Add Env UI and rename put_secret to set_secret (#756)

oeway · web-flow · commit b576b09b060f · 2025-06-27T04:22:03.000+02:00
* support get/set env and secret

* fix permission

* enhance get_secret

* add env ui; change put_secret to set_secret

* Bump hypha-rpc version to 0.20.58

* Limit token client_id

* Enhance UI for token generation
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,9 @@
 
 ### 0.20.55
 
- - Add `get_secret` and `put_secret` to the artifact manager to allow storing and retrieving secret values in the artifact.
+ - Add `get_secret` and `set_secret` to the artifact manager to allow storing and retrieving secret values in the artifact.
  - Add `set_env` and `get_env` to workspace to allow setting and retrieving environment variables in the workspace.
+ - Provide environment variables in the web ui.
 
 ### 0.20.41
 
diff --git a/docker-compose/README.md b/docker-compose/README.md
@@ -45,7 +45,7 @@ This directory contains a Docker Compose setup for running Hypha Server with Min
 
 The Hypha Server provides the backend API for the Hypha application.
 
-- Image: `ghcr.io/amun-ai/hypha:0.20.55`
+- Image: `ghcr.io/amun-ai/hypha:0.20.58`
 - Port: 9520
 - Data: Stored in the local directory `./data/hypha`
 
diff --git a/docker-compose/docker-compose.yml b/docker-compose/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   hypha-server:
-    image: ghcr.io/amun-ai/hypha:0.20.55
+    image: ghcr.io/amun-ai/hypha:0.20.58
     ports:
       - "${HYPHA_PORT:-9527}:9527"
     environment:
diff --git a/docs/artifact-manager.md b/docs/artifact-manager.md
@@ -973,16 +973,15 @@ else:
 ```
 
 ---
+### `set_secret(artifact_id: str, secret_key: str, secret_value: str) -> None`
 
-### `put_secret(artifact_id: str, secret_key: str, secret_value: str) -> None`
-
-Sets a secret value for an artifact. This operation requires read_write permissions.
+Sets or removes a secret value for an artifact. This operation requires read_write permissions.
 
 **Parameters:**
 
 - `artifact_id`: The id of the artifact to store the secret in. It can be a UUID generated by `create` or `edit` function, or it can be an alias of the artifact under the current workspace. If you want to refer to an artifact in another workspace, you should use the full alias in the format of `"workspace_id/alias"`.
 - `secret_key`: The key name for the secret.
-- `secret_value`: The secret value to store. Can be a string or `None`.
+- `secret_value`: The secret value to store. Can be a string or `None`. If set to `None`, the secret key will be removed from the artifact.
 
 **Permissions:**
 
@@ -992,21 +991,21 @@ Sets a secret value for an artifact. This operation requires read_write permissi
 
 ```python
 # Set a secret value for an artifact
-await artifact_manager.put_secret(
+await artifact_manager.set_secret(
     artifact_id="example-dataset",
     secret_key="API_KEY",
     secret_value="your-secret-api-key"
 )
 
 # Update an existing secret
-await artifact_manager.put_secret(
+await artifact_manager.set_secret(
     artifact_id="example-dataset",
     secret_key="API_KEY",
     secret_value="updated-secret-api-key"
 )
 
 # Set a secret to None (effectively removing it)
-await artifact_manager.put_secret(
+await artifact_manager.set_secret(
     artifact_id="example-dataset",
     secret_key="API_KEY",
     secret_value=None
diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -265,7 +265,7 @@ npm install hypha-rpc
 Or include it via CDN in your HTML file:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 ```
 
 Then use the following JavaScript code to register a service:
@@ -396,7 +396,7 @@ svc = await get_remote_service("http://localhost:9527/ws-user-scintillating-lawy
 Include the following script in your HTML file to load the `hypha-rpc` client:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 ```
 
 Use the following code in JavaScript to connect to the server and access an existing service:
@@ -618,6 +618,8 @@ async def main():
     # Set environment variables
     await server.set_env("DATABASE_URL", "postgres://localhost:5432/mydb")
     await server.set_env("API_KEY", "your-secret-key")
+    # Remove an environment variable
+    await server.set_env("API_KEY", None)
     
     # Get a specific environment variable
     db_url = await server.get_env("DATABASE_URL")
@@ -643,11 +645,12 @@ async function main() {
     });
     
     // Set environment variables
-    await server.setEnv("DATABASE_URL", "postgres://localhost:5432/mydb");
-    await server.setEnv("API_KEY", "your-secret-key");
-    
+    await server.setEnv({key: "DATABASE_URL", value: "postgres://localhost:5432/mydb", _rkwargs: true});
+    await server.setEnv({key: "API_KEY", value: "your-secret-key", _rkwargs: true});
+    // Remove an environment variable
+    await server.setEnv({key: "API_KEY", value: null, _rkwargs: true});
     // Get a specific environment variable
-    const dbUrl = await server.getEnv("DATABASE_URL");
+    const dbUrl = await server.getEnv({key: "DATABASE_URL", value: null, _rkwargs: true});
     console.log("Database URL:", dbUrl);
     
