL FAILURE alert on exit 2. Operators with binary
alerting must teach it the new partial signal.
- #81 Group C — schema v10 view_ownership; rejects silent overwrite
of a prior connector's view name on collision.
- #81 Group D — extractor-side identifier validation.
- #83 — Jira webhook fail-closed when JIRA_WEBHOOK_SECRET unset
+ path-traversal fix.
- #44 — entire /api/scripts/* surface is admin-only (planted-script +
sandbox-bypass risk closed).
== Web UI polish + deploy fix ==
- /admin/access: live grant-count badges (no stale snapshot revert),
shared-header CSS link added to /catalog and /admin/{tables,permissions},
per-resource-type colored stripes.
- docker-compose.host-mount.yml: bind,rbind so dual-disk hosts don't
silently shadow sub-mounts and write state to the wrong disk.
== OSS vendor-neutralization (waves 1+2) ==
- scripts/grpn/ → scripts/ops/. Customer-specific identifiers
(project IDs, internal hostnames, dev/prod VM IPs, brand names)
replaced with placeholders across code, docs, Terraform, Caddyfile,
OAuth probe, and planning docs. Downstream infra repos that copied
scripts/grpn/agnes-tls-rotate.sh or agnes-auto-upgrade.sh must
update the path.
== Translation ==
- src/repositories/user_groups.py::ensure_system docstring translated
from Czech to English for codebase consistency.
Co-authored-by: Mina Rustamyan <mina@keboola.com>
132 lines
4.6 KiB
Python
132 lines
4.6 KiB
Python
"""Repository for the per-marketplace plugin cache.
|
|
|
|
Each row is a single plugin listed in a marketplace's
|
|
`.claude-plugin/marketplace.json`. The rows are fully derived from the
|
|
cloned working copy on disk — treat this table as a cache that is
|
|
refreshed on every successful `src.marketplace.sync_one()` call.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from datetime import datetime, timezone
|
|
from typing import Any, Dict, Iterable, List, Optional
|
|
|
|
import duckdb
|
|
|
|
|
|
class MarketplacePluginsRepository:
|
|
def __init__(self, conn: duckdb.DuckDBPyConnection):
|
|
self.conn = conn
|
|
|
|
@staticmethod
|
|
def _row_to_dict(
|
|
columns: List[str], row: tuple
|
|
) -> Dict[str, Any]:
|
|
d = dict(zip(columns, row))
|
|
for k in ("source_spec", "raw"):
|
|
v = d.get(k)
|
|
if isinstance(v, str):
|
|
try:
|
|
d[k] = json.loads(v)
|
|
except (ValueError, TypeError):
|
|
pass
|
|
return d
|
|
|
|
def list_for_marketplace(self, marketplace_id: str) -> List[Dict[str, Any]]:
|
|
rows = self.conn.execute(
|
|
"SELECT * FROM marketplace_plugins WHERE marketplace_id = ? ORDER BY name",
|
|
[marketplace_id],
|
|
).fetchall()
|
|
if not rows:
|
|
return []
|
|
columns = [d[0] for d in self.conn.description]
|
|
return [self._row_to_dict(columns, r) for r in rows]
|
|
|
|
def list_all(self) -> List[Dict[str, Any]]:
|
|
rows = self.conn.execute(
|
|
"SELECT * FROM marketplace_plugins ORDER BY marketplace_id, name"
|
|
).fetchall()
|
|
if not rows:
|
|
return []
|
|
columns = [d[0] for d in self.conn.description]
|
|
return [self._row_to_dict(columns, r) for r in rows]
|
|
|
|
def count_by_marketplace(self) -> Dict[str, int]:
|
|
rows = self.conn.execute(
|
|
"SELECT marketplace_id, COUNT(*) FROM marketplace_plugins GROUP BY marketplace_id"
|
|
).fetchall()
|
|
return {r[0]: int(r[1]) for r in rows}
|
|
|
|
def replace_for_marketplace(
|
|
self,
|
|
marketplace_id: str,
|
|
plugins: Iterable[Dict[str, Any]],
|
|
) -> int:
|
|
"""Replace the full plugin set for one marketplace in a single transaction.
|
|
|
|
Returns the number of plugins written.
|
|
"""
|
|
plugins_list = list(plugins)
|
|
now = datetime.now(timezone.utc)
|
|
self.conn.execute("BEGIN")
|
|
try:
|
|
self.conn.execute(
|
|
"DELETE FROM marketplace_plugins WHERE marketplace_id = ?",
|
|
[marketplace_id],
|
|
)
|
|
for p in plugins_list:
|
|
name = (p.get("name") or "").strip()
|
|
if not name:
|
|
continue
|
|
source_spec = p.get("source")
|
|
source_type = _classify_source(source_spec)
|
|
author = p.get("author") or {}
|
|
author_name = author.get("name") if isinstance(author, dict) else None
|
|
self.conn.execute(
|
|
"""INSERT INTO marketplace_plugins
|
|
(marketplace_id, name, description, version, author_name,
|
|
homepage, category, source_type, source_spec, raw, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
|
|
[
|
|
marketplace_id,
|
|
name,
|
|
p.get("description"),
|
|
p.get("version"),
|
|
author_name,
|
|
p.get("homepage"),
|
|
p.get("category"),
|
|
source_type,
|
|
json.dumps(source_spec) if source_spec is not None else None,
|
|
json.dumps(p),
|
|
now,
|
|
],
|
|
)
|
|
self.conn.execute("COMMIT")
|
|
except Exception:
|
|
self.conn.execute("ROLLBACK")
|
|
raise
|
|
return sum(1 for p in plugins_list if (p.get("name") or "").strip())
|
|
|
|
def clear_for_marketplace(self, marketplace_id: str) -> None:
|
|
self.conn.execute(
|
|
"DELETE FROM marketplace_plugins WHERE marketplace_id = ?",
|
|
[marketplace_id],
|
|
)
|
|
|
|
|
|
def _classify_source(source: Optional[Any]) -> Optional[str]:
|
|
"""Return a coarse label for the `source` field of a plugin entry.
|
|
|
|
Matches the Claude Code marketplace spec (code.claude.com/docs/plugin-marketplaces):
|
|
relative-path string, or one of {github, url, git-subdir, npm}.
|
|
"""
|
|
if source is None:
|
|
return None
|
|
if isinstance(source, str):
|
|
return "path"
|
|
if isinstance(source, dict):
|
|
t = source.get("source")
|
|
if isinstance(t, str):
|
|
return t
|
|
return "unknown"
|