@agenticmail/enterprise 0.3.2 → 0.4.0

package/dashboards/python/routes/agents.py

@@ -0,0 +1,296 @@
+"""
+Agents routes: list, create, detail, and archive AI agents.
+"""
+
+import re
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+agents_bp = Blueprint('agents_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+def _resolve_agent_fields(agent):
+    """Resolve display name, email, and model from agent config following priority rules."""
+    config = agent.get('config') or {}
+    identity = config.get('identity') or {}
+
+    # Name: config.identity.name > config.name > config.displayName > agent.name
+    display_name = (
+        identity.get('name')
+        or config.get('name')
+        or config.get('displayName')
+        or agent.get('name', '')
+    )
+
+    # Email: config.identity.email > config.email > agent.email (never show raw UUIDs)
+    email = (
+        identity.get('email')
+        or config.get('email')
+        or agent.get('email', '')
+    )
+
+    # Filter out UUID emails
+    if email and re.match(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$', email, re.IGNORECASE):
+        email = ''
+
+    # Avatar initial: first letter of resolved display name
+    avatar_initial = display_name[0].upper() if display_name else '?'
+
+    # Model: if dict, use modelId or provider; otherwise use as-is
+    model_raw = config.get('model', '')
+    if isinstance(model_raw, dict):
+        model = model_raw.get('modelId') or model_raw.get('provider') or ''
+    else:
+        model = model_raw
+
+    return display_name, email, avatar_initial, model
+
+
+@agents_bp.route('/agents')
+@login_required
+def agents():
+    data = api_request('GET', '/api/agents')
+    return render_template(
+        'agents.html',
+        active_page='agents',
+        user=session.get('user', {}),
+        agents=data.get('agents', []),
+    )
+
+
+def _parse_comma_list(value):
+    """Parse a comma-separated string into a list, stripping whitespace."""
+    if not value:
+        return []
+    return [item.strip() for item in value.split(',') if item.strip()]
+
+
+@agents_bp.route('/api/providers/<provider_id>/models')
+@login_required
+def provider_models(provider_id):
+    from flask import jsonify
+    data = api_request('GET', f'/api/providers/{provider_id}/models')
+    return jsonify(data)
+
+
+@agents_bp.route('/agents/<id>')
+@login_required
+def agent_detail(id):
+    data = api_request('GET', f'/api/agents/{id}')
+    agent = data.get('agent') or data
+
+    display_name, email, avatar_initial, model = _resolve_agent_fields(agent)
+
+    config = agent.get('config') or {}
+    persona = config.get('persona') or {}
+    traits = persona.get('traits') or {}
+    permissions = config.get('permissions') or agent.get('permissions') or {}
+
+    # Fetch activity data (events, tool calls, journal) — each wrapped in try/except
+    events = []
+    try:
+        ev_data = api_request('GET', f'/activity/events?agentId={id}&limit=50')
+        events = ev_data.get('events', [])
+    except Exception:
+        pass
+
+    tool_calls = []
+    try:
+        tc_data = api_request('GET', f'/activity/tool-calls?agentId={id}&limit=50')
+        tool_calls = tc_data.get('toolCalls', [])
+    except Exception:
+        pass
+
+    journal_entries = []
+    try:
+        j_data = api_request('GET', f'/journal?agentId={id}&orgId=default&limit=50')
+        journal_entries = j_data.get('entries', [])
+    except Exception:
+        pass
+
+    # Fetch tool security data
+    tool_security = {}
+    org_defaults = {}
+    agent_overrides = {}
+    try:
+        ts_data = api_request('GET', f'/engine/agents/{id}/tool-security')
+        tool_security = ts_data.get('toolSecurity') or {}
+        org_defaults = ts_data.get('orgDefaults') or {}
+        agent_overrides = ts_data.get('agentOverrides') or {}
+    except Exception:
+        pass
+
+    return render_template(
+        'agent_detail.html',
+        active_page='agents',
+        user=session.get('user', {}),
+        agent=agent,
+        display_name=display_name,
+        email=email,
+        avatar_initial=avatar_initial,
+        model=model,
+        config=config,
+        persona=persona,
+        traits=traits,
+        permissions=permissions,
+        profile=permissions,
+        events=events,
+        tool_calls=tool_calls,
+        journal_entries=journal_entries,
+        tool_security=tool_security,
+        org_defaults=org_defaults,
+        agent_overrides=agent_overrides,
+    )
+
+
+@agents_bp.route('/agents/<id>/tool-security', methods=['POST'])
+@login_required
+def save_agent_tool_security(id):
+    tool_sec = {
+        'security': {
+            'pathSandbox': {
+                'enabled': 'ps_enabled' in request.form,
+                'allowedDirs': _parse_comma_list(request.form.get('ps_allowedDirs', '')),
+                'blockedPatterns': _parse_comma_list(request.form.get('ps_blockedPatterns', '')),
+            },
+            'ssrf': {
