Skip to content

Revert "fix: updating metric library" - #110

Closed
TEJASNARAYANS wants to merge 1 commit into
mainfrom
metric-library
Closed

Revert "fix: updating metric library"#110
TEJASNARAYANS wants to merge 1 commit into
mainfrom
metric-library

Conversation

@TEJASNARAYANS

@TEJASNARAYANS TEJASNARAYANS commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

This reverts commit f663650.

What Changed?

Briefly describe what this PR changes.

Why?

Explain the problem this solves and why this approach was chosen.

How to Test?

List clear steps for reviewers to verify the change.

Release Label

Select one semantic version bump intent for this PR:

  • major - breaking change, next release bumps major version
  • minor - backward-compatible feature, next release bumps minor version
  • fix - backward-compatible bug fix, next release bumps patch version
  • No label (defaults to patch release)

If you do not have permission to apply labels, mention the intended release label here and a maintainer will set it.

Checklist

  • I have read the CONTRIBUTING.md guide.
  • My code follows the project's style guidelines.
  • I have added tests that prove my fix is effective or my feature works.
  • I have updated documentation where needed.

@TEJASNARAYANS TEJASNARAYANS added the fix Fix version release label Aug 5, 2026
@greptile-apps

greptile-apps Bot commented Aug 5, 2026

Copy link
Copy Markdown

Greptile Summary

This PR reverts the Metrics Studio, platform administration, gated-signup, and metric-draft functionality introduced by the preceding commit.

  • Removes Metrics Studio routes, workers, persistence models, frontend pages, and tests.
  • Removes platform-admin organization controls and reference-code-gated signup.
  • Restores the prior metric management API and frontend.
  • Also removes disabled-organization enforcement from authentication paths, allowing previously suspended tenants to authenticate again.

Confidence Score: 4/5

The authentication regression must be fixed before merging because organizations disabled before this revert can regain access through every supported credential flow.

Applied migrations are not downgraded when their files are deleted, but the revert removes every runtime check of the retained organization-disabled state before issuing or accepting organization-scoped principals.

Files Needing Attention: app/core/auth/api_key.py, app/core/auth/local.py, app/core/auth/oidc_common.py, app/api/v1/routes/auth.py

Security Review

Disabled organizations retained in upgraded databases can authenticate again through API keys, local sessions, OIDC, refresh tokens, and organization switching because all organization-active guards are removed. How this was verified: The changed authentication paths construct or issue organization-scoped principals without any remaining check of the persisted organization-disabled state.

Important Files Changed

Filename Overview
app/core/auth/api_key.py Removes the organization-active guard, allowing existing keys for previously disabled tenants to authenticate.
app/core/auth/local.py Removes the disabled-organization check from local bearer-token authentication.
app/core/auth/oidc_common.py Allows OIDC identities mapped to previously disabled organizations to receive principals.
app/api/v1/routes/auth.py Removes disabled-organization filtering from login, refresh, and organization-switching flows.
app/api/v1/routes/metrics.py Reverts draft lifecycle endpoints and filtering; persisted draft rows may remain but are disabled.
app/models/database.py Removes platform administration, draft lifecycle, and Metrics Studio ORM models while deployed databases may retain their schema.
frontend/src/App.tsx Removes platform administration and Metrics Studio routes and restores the previous metrics pages.
app/migrations/057_platform_admin.py Deletes the migration file without downgrading already-upgraded databases, preserving prior disabled-organization state.

Reviews (1): Last reviewed commit: "Revert "fix: updating metric library"" | Re-trigger Greptile

Comment thread app/core/auth/api_key.py
@@ -38,8 +37,6 @@ def authenticate(self, cred: RawCredential, db: Session) -> Principal:
if not db_key:
raise AuthError("Invalid API key")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Disabled organization access bypass

If a database contains an organization disabled before this revert, API-key, local, OIDC, refresh-token, and organization-switching flows now issue or accept organization-scoped principals without checking the retained disabled state, causing suspended users and clients to regain access to the tenant's routes and data.

How this was verified: Every changed authentication path reaches principal construction or token issuance without any remaining organization-active guard.

@TEJASNARAYANS

Copy link
Copy Markdown
Contributor Author

Closing: revert already merged to main via #109. Feature changes will land via new PR from feat/metric-library.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Fix version release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant