Cross-graph share controls on the ledger client

.github/release-notes/v1.8.0.md

@@ -0,0 +1,46 @@
+Cross-graph report sharing gets its controls, on both sides.
+
+Sharing pushes a published report from one graph into another's books, across
+the organization boundary by design — a company distributing its quarterly
+statements to investors who are, by definition, somewhere else. Authorization
+is capability-style: possession of the recipient's `graph_id` is sufficient,
+because the only way to hold one is that the recipient handed it over.
+
+That model is only sound if the recipient can refuse. This release adds the
+methods that let them, and the one that lets a sender take a report back.
+
+## New on `LedgerClient`
+
+- **`block_source_graph(graph_id, source_graph_id, reason=None, purge=False)`**
+  — bars a sender from sharing reports into your graph. Read their id off the
+  `source_graph_id` provenance field of a report they sent you. Idempotent:
+  re-blocking preserves the original `blocked_at`. With `purge=True`, reports
+  already received from that sender are deleted along with their fact sets and
+  facts; reports you authored are never eligible. `reason` is a note for your
+  own records and is never disclosed to the sender. Purging requires the graph
+  admin role; plain blocking does not.
+- **`unblock_source_graph(graph_id, source_graph_id)`** — reopens the channel.
+  Purged reports are not restored: unblocking undoes the block, not the purge.
+  Requires the graph admin role.
+- **`revoke_report_share(graph_id, report_id, target_graph_id)`** — the
+  sender's half. Deletes the delivered copy from that recipient's books and
+  marks the share revoked. Scoped to one recipient, so a withdrawal is always
+  deliberate. A recipient who already deleted the copy is not an error — the
+  share is still marked revoked and `copy_deleted` returns `False`.
+- **`list_blocked_source_graphs(graph_id, limit=100, offset=0)`** — the read
+  side, returning who is blocked, by whom, when, and why.
+
+A report shared *in* from another graph can now also be deleted by an admin of
+the receiving graph. The copy carries the sender's user id, so the ordinary
+owner rule could never have matched anyone on the receiving side.
+
+## Generated tier
+
+`OrgUsageSummary` loses four fields: `total_api_calls`, `daily_avg_api_calls`,
+`projected_monthly_api_calls`, and `api_calls_limit`. The platform never
+populated them with anything but zero, and they have been removed upstream
+rather than left to imply a measurement that was not happening. If you read
+them, they were reporting nothing.
+
+No facade method changes shape, and nothing on the stable tier is removed or
+deprecated.