+                'enabled': 'ssrf_enabled' in request.form,
+                'allowedHosts': _parse_comma_list(request.form.get('ssrf_allowedHosts', '')),
+                'blockedCidrs': _parse_comma_list(request.form.get('ssrf_blockedCidrs', '')),
+            },
+            'commandSanitizer': {
+                'enabled': 'cs_enabled' in request.form,
+                'mode': request.form.get('cs_mode', 'blocklist'),
+                'allowedCommands': _parse_comma_list(request.form.get('cs_allowedCommands', '')),
+                'blockedPatterns': _parse_comma_list(request.form.get('cs_blockedPatterns', '')),
+            },
+        },
+        'middleware': {
+            'audit': {
+                'enabled': 'audit_enabled' in request.form,
+                'redactKeys': _parse_comma_list(request.form.get('audit_redactKeys', '')),
+            },
+            'rateLimit': {
+                'enabled': 'rl_enabled' in request.form,
+                'overrides': {},
+            },
+            'circuitBreaker': {
+                'enabled': 'cb_enabled' in request.form,
+            },
+            'telemetry': {
+                'enabled': 'tel_enabled' in request.form,
+            },
+        },
+    }
+    result = api_request('PATCH', f'/engine/agents/{id}/tool-security', {
+        'toolSecurity': tool_sec,
+        'updatedBy': 'dashboard',
+    })
+    if 'error' in result:
+        flash(result.get('error', 'Failed to save tool security'))
+    else:
+        flash('Agent tool security saved!')
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/<id>/tool-security/reset', methods=['POST'])
+@login_required
+def reset_agent_tool_security(id):
+    result = api_request('PATCH', f'/engine/agents/{id}/tool-security', {
+        'toolSecurity': {},
+        'updatedBy': 'dashboard',
+    })
+    if 'error' in result:
+        flash(result.get('error', 'Failed to reset tool security'))
+    else:
+        flash('Tool security reset to org defaults')
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/<id>/deploy', methods=['POST'])
+@login_required
+def deploy_agent(id):
+    api_request('POST', f'/api/agents/{id}/deploy')
+    flash('Agent deployed')
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/<id>/stop', methods=['POST'])
+@login_required
+def stop_agent(id):
+    api_request('POST', f'/api/agents/{id}/stop')
+    flash('Agent stopped')
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/<id>/restart', methods=['POST'])
+@login_required
+def restart_agent(id):
+    api_request('POST', f'/api/agents/{id}/restart')
+    flash('Agent restarted')
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/create', methods=['POST'])
+@login_required
+def create_agent():
+    body = {
+        'name': request.form['name'],
+        'role': request.form.get('role', 'assistant'),
+        'provider': request.form.get('provider', 'anthropic'),
+        'model': request.form.get('model') or None,
+        'persona': {
+            'gender': request.form.get('gender') or None,
+            'dateOfBirth': request.form.get('date_of_birth') or None,
+            'maritalStatus': request.form.get('marital_status') or None,
+            'culturalBackground': request.form.get('cultural_background') or None,
+            'language': request.form.get('language') or None,
+            'traits': {
+                'communication': request.form.get('trait_communication', 'direct'),
+                'detail': request.form.get('trait_detail', 'detail-oriented'),
+                'energy': request.form.get('trait_energy', 'calm'),
+                'humor': request.form.get('humor') or 'warm',
+                'formality': request.form.get('formality') or 'adaptive',
+                'empathy': request.form.get('empathy') or 'moderate',
+                'patience': request.form.get('patience') or 'patient',
+                'creativity': request.form.get('creativity') or 'creative',
+            },
+        },
+    }
+    if request.form.get('soul_id'):
+        body['soul_id'] = request.form['soul_id']
+    if request.form.get('email'):
+        body['email'] = request.form['email']
+    result = api_request('POST', '/api/agents', body)
+    flash('Agent created!' if 'id' in result else result.get('error', 'Failed'))
+    return redirect(url_for('agents_bp.agents'))
+
+
+@agents_bp.route('/agents/<id>/journal/<entry_id>/rollback', methods=['POST'])
+@login_required
+def rollback_journal(id, entry_id):
+    result = api_request('POST', f'/journal/{entry_id}/rollback', body={})
+    if result.get('success'):
+        flash('Journal entry rolled back')
+    else:
+        flash(result.get('error', 'Rollback failed'))
+    return redirect(url_for('agents_bp.agent_detail', id=id))
+
+
+@agents_bp.route('/agents/<id>/archive', methods=['POST'])
+@login_required
+def archive_agent(id):
+    api_request('POST', f'/api/agents/{id}/archive')
+    flash('Agent archived')
+    return redirect(url_for('agents_bp.agents'))

