justin
c5631d3eab
Provenance had no system-level owner: ownership was only per-tree (TreeMembership), so a self-hosted instance had no operator account and no instance-admin surface. This adds one, declared by environment per the project's twelve-factor rule. - OWNER_EMAIL (comma-separated): the account(s) named here are instance owners. Derived at request time — no DB column, no migration, can't drift from the env, survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py. - Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION). Registration is open, so without this an attacker could seize the role by registering the owner address first; verification ties it to inbox control. - GET /api/v1/admin/instance (owner-only): operational status — version, env, user/tree counts, configured AI providers. Deliberately exposes no tree data or PII: instance ownership is an operator role, NOT a privacy-engine bypass. - /users/me reports is_instance_owner; frontend gains an owner-only /admin page and a conditional sidebar link (server-enforced, not just client-hidden). Found-and-fixed by an adversarial security review before merge: the verified-email land-grab (above) and a frontend null-deref where the admin page crashed on 401/5xx instead of failing closed. Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and the verified-email requirement). Tests: owner matching, the land-grab guard, /users/me, and owner-only /admin. Suite 96 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Justin Paul <justin@jpaul.me>
21 lines
664 B
Python
21 lines
664 B
Python
"""Instance-admin schemas. Operator-facing, owner-only — operational status and
|
|
config, never tree data or PII (instance ownership doesn't bypass privacy)."""
|
|
|
|
from pydantic import BaseModel
|
|
|
|
from app.schemas.ai_policy import ConfiguredProvider
|
|
|
|
|
|
class InstanceStatus(BaseModel):
|
|
version: str
|
|
env: str
|
|
# Operator account(s) — the email(s) named in OWNER_EMAIL.
|
|
owner_emails: list[str]
|
|
require_email_verification: bool
|
|
# Aggregate, non-identifying counts (live rows only).
|
|
user_count: int
|
|
tree_count: int
|
|
# Instance-wide AI configuration (no secrets).
|
|
default_llm_provider: str
|
|
ai_providers: list[ConfiguredProvider]
|