Fixes and improvements

.env.template

@@ -12,11 +12,18 @@ SANDBOX=local              # code execution backend: 'local' (default) or 'docke
 # LOG_LEVEL=INFO           # logging level for data_formulator modules (DEBUG, INFO, WARNING, ERROR)
 
 # --- Feature gates ---
-# Disable external data connectors (MySQL, PostgreSQL, etc.).
-# Recommended for multi-user anonymous deployments to prevent credential exposure.
+# Enable administrator-managed resources and the Administration navigation page.
+# Default: off. Authentication, storage, and sandbox are configured independently.
+# DF_MANAGED=false
+# Hosted administrators must have verified identities; anonymous IDs are not accepted.
+# DF_ADMIN_IDENTITIES=user:<verified-admin-subject>
+# Fresh managed installs default to configured resources only; admins may relax this.
+# The flags below enforce restrictions even when managed mode is off.
+# Allow configured data connectors only; block user-created connections.
 # DISABLE_DATA_CONNECTORS=false
 
-# Prevent users from adding custom LLM endpoints via the UI.\n# Only server-configured models (below) will be available.\n# DISABLE_CUSTOM_MODELS=false
+# Prevent users from adding custom LLM endpoints; configured models remain available.
+# DISABLE_CUSTOM_MODELS=false
 
 # Flask session secret key — used to sign cookies and encrypt session data.
 # Required for SSO and plugin auth (Superset, etc.). Generate one with:
@@ -47,42 +54,46 @@ SANDBOX=local              # code execution backend: 'local' (default) or 'docke
 #   └── cache/                   (local cache, only for azure_blob backend)
 # DATA_FORMULATOR_HOME=
 
-# Available UI languages (optional, comma-separated).
-# Default: en,zh — if not set, both English and Chinese are available.
-# Supported values: en, zh  (add more after creating locale files)
-# Examples:
-#   AVAILABLE_LANGUAGES=zh          # only Chinese, language switcher hidden
-#   AVAILABLE_LANGUAGES=en,zh,ja    # three languages
-# AVAILABLE_LANGUAGES=
-
 # -------------------------------------------------------------------
 # LLM provider API keys
 # -------------------------------------------------------------------
-# Enable providers and set API keys / models below.
+# A provider is enabled when {PROVIDER}_MODELS is set together with
+# {PROVIDER}_API_KEY and/or {PROVIDER}_API_BASE. Uncomment and fill in the
+# providers you want to use.
 # For details see: https://docs.litellm.ai/docs#litellm-python-sdk
 
 # OpenAI
-OPENAI_ENABLED=true
-OPENAI_API_KEY=#your-openai-api-key
-OPENAI_MODELS=gpt-5.5 # comma separated list of models
+# OPENAI_API_KEY=<your-openai-api-key>
+# OPENAI_MODELS=gpt-5.5 # comma separated list of models
 
 # Azure OpenAI
-AZURE_ENABLED=true
-AZURE_API_KEY=#your-azure-openai-api-key
-AZURE_API_BASE=https://your-azure-openai-endpoint.openai.azure.com/
-AZURE_MODELS=gpt-5.4
+# AZURE_API_KEY=<your-azure-openai-api-key>
+# AZURE_API_BASE=https://your-azure-openai-endpoint.openai.azure.com/
+# AZURE_MODELS=gpt-5.4
 
 # Anthropic
-ANTHROPIC_ENABLED=true
-ANTHROPIC_API_KEY=#your-anthropic-api-key
-ANTHROPIC_MODELS=claude-sonnet-4-20250514
+# ANTHROPIC_API_KEY=<your-anthropic-api-key>
+# ANTHROPIC_MODELS=claude-sonnet-4-20250514
 