package/dashboards/python/routes/api_keys.py

@@ -0,0 +1,49 @@
+"""
+API Keys routes: list, create, and revoke API keys.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+api_keys_bp = Blueprint('api_keys_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@api_keys_bp.route('/api-keys')
+@login_required
+def api_keys():
+    data = api_request('GET', '/api/api-keys')
+    return render_template(
+        'api_keys.html',
+        active_page='api_keys',
+        user=session.get('user', {}),
+        keys=data.get('keys', []),
+    )
+
+
+@api_keys_bp.route('/api-keys/create', methods=['POST'])
+@login_required
+def create_api_key():
+    result = api_request('POST', '/api/api-keys', {'name': request.form['name']})
+    if 'plaintext' in result:
+        flash(f"Key created: {result['plaintext']} — SAVE THIS NOW!")
+    else:
+        flash(result.get('error', 'Failed'))
+    return redirect(url_for('api_keys_bp.api_keys'))
+
+
+@api_keys_bp.route('/api-keys/<id>/revoke', methods=['POST'])
+@login_required
+def revoke_api_key(id):
+    api_request('DELETE', f'/api/api-keys/{id}')
+    flash('Key revoked')
+    return redirect(url_for('api_keys_bp.api_keys'))

package/dashboards/python/routes/audit.py

@@ -0,0 +1,33 @@
+"""
+Audit Log route: paginated list of audit events.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for
+from functools import wraps
+from utils.api import api_request
+
+audit_bp = Blueprint('audit_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@audit_bp.route('/audit')
+@login_required
+def audit():
+    page = max(0, int(request.args.get('p', 0)))
+    data = api_request('GET', f'/api/audit?limit=25&offset={page * 25}')
+    return render_template(
+        'audit.html',
+        active_page='audit',
+        user=session.get('user', {}),
+        events=data.get('events', []),
+        total=data.get('total', 0),
+        page=page,
+    )

package/dashboards/python/routes/auth.py

@@ -0,0 +1,30 @@
+"""
+Authentication routes: login and logout.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for
+from utils.api import api_request, API_URL
+
+auth_bp = Blueprint('auth_bp', __name__)
+
+
+@auth_bp.route('/login', methods=['GET', 'POST'])
+def login():
+    error = None
+    if request.method == 'POST':
+        data = api_request('POST', '/auth/login', {
+            'email': request.form['email'],
+            'password': request.form['password'],
+        })
+        if 'token' in data:
+            session['token'] = data['token']
+            session['user'] = data['user']
+            return redirect(url_for('dashboard_bp.dashboard'))
+        error = data.get('error', 'Login failed')
+    return render_template('login.html', error=error, api_url=API_URL)
+
+
+@auth_bp.route('/logout')
+def logout():
+    session.clear()
+    return redirect(url_for('auth_bp.login'))

