patient_llm 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7873a0b7daf57787415d4484495a17f130cbf3a14137613799651aa0007f2d63
-  data.tar.gz: 728755787c1a52c805ebd70eaf163fae702d55b9525325b101b9dae571ad1652
+  metadata.gz: 7ba366158096a79e3180cb63c1a03741d88536fb787b42852f2bcb5dc61b0181
+  data.tar.gz: e507e79956d2e3534c5de85646bbfb0973c7253cb4db266ac4c721cea9201cf0
 SHA512:
-  metadata.gz: c101043564f214413f1a50b3536d56eff6f611e227013cc26507fd7b8465f1554bb6922de98f736f0712bda809afa2654bf1c366740c8b5ca3e673074e5738d7
-  data.tar.gz: 80d9a476d5fbe99a96946558a1d847c7faad08250584f9d0b5b452d6faeb906066d64b9c5e822139aed84f22d41c0059e035d59cefc9dc75979b8c4bffb7fd20
+  metadata.gz: edfb6fc58609f0b7b7733b9e5729877318f2bbe7bdec15a7aeddff05f0a1d75f1c8c47683a3431154a5267e8f5099c1a0271b4520cc3b56fec4df9e1b3228048
+  data.tar.gz: 5075e4c627595ee0d99795726a0071378e6529ca2db9ac11228740781e8e0764d44e44fa624156c30ce4675aa85978f6bdaf93d4693e8068e5305791413cadbf

data/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.2.0
+
+### Added
+
+- Requires authentication headers to be set up as secrets using `PatientHttp.secret`. This is enforced and an error will be raised if plain text values are included for any of the following headers in the provider configuration: `authorization`, `x-api-key`, `x-goog-api-key`, `api-key`.
+
+### Changed
+
+- Requires patient_http version 1.1 or higher.
+
 ## 0.1.0
 
 ### Added

data/README.md

@@ -27,25 +27,30 @@ Without a handler, `PatientLLM.ask` raises `RuntimeError: No request handler reg
 
 ### Configuration
 
-Register your LLM providers with their API base URLs and authentication headers:
+Register your LLM providers with their API base URLs and authentication headers. Authentication headers must be registered using the PatientHttp secrets manager. This ensures that these values are never included in the serialized payloads in the job queue, and are only attached to the request at dispatch time.
 
 ```ruby
 PatientLLM.configure do |config|
   config.provider :openai,
     url: "https://api.openai.com",
-    headers: {"Authorization" => "Bearer #{ENV["OPENAI_API_KEY"]}"}
+    headers: {"authorization" => PatientHttp.secret("openai.bearer_token")}
 
   config.provider :anthropic,
     url: "https://api.anthropic.com",
-    headers: {"x-api-key" => ENV["ANTHROPIC_API_KEY"]},
+    headers: {"x-api-key" => PatientHttp.secret("anthropic.api_key")},
     serializer: :messages
 end
+
+# Register the API keys as secrets with the PatientHttp secrets manager. This example
+# is for the Sidekiq integration, but the pattern is the same for SolidQueue.
+PatientHttp::Sidekiq.configure do |config|
+  config.register_secret("openai.bearer_token") { "Bearer #{ENV.fetch("OPENAI_API_KEY")}" }
+  config.register_secret("anthropic.api_key") { ENV.fetch("ANTHROPIC_API_KEY") }
+end
 ```
 
 > [!NOTE]
-> Authentication headers configured on the provider are re-attached to every request at dispatch time and are persisted in the asynchronous job payload.
->
-> You should set up encryption for you job payloads to prevent leaking credentials. See the documentation for [patient_http-sidekiq](https://github.com/bdurand/patient_http-sidekiq#sensitive-data-handling) or [patient_http-solid_queue](https://github.com/bdurand/patient_http-solid_queue#sensitive-data-handling) for details.
+> You can also set up encryption for your job payloads to ensure the entire serialized payload is always encrypted in the job queue. See the documentation for [patient_http-sidekiq](https://github.com/bdurand/patient_http-sidekiq#sensitive-data-handling) or [patient_http-solid_queue](https://github.com/bdurand/patient_http-solid_queue#sensitive-data-handling) for details.
 
 ### Creating a Callback Class
 

data/VERSION

@@ -1 +1 @@
-0.1.0
+0.2.0

data/lib/patient_llm/configuration.rb

@@ -1,6 +1,11 @@
 # frozen_string_literal: true
 
 module PatientLLM
+  # Headers that must be setup to use the secrets manager. If any of these headers
+  # are included in the provider configuration, an error will be raised unless their
+  # values are set up as secrets using `PatientHttp.secret`.
+  AUTHENTICATION_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"].freeze
+
   # Configuration for provider registry.
   #
   # @example
@@ -30,6 +35,8 @@ module PatientLLM
         raise ArgumentError, "Unknown serializer: #{sym.inspect}. Valid options: #{PatientLLM::VALID_SERIALIZERS.map(&:inspect).join(", ")}"
       end
 
+      ensure_auth_headers_use_secrets!(headers)
+
       @providers[name.to_s] = {
         url: url,
         headers: headers,
@@ -46,5 +53,18 @@ module PatientLLM
     def lookup(name)
       @providers[name&.to_s]
     end
+
+    private
+
+    def ensure_auth_headers_use_secrets!(headers)
+      headers.each do |header_name, header_value|
+        normalized_header_name = header_name.to_s.downcase
+        next unless AUTHENTICATION_HEADERS.include?(normalized_header_name)
+
+        if header_value && !header_value.is_a?(PatientHttp::SecretReference)
+          raise ArgumentError, "Authentication header #{header_name} must be set up as a secret using `PatientHttp.secret`"
+        end
+      end
+    end
   end
 end

data/patient_llm.gemspec

@@ -37,7 +37,7 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = ">= 3.0"
 
-  spec.add_dependency "patient_http"
+  spec.add_dependency "patient_http", "~> 1.1"
   spec.add_dependency "prompt_builder"
 
   spec.add_development_dependency "bundler"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: patient_llm
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Brian Durand
@@ -13,16 +13,16 @@ dependencies:
   name: patient_http
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: prompt_builder
   requirement: !ruby/object:Gem::Requirement