 # Ollama
-OLLAMA_ENABLED=true
-OLLAMA_API_BASE=http://localhost:11434
-OLLAMA_MODELS=qwen3:32b # models with good code generation capabilities recommended
+# OLLAMA_API_BASE=http://localhost:11434
+# OLLAMA_MODELS=qwen3:32b # models with good code generation capabilities recommended
+
+# OrcaRouter (third-party OpenAI-compatible API service)
+# See: https://www.orcarouter.ai
+# ORCAROUTER_API_KEY=<your-orcarouter-api-key>
+# ORCAROUTER_API_BASE=https://api.orcarouter.ai/v1
+# ORCAROUTER_MODELS=auto # comma separated list of models; use e.g. "auto" or "openai/gpt-4.1-mini"
+
+# Cheaper Inference (third-party OpenAI-compatible API service)
+# Model ids are bare, e.g. "gpt-5.4-mini".
+# See: https://cheaperinference.com/docs
+# CHEAPERINFERENCE_API_KEY=<your-cheaperinference-api-key>
+# CHEAPERINFERENCE_API_BASE=https://api.cheaperinference.com/v1
+# CHEAPERINFERENCE_MODELS=gpt-5.4-mini # comma separated list of models; use e.g. "gpt-5.4-mini" or "claude-sonnet-5"
 
 # Add other LiteLLM-supported providers with PROVIDER_API_KEY, PROVIDER_MODELS, etc.
+# (optionally PROVIDER_API_BASE and PROVIDER_ENDPOINT, which defaults to openai).
 
 # -------------------------------------------------------------------
 # API base URL allowlist (SSRF protection)
@@ -95,7 +106,9 @@ OLLAMA_MODELS=qwen3:32b # models with good code generation capabilities recommen
 # Enforce mode: set to restrict which endpoints users can target.
 #
 # Glob patterns use fnmatch syntax (* matches anything, case-insensitive).
-# Empty api_base (provider defaults like OpenAI/Anthropic) is always allowed.
+# Empty api_base (provider defaults like OpenAI/Anthropic) is always allowed,
+# except for third-party gateways (OpenRouter, OrcaRouter, Cheaper Inference),
+# whose default base URL must match a pattern.
 # Global models (configured above via env vars) bypass this check.
 #
 # Examples:
@@ -256,13 +269,16 @@ OLLAMA_MODELS=qwen3:32b # models with good code generation capabilities recommen
 #   Just run: data_formulator
 #
 # Profile 2 — Multi-user anonymous demo:
+#   DF_MANAGED=true
 #   WORKSPACE_BACKEND=ephemeral
 #   DISABLE_DATA_CONNECTORS=true
 #   DISABLE_CUSTOM_MODELS=true
 #   DISABLE_DISPLAY_KEYS=true
-#   (or simply: DISABLE_DATABASE=true as shortcut)
+#   Legacy shortcut: DISABLE_DATABASE=true (deprecated; also enables managed mode)
 #
-# Profile 3 — Multi-user authenticated (enterprise):
+# Profile 3 — Multi-user authenticated (team):
+#   DF_MANAGED=true
+#   DF_ADMIN_IDENTITIES=user:<verified-admin-subject>
 #   AUTH_PROVIDER=oidc
 #   OIDC_ISSUER_URL=https://your-idp.example.com/realms/main
 #   OIDC_CLIENT_ID=data-formulator
@@ -272,4 +288,4 @@ OLLAMA_MODELS=qwen3:32b # models with good code generation capabilities recommen
 #   FLASK_SECRET_KEY=<generate-with: python -c "import secrets; print(secrets.token_hex(32))">
 #
 #   If your IdP requires a confidential (private) client, just add the secret:
-#   OIDC_CLIENT_SECRET=your-client-secret
+#   OIDC_CLIENT_SECRET=your-client-secret

.github/dependabot.yml

@@ -39,11 +39,6 @@ updates:
        update-types:
          - minor
          - patch
-   ignore:
-     # LiteLLM 1.92+ no longer provides portable Windows/macOS wheels.
-     - dependency-name: "litellm"
-       versions:
-         - ">=1.92"
 
  # GitHub Actions workflow dependencies
  - package-ecosystem: "github-actions"

.github/workflows/desktop-build.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   build-desktop:
     name: ${{ matrix.name }}
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
@@ -54,8 +55,8 @@ jobs:
       - name: Install desktop dependencies
         run: uv sync --extra desktop --frozen
 