package/dashboards/python/routes/compliance.py

@@ -0,0 +1,50 @@
+"""
+Compliance routes: generate and view compliance reports.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+compliance_bp = Blueprint('compliance_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@compliance_bp.route('/compliance')
+@login_required
+def compliance():
+    data = api_request('GET', '/engine/compliance/reports?orgId=default')
+    return render_template(
+        'compliance.html',
+        active_page='compliance',
+        user=session.get('user', {}),
+        reports=data.get('reports', []),
+    )
+
+
+@compliance_bp.route('/compliance/generate', methods=['POST'])
+@login_required
+def generate_report():
+    report_type = request.form['type']
+    body = {
+        'startDate': request.form.get('startDate', ''),
+        'endDate': request.form.get('endDate', ''),
+        'agentId': request.form.get('agentId', ''),
+    }
+    type_paths = {
+        'soc2': '/engine/compliance/reports/soc2',
+        'gdpr': '/engine/compliance/reports/gdpr',
+        'audit': '/engine/compliance/reports/audit',
+    }
+    path = type_paths.get(report_type, '/engine/compliance/reports/audit')
+    result = api_request('POST', path, body)
+    flash('Report generated!' if not result.get('error') else result.get('error', 'Failed'))
+    return redirect(url_for('compliance_bp.compliance'))

package/dashboards/python/routes/dashboard.py

@@ -0,0 +1,32 @@
+"""
+Dashboard route: main overview page with stats and recent audit activity.
+"""
+
+from flask import Blueprint, render_template, session, redirect, url_for
+from functools import wraps
+from utils.api import api_request
+
+dashboard_bp = Blueprint('dashboard_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@dashboard_bp.route('/')
+@login_required
+def dashboard():
+    stats = api_request('GET', '/api/stats')
+    audit = api_request('GET', '/api/audit?limit=8')
+    return render_template(
+        'dashboard.html',
+        active_page='dashboard',
+        user=session.get('user', {}),
+        stats=stats,
+        audit=audit.get('events', []),
+    )

package/dashboards/python/routes/dlp.py

@@ -0,0 +1,64 @@
+"""
+DLP routes: manage data loss prevention rules, violations, and scanning.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+dlp_bp = Blueprint('dlp_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@dlp_bp.route('/dlp')
+@login_required
+def dlp():
+    rules = api_request('GET', '/engine/dlp/rules?orgId=default')
+    violations = api_request('GET', '/engine/dlp/violations?orgId=default')
+    return render_template(
+        'dlp.html',
+        active_page='dlp',
+        user=session.get('user', {}),
+        rules=rules.get('rules', []),
+        violations=violations.get('violations', []),
+    )
+
+
+@dlp_bp.route('/dlp/rules/create', methods=['POST'])
+@login_required
+def create_rule():
+    body = {
+        'name': request.form['name'],
+        'type': request.form['type'],
+        'pattern': request.form['pattern'],
+        'action': request.form.get('action', 'block'),
+        'severity': request.form.get('severity', 'high'),
+    }
+    result = api_request('POST', '/engine/dlp/rules', body)
+    flash('DLP rule created!' if 'id' in result else result.get('error', 'Failed'))
+    return redirect(url_for('dlp_bp.dlp'))
+
+
+@dlp_bp.route('/dlp/rules/<id>/delete', methods=['POST'])
+@login_required
+def delete_rule(id):
+    api_request('DELETE', f'/engine/dlp/rules/{id}')
+    flash('DLP rule deleted')
+    return redirect(url_for('dlp_bp.dlp'))
+
+
+@dlp_bp.route('/dlp/scan', methods=['POST'])
+@login_required
+def scan():
+    body = {'content': request.form['content']}
+    result = api_request('POST', '/engine/dlp/scan', body)
+    flash(f'Scan complete — {len(result.get("violations", []))} violation(s) found')
+    return redirect(url_for('dlp_bp.dlp'))