     // Get all environment variables
diff --git a/docs/migration-guide.md b/docs/migration-guide.md
@@ -15,7 +15,7 @@ To connect to the server, instead of installing the `imjoy-rpc` module, you will
 pip install -U hypha-rpc # new install
 ```
 
-We also changed our versioning strategy, we use the same version number for the server and client, so it's easier to match the client and server versions. For example, `hypha-rpc` version `0.20.55` is compatible with Hypha server version `0.20.55`.
+We also changed our versioning strategy, we use the same version number for the server and client, so it's easier to match the client and server versions. For example, `hypha-rpc` version `0.20.58` is compatible with Hypha server version `0.20.58`.
 
 #### 2. Change the imports to use `hypha-rpc`
 
@@ -128,10 +128,10 @@ loop.run_forever()
 To connect to the server, instead of using the `imjoy-rpc` module, you will need to use the `hypha-rpc` module. The `hypha-rpc` module is a standalone module that provides the RPC connection to the Hypha server. You can include it in your HTML using a script tag:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 ```
 
-We also changed our versioning strategy, we use the same version number for the server and client, so it's easier to match the client and server versions. For example, `hypha-rpc` version `0.20.55` is compatible with Hypha server version `0.20.55`.
+We also changed our versioning strategy, we use the same version number for the server and client, so it's easier to match the client and server versions. For example, `hypha-rpc` version `0.20.58` is compatible with Hypha server version `0.20.58`.
 
 #### 2. Change the connection method and use camelCase for service function names
 
@@ -149,7 +149,7 @@ Here is a suggested list of search and replace operations to update your code:
 Here is an example of how the updated code might look:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 <script>
 async function main(){
     const server = await hyphaWebsocketClient.connectToServer({"server_url": "https://hypha.amun.ai"});
@@ -197,7 +197,7 @@ We created a tutorial to introduce this new feature: [service type annotation](.
 Here is a quick example in JavaScript:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 
 <script>
 async function main(){
diff --git a/docs/quick-guide.md b/docs/quick-guide.md
@@ -48,7 +48,7 @@ if __name__ == "__main__":
 ### JavaScript
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 <script>
 async function registerService() {
     const server = await hyphaWebsocketClient.connectToServer({
@@ -106,7 +106,7 @@ if __name__ == "__main__":
 ### JavaScript Client
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 <script>
 async function useService() {
     const server = await hyphaWebsocketClient.connectToServer({
diff --git a/docs/service-type-annotation.md b/docs/service-type-annotation.md
@@ -134,7 +134,7 @@ if __name__ == "__main__":
 **JavaScript Client: Service Usage**
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
 <script>
 async function main() {
     const server = await hyphaWebsocketClient.connectToServer({"server_url": "https://hypha.amun.ai"});
diff --git a/helm-charts/aks-hypha.md b/helm-charts/aks-hypha.md
@@ -146,7 +146,7 @@ replicaCount: 1
 image:
   repository: ghcr.io/amun-ai/hypha
   pullPolicy: IfNotPresent
-  tag: "0.20.55"
+  tag: "0.20.58"
 
 serviceAccount:
   create: true
diff --git a/helm-charts/hypha-server/Chart.yaml b/helm-charts/hypha-server/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.20.55
+version: 0.20.58
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
diff --git a/helm-charts/hypha-server/values.yaml b/helm-charts/hypha-server/values.yaml
@@ -8,7 +8,7 @@ image:
   repository: ghcr.io/amun-ai/hypha
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: "0.20.55"
+  tag: "0.20.58"
 
 imagePullSecrets: []
 nameOverride: ""
diff --git a/hypha/VERSION b/hypha/VERSION
@@ -1,3 +1,3 @@
 {
-    "version": "0.20.55"
+    "version": "0.20.58"
 }
diff --git a/hypha/artifact.py b/hypha/artifact.py
@@ -1127,7 +1127,7 @@ async def _get_artifact_with_permission(
             "put_file": UserPermission.read_write,
             "remove_vectors": UserPermission.read_write,
             "remove_file": UserPermission.read_write,
-            "put_secret": UserPermission.read_write,
+            "set_secret": UserPermission.read_write,
             "delete": UserPermission.admin,
             "reset_stats": UserPermission.admin,
             "publish": UserPermission.admin,
@@ -3610,7 +3610,7 @@ async def get_secret(
         finally:
             await session.close()
 
-    async def put_secret(
+    async def set_secret(
         self,
         artifact_id: str,
         secret_key: str,
@@ -3627,15 +3627,21 @@ async def put_secret(
         try:
             async with session.begin():
                 artifact, _ = await self._get_artifact_with_permission(
-                    user_info, artifact_id, "put_secret", session