-      - name: Test desktop startup output
-        run: uv run pytest tests/backend/test_startup_spinner.py -q
+      - name: Test desktop packaging and startup
+        run: uv run pytest tests/backend/test_startup_spinner.py tests/backend/test_desktop_packaging.py tests/backend/test_desktop_single_instance.py -q
 
       - name: Build desktop application
         run: uv run pyinstaller --noconfirm --clean packaging/data_formulator_desktop.spec
@@ -76,49 +77,79 @@ jobs:
         run: |
           './dist/Data Formulator.app/Contents/MacOS/Data Formulator'
 
-      - name: Archive Windows application
+      - name: Record bundle inventory
+        run: uv run python packaging/desktop_metadata.py --inventory "dist/Data Formulator/_internal" --output release/bundle-inventory.json
+
+      - name: Build unsigned Windows installer
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force build/installer-test | Out-Null
+          Start-Transcript -Path build/installer-test/compiler.log
+          & packaging/windows/build-installer.ps1 -PayloadDir 'dist/Data Formulator' -OutputDir release -Unsigned
+          Stop-Transcript
+
+      - name: Test installed Windows application
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          New-Item -ItemType Directory -Force release | Out-Null
-          Compress-Archive -Path 'dist/Data Formulator' -DestinationPath 'release/Data-Formulator-Windows-x64.zip'
+          $installers = @(Get-ChildItem release -Filter '*-Setup-unsigned.exe')
+          if ($installers.Count -ne 1) { throw 'Expected exactly one unsigned installer' }
+          & packaging/windows/test-installer.ps1 -Installer $installers[0].FullName -Reports build/installer-test
+
+      - name: Build unsigned macOS disk image
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          version=$(uv run python packaging/desktop_metadata.py | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")
+          bash packaging/macos/build-dmg.sh 'dist/Data Formulator.app' \
+            "release/Data-Formulator-${version}-macOS-$(uname -m)-unsigned.dmg"
 
-      - name: Archive macOS application
+      - name: Test copied macOS application
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          uv run python packaging/test_desktop.py --dmg release/*.dmg --reports build/dmg-test
+
+      - name: Upload installation test reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact }}-test-reports
+          path: |
+            build/installer-test/
+            build/dmg-test/
+          if-no-files-found: ignore
+
+      - name: Preserve existing macOS portable download
         if: runner.os == 'macOS'
         shell: bash
         run: |
-          mkdir -p release
           ditto -c -k --sequesterRsrc --keepParent \
-            'dist/Data Formulator.app' \
-            'release/Data-Formulator-macOS.zip'
+            'dist/Data Formulator.app' 'release/Data-Formulator-macOS.zip'
 
       - name: Upload desktop artifact
         uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact }}
-          path: release/*.zip
+          path: release/*
           if-no-files-found: error
           retention-days: 30
 
-  attach-to-release:
-    name: Attach desktop downloads to release
+  attach-macos-to-release:
+    name: Preserve macOS portable release
     if: github.ref_type == 'tag'
     needs: build-desktop
     runs-on: ubuntu-latest
     permissions:
       contents: write
-
     steps:
-      - name: Download desktop artifacts
-        uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8
         with:
-          pattern: data-formulator-*
+          name: data-formulator-macos
           path: release
-          merge-multiple: true
-
-      - name: Attach archives to GitHub Release
-        uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v2
         with:
-          files: release/*.zip
+          files: release/Data-Formulator-macOS.zip
           fail_on_unmatched_files: true
-          generate_release_notes: true
+          generate_release_notes: true

.gitignore

@@ -12,6 +12,8 @@ design-docs/
 deploy-scripts/
 test-data-loader/
 scripts/
+docs/esrp/*
+.azure-pipelines/*
 
 ## Ignore Visual Studio temporary files, build results, and
 ## files generated by popular Visual Studio add-ons.