package/dashboards/python/routes/guardrails.py

@@ -0,0 +1,79 @@
+"""
+Guardrails routes: manage interventions, pause/resume/kill agents, and anomaly rules.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+guardrails_bp = Blueprint('guardrails_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@guardrails_bp.route('/guardrails')
+@login_required
+def guardrails():
+    interventions = api_request('GET', '/engine/guardrails/interventions?orgId=default')
+    anomaly_rules = api_request('GET', '/engine/anomaly-rules?orgId=default')
+    return render_template(
+        'guardrails.html',
+        active_page='guardrails',
+        user=session.get('user', {}),
+        interventions=interventions.get('interventions', []),
+        anomaly_rules=anomaly_rules.get('rules', []),
+    )
+
+
+@guardrails_bp.route('/guardrails/pause', methods=['POST'])
+@login_required
+def pause_agent():
+    body = {'agentId': request.form['agentId'], 'reason': request.form.get('reason', '')}
+    result = api_request('POST', f'/engine/guardrails/pause/{request.form["agentId"]}', body)
+    flash('Agent paused!' if not result.get('error') else result.get('error', 'Failed'))
+    return redirect(url_for('guardrails_bp.guardrails'))
+
+
+@guardrails_bp.route('/guardrails/resume/<id>', methods=['POST'])
+@login_required
+def resume_agent(id):
+    api_request('POST', f'/engine/guardrails/resume/{id}')
+    flash('Agent resumed')
+    return redirect(url_for('guardrails_bp.guardrails'))
+
+
+@guardrails_bp.route('/guardrails/kill/<id>', methods=['POST'])
+@login_required
+def kill_agent(id):
+    api_request('POST', f'/engine/guardrails/kill/{id}')
+    flash('Agent killed')
+    return redirect(url_for('guardrails_bp.guardrails'))
+
+
+@guardrails_bp.route('/anomaly-rules/create', methods=['POST'])
+@login_required
+def create_anomaly_rule():
+    body = {
+        'name': request.form['name'],
+        'condition': request.form['condition'],
+        'action': request.form.get('action', 'alert'),
+        'threshold': request.form.get('threshold', ''),
+    }
+    result = api_request('POST', '/engine/anomaly-rules', body)
+    flash('Anomaly rule created!' if 'id' in result else result.get('error', 'Failed'))
+    return redirect(url_for('guardrails_bp.guardrails'))
+
+
+@guardrails_bp.route('/anomaly-rules/<id>/delete', methods=['POST'])
+@login_required
+def delete_anomaly_rule(id):
+    api_request('DELETE', f'/engine/anomaly-rules/{id}')
+    flash('Anomaly rule deleted')
+    return redirect(url_for('guardrails_bp.guardrails'))

package/dashboards/python/routes/journal.py

@@ -0,0 +1,40 @@
+"""
+Journal routes: view action journal entries and rollback operations.
+"""
+
+from flask import Blueprint, render_template, request, session, redirect, url_for, flash
+from functools import wraps
+from utils.api import api_request
+
+journal_bp = Blueprint('journal_bp', __name__)
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'token' not in session:
+            return redirect(url_for('auth_bp.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+@journal_bp.route('/journal')
+@login_required
+def journal():
+    data = api_request('GET', '/engine/journal?orgId=default')
+    stats = api_request('GET', '/engine/journal/stats/default')
+    return render_template(
+        'journal.html',
+        active_page='journal',
+        user=session.get('user', {}),
+        entries=data.get('entries', []),
+        stats=stats,
+    )
+
+
+@journal_bp.route('/journal/<id>/rollback', methods=['POST'])
+@login_required
+def rollback(id):
+    result = api_request('POST', f'/engine/journal/{id}/rollback')
+    flash('Rollback successful!' if not result.get('error') else result.get('error', 'Failed'))
+    return redirect(url_for('journal_bp.journal'))