robosystems_client/api/extensions_robo_ledger/block_source_graph.py

@@ -0,0 +1,270 @@
+from http import HTTPStatus
+from typing import Any
+from urllib.parse import quote
+
+import httpx
+
+from ... import errors
+from ...client import AuthenticatedClient, Client
+from ...models.block_source_graph_operation import BlockSourceGraphOperation
+from ...models.error_response import ErrorResponse
+from ...models.operation_envelope_block_source_graph_result import (
+  OperationEnvelopeBlockSourceGraphResult,
+)
+from ...types import UNSET, Response, Unset
+
+
+def _get_kwargs(
+  graph_id: str,
+  *,
+  body: BlockSourceGraphOperation,
+  idempotency_key: None | str | Unset = UNSET,
+) -> dict[str, Any]:
+  headers: dict[str, Any] = {}
+  if not isinstance(idempotency_key, Unset):
+    headers["Idempotency-Key"] = idempotency_key
+
+  _kwargs: dict[str, Any] = {
+    "method": "post",
+    "url": "/extensions/roboledger/{graph_id}/operations/block-source-graph".format(
+      graph_id=quote(str(graph_id), safe=""),
+    ),
+  }
+
+  _kwargs["json"] = body.to_dict()
+
+  headers["Content-Type"] = "application/json"
+
+  _kwargs["headers"] = headers
+  return _kwargs
+
+
+def _parse_response(
+  *, client: AuthenticatedClient | Client, response: httpx.Response
+) -> ErrorResponse | OperationEnvelopeBlockSourceGraphResult | None:
+  if response.status_code == 200:
+    response_200 = OperationEnvelopeBlockSourceGraphResult.from_dict(response.json())
+
+    return response_200
+
+  if response.status_code == 400:
+    response_400 = ErrorResponse.from_dict(response.json())
+
+    return response_400
+
+  if response.status_code == 401:
+    response_401 = ErrorResponse.from_dict(response.json())
+
+    return response_401
+
+  if response.status_code == 403:
+    response_403 = ErrorResponse.from_dict(response.json())
+
+    return response_403
+
+  if response.status_code == 404:
+    response_404 = ErrorResponse.from_dict(response.json())
+
+    return response_404
+
+  if response.status_code == 409:
+    response_409 = ErrorResponse.from_dict(response.json())
+
+    return response_409
+
+  if response.status_code == 422:
+    response_422 = ErrorResponse.from_dict(response.json())
+
+    return response_422
+
+  if response.status_code == 429:
+    response_429 = ErrorResponse.from_dict(response.json())
+
+    return response_429
+
+  if response.status_code == 500:
+    response_500 = ErrorResponse.from_dict(response.json())
+
+    return response_500
+
+  if client.raise_on_unexpected_status:
+    raise errors.UnexpectedStatus(response.status_code, response.content)
+  else:
+    return None
+
+
+def _build_response(
+  *, client: AuthenticatedClient | Client, response: httpx.Response
+) -> Response[ErrorResponse | OperationEnvelopeBlockSourceGraphResult]:
+  return Response(
+    status_code=HTTPStatus(response.status_code),
+    content=response.content,
+    headers=response.headers,
+    parsed=_parse_response(client=client, response=response),
+  )
+
+
+def sync_detailed(
+  graph_id: str,
+  *,
+  client: AuthenticatedClient,
+  body: BlockSourceGraphOperation,
+  idempotency_key: None | str | Unset = UNSET,
+) -> Response[ErrorResponse | OperationEnvelopeBlockSourceGraphResult]:
+  """Block Source Graph
+
+   Bars a graph from sharing reports into this one. Subsequent `share-report` calls naming this graph
+  fail for this target with an explicit error — blocked senders are told, not silently dropped.
+  Idempotent: re-blocking preserves the original `blocked_at`. Set `purge` to also delete every report
+  already shared in from that source, along with its fact sets and facts; reports this graph authored
+  are never touched.
+
+  **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
+  return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
+
+  Args:
+      graph_id (str):
+      idempotency_key (None | str | Unset):
+      body (BlockSourceGraphOperation): Bar a graph from sharing reports into this one.
+
+  Raises:
+      errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+      httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+  Returns:
+      Response[ErrorResponse | OperationEnvelopeBlockSourceGraphResult]
+  """
+
+  kwargs = _get_kwargs(
+    graph_id=graph_id,
+    body=body,
+    idempotency_key=idempotency_key,
+  )
+
+  response = client.get_httpx_client().request(
+    **kwargs,
+  )
+
+  return _build_response(client=client, response=response)
+
+
+def sync(
+  graph_id: str,
+  *,
+  client: AuthenticatedClient,
+  body: BlockSourceGraphOperation,
+  idempotency_key: None | str | Unset = UNSET,
+) -> ErrorResponse | OperationEnvelopeBlockSourceGraphResult | None:
+  """Block Source Graph
+
+   Bars a graph from sharing reports into this one. Subsequent `share-report` calls naming this graph
+  fail for this target with an explicit error — blocked senders are told, not silently dropped.
+  Idempotent: re-blocking preserves the original `blocked_at`. Set `purge` to also delete every report
+  already shared in from that source, along with its fact sets and facts; reports this graph authored
+  are never touched.
+
+  **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
+  return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
+
+  Args:
+      graph_id (str):
+      idempotency_key (None | str | Unset):
+      body (BlockSourceGraphOperation): Bar a graph from sharing reports into this one.
+
+  Raises:
+      errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+      httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+  Returns:
+      ErrorResponse | OperationEnvelopeBlockSourceGraphResult
+  """
+
+  return sync_detailed(
+    graph_id=graph_id,
+    client=client,
+    body=body,
+    idempotency_key=idempotency_key,
+  ).parsed
+
+
+async def asyncio_detailed(
+  graph_id: str,
+  *,
+  client: AuthenticatedClient,
+  body: BlockSourceGraphOperation,
+  idempotency_key: None | str | Unset = UNSET,
+) -> Response[ErrorResponse | OperationEnvelopeBlockSourceGraphResult]:
+  """Block Source Graph
+
+   Bars a graph from sharing reports into this one. Subsequent `share-report` calls naming this graph
+  fail for this target with an explicit error — blocked senders are told, not silently dropped.
+  Idempotent: re-blocking preserves the original `blocked_at`. Set `purge` to also delete every report
+  already shared in from that source, along with its fact sets and facts; reports this graph authored
+  are never touched.
+
+  **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
+  return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
+
+  Args:
+      graph_id (str):
+      idempotency_key (None | str | Unset):
+      body (BlockSourceGraphOperation): Bar a graph from sharing reports into this one.
+
+  Raises:
+      errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+      httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+  Returns:
+      Response[ErrorResponse | OperationEnvelopeBlockSourceGraphResult]
+  """
+
+  kwargs = _get_kwargs(
+    graph_id=graph_id,
+    body=body,
+    idempotency_key=idempotency_key,
+  )
+
+  response = await client.get_async_httpx_client().request(**kwargs)
+
+  return _build_response(client=client, response=response)
+
+
+async def asyncio(
+  graph_id: str,
+  *,
+  client: AuthenticatedClient,
+  body: BlockSourceGraphOperation,
+  idempotency_key: None | str | Unset = UNSET,
+) -> ErrorResponse | OperationEnvelopeBlockSourceGraphResult | None:
+  """Block Source Graph
+
+   Bars a graph from sharing reports into this one. Subsequent `share-report` calls naming this graph
+  fail for this target with an explicit error — blocked senders are told, not silently dropped.
+  Idempotent: re-blocking preserves the original `blocked_at`. Set `purge` to also delete every report
+  already shared in from that source, along with its fact sets and facts; reports this graph authored
+  are never touched.
+
+  **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
+  return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
+
+  Args:
+      graph_id (str):
+      idempotency_key (None | str | Unset):
+      body (BlockSourceGraphOperation): Bar a graph from sharing reports into this one.
+
+  Raises:
+      errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+      httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+  Returns:
+      ErrorResponse | OperationEnvelopeBlockSourceGraphResult
+  """
+
+  return (
+    await asyncio_detailed(
+      graph_id=graph_id,
+      client=client,
+      body=body,
+      idempotency_key=idempotency_key,
+    )
+  ).parsed

