Revert "fix: updating metric library"

[TEJASNARAYANS]

This reverts commit f663650.

Co-authored-by: Cursor cursoragent@cursor.com

[greptile-apps]

Greptile Summary

This revert removes Metrics Studio, platform administration, gated signup, draft-metric lifecycle support, and their associated backend, frontend, worker, migration, documentation, and test code. It also restores the earlier metric-management implementation and authentication behavior.

• Removes Metrics Studio routes, workers, models, UI, documentation, and tests.
• Removes platform-admin organization management and signup-code functionality.
• Removes draft lifecycle APIs and filtering from metric management and evaluation.
• Removes organization-active enforcement across authentication methods.

Confidence Score: 4/5

This PR should not merge until gated-signup enforcement, disabled-organization access revocation, and safe handling of retained draft metrics are restored or explicitly migrated.

The revert makes previously configured signup restrictions inert, allows credentials tied to already-disabled organizations to authenticate, and exposes retained draft metrics to ordinary management and evaluation flows.

Files Needing Attention: app/api/v1/routes/auth.py, app/core/auth/api_key.py, app/core/auth/local.py, app/core/auth/oidc_common.py, app/models/database.py, app/api/v1/routes/metrics.py, app/api/v1/routes/call_import_evaluations.py

Security Review

The revert removes two access-control boundaries: configured reference-code signup gating and disabled-organization enforcement. Existing gated-signup deployments become open to unauthenticated organization provisioning, while credentials associated with previously disabled organizations can authenticate again.

Important Files Changed

Filename	Overview
app/api/v1/routes/auth.py	Removes gated-signup validation and inactive-organization checks from login, refresh, and organization switching, reopening account provisioning and disabled-tenant sessions.
app/core/auth/api_key.py	Returns organization-scoped principals without enforcing the organization’s persisted disabled state.
app/core/auth/local.py	Validates users and memberships but no longer rejects sessions scoped to disabled organizations.
app/models/database.py	Removes platform-admin, organization-active, metric-lifecycle, and Metrics Studio model mappings while upgraded databases can retain the corresponding state.
app/api/v1/routes/metrics.py	Removes draft creation/promotion behavior and lifecycle filtering, causing retained drafts to appear as ordinary metrics.
app/api/v1/routes/call_import_evaluations.py	Removes the explicit guard that prevented draft metrics from entering production call-import evaluations.
app/api/v1/routes/metric_studio.py	Deletes the Metrics Studio API as part of the feature revert.
app/api/v1/routes/platform_admin.py	Deletes platform-admin APIs, including organization disablement and signup-code management.
frontend/src/App.tsx	Removes Metrics Studio and platform-admin routes consistently with the deleted frontend pages.
frontend/src/lib/api.ts	Removes client contracts for the reverted Metrics Studio, platform-admin, gated-signup, and draft-lifecycle APIs.

Comments Outside Diff (2)

1. app/core/auth/api_key.py, line 40-43 (link)

   Disabled organization access restored

   If an upgraded database contains an organization previously marked inactive, valid API keys, local sessions, refresh tokens, memberships, and OIDC identities for that tenant can again produce principals or fresh tokens, restoring access to protected resources that organization disablement was intended to revoke. How this was verified: Every organization-active check and the mapped Organization.is_active field were removed, while the authentication paths still return organization-scoped principals or tokens.

2. app/api/v1/routes/metrics.py, line 868-880 (link)

   Draft lifecycle boundary removed

   If an upgraded database contains metrics created as drafts before this revert, this unfiltered query exposes them as ordinary metrics and the normal update path can enable them, causing unfinished definitions to enter production call-import evaluations even though the promotion API has been removed.

_{Reviews (1): Last reviewed commit: "Revert "fix: updating metric library"" | Re-trigger Greptile}

[greptile-apps]

Gated signup enforcement removed

If an existing local-password deployment retains its gated-signup configuration, that setting is now ignored and POST /auth/signup provisions an administrator, organization, workspace, billing customer, and authenticated session without validating a reference code. How this was verified: The public signup route now proceeds directly from AUTH_LOCAL_ALLOW_SIGNUP to account creation, with no remaining reference-code enforcement in the repository.