stardesign.directory Namespace Reference

Functions
list[dict]	_fetch_auth (str cookie)
list[dict]	_auth_roster (Request request)
list[dict]	roster (Request request, UserData ud)
dict[str, str]	display_names (Request request, UserData ud)

Variables
	TTL_SECONDS = float(os.environ.get("AUTH_USERS_TTL", "60"))
float	TIMEOUT_SECONDS = 3.0
	_lock = threading.Lock()
tuple	_cache = None

Detailed Description

Who a design can be shared with: the team roster.

Sharing needs a list of people, and the design tools have never had one -- they
only ever knew the single email in the request header. The roster here is the
**union** of two sources, and it needs both:

* **The auth service** (``AUTH_USERS_URL`` -> ``auth/main.py``'s ``/users``),
  which records everyone who has signed in. It is the only source of real
  display names; nothing on this side of the wire knows them.
* **The shared userdata volume** -- everyone who already has designs. Auth only
  learns about a person when they log in and sessions last 30 days, so for the
  first month after this ships the auth roster is missing most of the team. In
  dev there is no auth service at all. The volume scan covers both cases, which
  is what keeps ``./dev.sh`` working with nothing in front of it.

Auth being unset, down, or slow degrades this to the volume scan. It must never
break listing or editing designs.

**On making this app an authenticated-request forwarder.** The outbound call
carries exactly one header -- the caller's own session cookie, which Caddy has
already handed us -- and its URL comes from ``AUTH_USERS_URL`` in the
environment, never from the request. A caller can therefore influence *whether*
we ask auth, never *whom* we ask, which is what keeps this from being an SSRF
hole. Keep it that way: no request-supplied URLs, no header pass-through.

Function Documentation

_auth_roster()

list[dict] stardesign.directory._auth_roster ( Request request )

protected

:func:`_fetch_auth` behind a process-wide TTL cache.

Cached across callers, not per-cookie: every session that reaches this app
has already been verified by Caddy and would get the same answer. A failed
fetch caches ``[]`` for the same TTL, so an auth outage costs one attempt a
minute rather than one per request.

Definition at line 88 of file directory.py.

References _fetch_auth().

Referenced by roster().

_fetch_auth()

list[dict] stardesign.directory._fetch_auth ( str cookie )

protected

The auth service's roster, or ``[]`` if unset, unreachable, or garbage.

Definition at line 57 of file directory.py.

References decode().

Referenced by _auth_roster().

display_names()

dict[str, str] stardesign.directory.display_names	(	Request	request,
		UserData	ud )

``slug -> display name`` for labelling design owners; ``""`` when unknown.

Definition at line 125 of file directory.py.

References roster().

roster()

list[dict] stardesign.directory.roster	(	Request	request,
		UserData	ud )

Everyone a design can be shared with: ``[{email, name}]``, sorted.

Keyed on the path slug, so the same person arriving from both sources
collapses to one row -- and auth's spelling of the address wins, since the
volume only ever holds the slug.

Definition at line 107 of file directory.py.

References _auth_roster().

Referenced by display_names().

Variable Documentation

_cache

tuple stardesign.directory._cache = None

protected

Definition at line 54 of file directory.py.

_lock

stardesign.directory._lock = threading.Lock()

protected

Definition at line 47 of file directory.py.

TIMEOUT_SECONDS

float stardesign.directory.TIMEOUT_SECONDS = 3.0

Definition at line 45 of file directory.py.

TTL_SECONDS

stardesign.directory.TTL_SECONDS = float(os.environ.get("AUTH_USERS_TTL", "60"))

Definition at line 42 of file directory.py.