robosystems_client/api/extensions_robo_ledger/delete_report.py

@@ -111,7 +111,10 @@ def sync_detailed(
 ) -> Response[ErrorResponse | OperationEnvelopeDeleteResult]:
   """Delete Report
 
-   Deletes the report definition and all generated facts.
+   Deletes the report definition and all generated facts. Normally restricted to the report's creator.
+  A report shared in from another graph carries the sender's user id in `created_by`, so those may be
+  deleted by any admin of the receiving graph — the recipient's exit from an unsolicited share.
+  Deleting a shared copy does not affect the sender's record that they sent it.
 
   **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
   return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
@@ -151,7 +154,10 @@ def sync(
 ) -> ErrorResponse | OperationEnvelopeDeleteResult | None:
   """Delete Report
 
-   Deletes the report definition and all generated facts.
+   Deletes the report definition and all generated facts. Normally restricted to the report's creator.
+  A report shared in from another graph carries the sender's user id in `created_by`, so those may be
+  deleted by any admin of the receiving graph — the recipient's exit from an unsolicited share.
+  Deleting a shared copy does not affect the sender's record that they sent it.
 
   **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
   return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
@@ -186,7 +192,10 @@ async def asyncio_detailed(
 ) -> Response[ErrorResponse | OperationEnvelopeDeleteResult]:
   """Delete Report
 
-   Deletes the report definition and all generated facts.
+   Deletes the report definition and all generated facts. Normally restricted to the report's creator.
+  A report shared in from another graph carries the sender's user id in `created_by`, so those may be
+  deleted by any admin of the receiving graph — the recipient's exit from an unsolicited share.
+  Deleting a shared copy does not affect the sender's record that they sent it.
 
   **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
   return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.
@@ -224,7 +233,10 @@ async def asyncio(
 ) -> ErrorResponse | OperationEnvelopeDeleteResult | None:
   """Delete Report
 
-   Deletes the report definition and all generated facts.
+   Deletes the report definition and all generated facts. Normally restricted to the report's creator.
+  A report shared in from another graph carries the sender's user id in `created_by`, so those may be
+  deleted by any admin of the receiving graph — the recipient's exit from an unsolicited share.
+  Deleting a shared copy does not affect the sender's record that they sent it.
 
   **Idempotency**: supply an `Idempotency-Key` header to make safe retries; replays within 24 hours
   return the same envelope. Reusing the key with a different body returns HTTP 409 Conflict.