AppsManager

Class to manage the different apps.

Each app runs in its own dedicated process.

Attributes

app_dir: str | Nonerunning_processes: dict

Functions

consume_authorize_grant @classmethod

Consume an authorize grant and return the user id it names.

Confirms the grant was minted for this app before trusting it, so a grant for app A cannot be replayed on app B.

app_id : str

the app the grant must be bound to

grant : str

the single-use authorize grant (consumed here)

Return type : str

create_or_get_app @classmethod

app : AppInstance

Return type : AppInstanceUrl

create_or_get_app_async @classmethod

Create app asynchronously and return the app ID. The app will be started in background.

app : AppInstance

Return type : CreateAppAsyncResultDTO

exchange_app_code @classmethod

Consume a one-time app code and return a JWT + the resolved user id.

Called from the app (via POST /apps/exchange-code) to turn the gws_code it received in its URL into a JWT it carries on data lab API calls. The code is single-use (consumed here) and must match the app it was minted for.

app_id : str

the app the code is being exchanged for (must match the code binding)

code : str

the one-time code from the app URL

Return type : ExchangeAppCodeResponseDTO

find_app_by_resource_model_id @classmethod

Find the streamlit app that was generated from the given resource model id

resource_model_id : str

Return type : gws_core.apps.app_process.AppProcess | None

find_process_by_token @classmethod

Find the process that contains the app with the given token

token : str

Return type : gws_core.apps.app_process.AppProcess | None

generate_app_access_code @classmethod

Mint a short-lived, single-use code that authenticates a user to a specific app.

The code is put in the app URL as gws_code. The app relays it back to exchange_app_code (it cannot consume the code itself, being gws_core-free), which swaps it for a JWT. The code is bound to app_id so it cannot be replayed against another app.

user_id : str

the user the code authenticates

app_id : str

the app resource model id the code is valid for

validity_seconds : int - 60

code lifetime (single-use). Default 60s suits the gateway handoff (minted post-RUNNING, navigated immediately); pass URL_APP_CODE_VALIDITY_SECONDS when baking the code into the app URL up front (must survive a cold build before exchange).

Return type : str

generate_authorize_grant @classmethod

Mint the single-use authorize grant returned by the gateway authorize step.

Names the resolved user and is bound to app_id. The front replays it to handoff, which consumes it (consume_authorize_grant) to re-resolve the user without a lab session and mint the fresh app grant post-RUNNING.

user_id : str

the user resolved at authorize (lab session or space code)

app_id : str

the app the grant is bound to

Return type : str

get_app_dir @classmethod

Return type : str

get_logs_of_app @classmethod

Read the server log filtered by the app id

app_id : str

the resource model id of the app

from_page_date : datetime.datetime | None

the date to start reading from (for pagination)

Return type : LogsBetweenDates

get_status_dto @classmethod

Return type : AppsStatusDTO

init @classmethod

set_custom_subdomain @classmethod

Set (or clear) the custom subdomain on an app resource.

The value is validated and checked for DB-wide uniqueness by the resource setter. Passing a falsy value clears the custom subdomain and restores the default id-based host.

The custom subdomain is a front-only alias on the app host: the canonical id-based host is kept, and the custom host is added as an extra nginx server_name. If the app is currently running, the change is applied immediately (the front nginx service is re-registered and nginx reloaded); otherwise it takes effect on the next start.

app_id : str

the resource model id of the app

subdomain : str | None

the custom subdomain to apply, or None/"" to clear it

set_stop_policy @classmethod

Set the stop policy on an app resource and update the running process if any.

app_id : str

the resource model id of the app

stop_policy : AppStopPolicy

start_app_async @classmethod

(Cold-)start the app in background and return its process.

Unlike create_or_get_app_async, this builds no app URL, so it works in contexts where there is no current user (lab boot) and for callers that only need the process itself.

app : AppInstance

Return type : AppProcess

stop_all_processes @classmethod

Stop every running app process, concurrently.

Each stop_process() SIGTERMs the app's process group and then waits up to 5s for it to die before SIGKILLing survivors. Stopping apps sequentially would sum those waits and, with several apps, exceed uvicorn's shutdown-timeout — cutting shutdown short and leaving some apps as orphans (issue #97). Stopping them in parallel bounds the total wait to a single ~5s window regardless of app count.

stop_process @classmethod

app_id : str

user_has_access_to_app @classmethod

Return the user id from the user access token if the user has access to the app

app_id : str

user_access_token : str

Return type : str | None

validate_app_jwt @classmethod

Validate an app-scoped token (from the app's gws_app_jwt cookie) and return the user id.

Used on a fresh page load (F5 / new tab) to re-authenticate without a one-time code: the app stored the app token in a cookie on first load and relays it here. Validated as an app-scoped token bound to this app (typ:app + matching app_id), so a token minted for another app is rejected.

app_id : str

the app the token must be scoped to

jwt : str

the token (with or without the ``Bearer `` prefix)

Return type : ValidateAppJwtResponseDTO

Have you developed a brick?