+                    user_info, artifact_id, "set_secret", session
                 )
                 
                 # Initialize secrets dict if it doesn't exist
                 if artifact.secrets is None:
                     artifact.secrets = {}
-                
-                # Update the secret
-                artifact.secrets[secret_key] = secret_value
+                # Update or remove the secret
+                if secret_value is None:
+                    if secret_key in artifact.secrets:
+                        del artifact.secrets[secret_key]
+                        logger.info(f"Removed secret '{secret_key}' from artifact {artifact_id}")
+                else:
+                    artifact.secrets[secret_key] = secret_value
+                    logger.info(f"Updated secret '{secret_key}' for artifact {artifact_id}")
+
                 artifact.last_modified = int(time.time())
                 
                 # Mark the field as modified for SQLAlchemy
@@ -3645,7 +3651,7 @@ async def put_secret(
                 await session.commit()
                 
                 logger.info(f"Updated secret '{secret_key}' for artifact {artifact_id}")
-                
+
         except Exception as e:
             raise e
         finally:
@@ -3677,5 +3683,5 @@ def get_artifact_service(self):
             "list_vectors": self.list_vectors,
             "publish": self.publish,
             "get_secret": self.get_secret,
-            "put_secret": self.put_secret,
+            "set_secret": self.set_secret,
         }
diff --git a/hypha/core/__init__.py b/hypha/core/__init__.py
@@ -437,6 +437,7 @@ class TokenConfig(BaseModel):
         pattern="^(read|read_write|admin)$",
     )
     extra_scopes: Optional[List[str]] = Field(None, description="List of extra scopes")
+    client_id: Optional[str] = Field(None, description="Optional client ID to restrict the token to a specific client")
 
     @field_validator("extra_scopes")
     def validate_scopes(cls, v):
diff --git a/hypha/core/workspace.py b/hypha/core/workspace.py
@@ -393,11 +393,18 @@ async def set_env(
         workspace_info.config = workspace_info.config or {}
         if "environs" not in workspace_info.config:
             workspace_info.config["environs"] = {}
-        
-        workspace_info.config["environs"][key] = value
+
+        if value is None:
+            if key in workspace_info.config["environs"]:
+                del workspace_info.config["environs"][key]
+                await self.log_event("env_removed", {"key": key}, context=context)
+                logger.info(f"Environment variable '{key}' removed from workspace {ws}")
+        else:
+            workspace_info.config["environs"][key] = value
+            await self.log_event("env_set", {"key": key}, context=context)
+            logger.info(f"Environment variable '{key}' set in workspace {ws}")
+            
         await self._update_workspace(workspace_info, user_info)
-        await self.log_event("env_set", {"key": key}, context=context)
-        logger.info(f"Environment variable '{key}' set in workspace {ws}")
 
     @schema_method
     async def get_env(
@@ -810,6 +817,7 @@ async def generate_token(
         user_info.scope = create_scope(
             {allowed_workspace: permission},
             current_workspace=allowed_workspace,
+            client_id=config.client_id,
             extra_scopes=extra_scopes,
         )
         config.expires_in = config.expires_in or 3600
diff --git a/hypha/templates/hypha-core-app/hypha-app-iframe.html b/hypha/templates/hypha-core-app/hypha-app-iframe.html
@@ -9,7 +9,7 @@
             overflow: hidden;
         }
     </style>
-    <script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.55/dist/hypha-rpc-websocket.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/hypha-rpc@0.20.58/dist/hypha-rpc-websocket.min.js"></script>
     <script>
         hyphaWebsocketClient.setupLocalClient({enable_execution: true}).then((api)=>{
             console.log("Hypha client is ready", api)
diff --git a/hypha/templates/hypha-core-app/hypha-app-webpython.js b/hypha/templates/hypha-core-app/hypha-app-webpython.js
@@ -27,7 +27,7 @@ loadPyodide().then(async (pyodide) => {
     pyodide.setStderr({ batched: (msg) => console.error(msg) });
     await pyodide.loadPackage("micropip");
     const micropip = pyodide.pyimport("micropip");
-    await micropip.install('hypha-rpc==0.20.55');
+    await micropip.install('hypha-rpc==0.20.58');
     const isWindow = typeof window !== "undefined";
     
     setTimeout(() => {
diff --git a/hypha/templates/hypha-core-app/hypha-app-webworker.js b/hypha/templates/hypha-core-app/hypha-app-webworker.js
diff --git a/hypha/templates/ws/index.html b/hypha/templates/ws/index.html
diff --git a/hypha/websocket.py b/hypha/websocket.py
diff --git a/requirements.txt b/requirements.txt
diff --git a/setup.py b/setup.py
diff --git a/tests/test_artifact.py b/tests/test_artifact.py
diff --git a/tests/test_token.py b/tests/test_token.py
