@atmem/architect 0.0.0-stage → 0.2.0

package/src/runtime/enterprise_google_jobs.py

@@ -0,0 +1,275 @@
+"""Owned Google Batch per-file jobs; no source/model/SQL credentials in workloads.
+
+The VM transfer identity is trusted, distinct from the question worker. Only the
+parser runnable is network-blocked. Its mounts are explicit local POSIX paths;
+no FUSE, identity mounts, background listener or shared parser service is used.
+Cloud IAM/network/provisioning remain required parts of the generated composition.
+"""
+import json
+import hashlib
+import re
+import time
+import uuid
+from types import MappingProxyType
+from urllib.parse import quote
+import requests
+from enterprise_document_contract import MAX_INPUT
+from enterprise_document_job import MAX_ENVELOPE, request, result, unique
+from enterprise_sources import SourceUnavailable
+from workflow_connection import google_metadata_token
+from enterprise_document_jobs import DocumentJobLedger
+
+
+def configuration(value):
+    fields = {'format', 'projectId', 'region', 'bucket', 'parserImage', 'transferImage',
+              'workerServiceAccount', 'vmServiceAccount', 'network', 'subnetwork'}
+    if not isinstance(value, dict) or set(value) != fields or value['format'] != 'enterprise-google-document-job-v1':
+        raise ValueError('Use the exact owned Google document-job configuration')
+    patterns = {'projectId': '[a-z][a-z0-9-]{4,28}[a-z0-9]', 'region': '[a-z]+-[a-z]+[1-9][0-9]?',
+                'bucket': '[a-z0-9][a-z0-9-]{1,61}[a-z0-9]'}
+    for key, pattern in patterns.items():
+        if not isinstance(value[key], str) or not re.fullmatch(pattern, value[key]): raise ValueError('Invalid owned Google job destination')
+    project, region = value['projectId'], value['region']
+    for key in ['workerServiceAccount', 'vmServiceAccount']:
+        if not isinstance(value[key], str) or not re.fullmatch('[a-z][a-z0-9-]{4,28}[a-z0-9]@' + re.escape(project) + r'\.iam\.gserviceaccount\.com', value[key]):
+            raise ValueError('Use distinct existing owned worker and VM service accounts')
+    if value['workerServiceAccount'] == value['vmServiceAccount']: raise ValueError('Parser transfer VM must not inherit worker authority')
+    for key in ['parserImage', 'transferImage']:
+        if not isinstance(value[key], str) or not re.fullmatch(re.escape(region + '-docker.pkg.dev/' + project + '/') + r'[a-z][a-z0-9_-]{0,62}/[a-z][a-z0-9_-]{0,62}(?:/[a-z][a-z0-9_-]{0,62}){0,3}@sha256:[0-9a-f]{64}', value[key]):
+            raise ValueError('Use immutable owned regional Artifact Registry images')
+    for key, prefix in [('network', 'projects/' + project + '/global/networks/'),
+                        ('subnetwork', 'projects/' + project + '/regions/' + region + '/subnetworks/')]:
+        if not isinstance(value[key], str) or not re.fullmatch(re.escape(prefix) + '[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?', value[key]):
+            raise ValueError('Use explicit same-project regional private networking')
+    return dict(value)
+
+
+def identity(value):
+    if not isinstance(value, str) or not re.fullmatch('[0-9a-f]{64}', value): raise ValueError('Invalid owned per-file identity')
+    return value
+
+
+def object_key(identifier, side):
+    if side not in {'input', 'result'}: raise ValueError('Use the owned input or result object')
+    return 'document-jobs/' + identity(identifier) + '/' + side
+
+
+def transfer_metadata(config, metadata, generation):
+    if (not isinstance(metadata, dict) or set(metadata) != {'format', 'requestId', 'sha256', 'mediaType'} or
+        metadata['format'] != 'enterprise-document-job-v1' or not isinstance(metadata['sha256'], str) or
+        not re.fullmatch('[0-9a-f]{64}', metadata['sha256'])):
+        raise ValueError('Use the exact byte-bound document request')
+    identity(metadata['requestId'])
+    from enterprise_document_contract import media_type
+    if media_type(metadata['mediaType']) != metadata['mediaType']: raise ValueError('Use canonical document MIME')
+    if not isinstance(generation, str) or not re.fullmatch('[1-9][0-9]{0,29}', generation): raise ValueError('Use the immutable native input generation')
+    return {'format': 'enterprise-google-document-transfer-v1', 'projectId': config['projectId'],
+            'region': config['region'], 'bucket': config['bucket'], 'request': dict(metadata), 'inputGeneration': generation}
+
+
+def job_spec(config, metadata, generation):
+    owned = configuration(config)
+    transfer = transfer_metadata(owned, metadata, generation)
+    base = '/mnt/disks/share/document-' + metadata['requestId']
+    common = '--read-only --cap-drop=ALL --security-opt=no-new-privileges:true --pids-limit=128 --log-driver=none'
+    def bridge(mode, user):
+        return {'container': {'imageUri': owned['transferImage'], 'entrypoint': 'python',
+            'commands': ['-I', '/app/enterprise_google_transfer.py', mode],
+            'volumes': [base + ':/work:' + ('rw' if mode == 'download' else 'ro')],
+            'options': common + ' --user=' + user + (' --cap-add=CHOWN' if mode == 'download' else '')},
+            'environment': {'variables': {'DOCUMENT_JOB': json.dumps(transfer, separators=(',', ':'))}},
+            'timeout': '25s'}
+    parser = {'container': {'imageUri': owned['parserImage'], 'entrypoint': 'python',
+        'commands': ['-I', '/app/enterprise_document_cli.py', '--job'],
+        'volumes': [base + '/input:/input:ro', base + '/output:/output:rw'],
+        'options': common + ' --user=10001:10001 --tmpfs=/tmp:rw,noexec,nosuid,size=128m',
+        'blockExternalNetwork': True}, 'timeout': '110s'}
+    return {'taskGroups': [{'taskCount': '1', 'parallelism': '1', 'taskCountPerNode': '1',
+        'taskSpec': {'runnables': [bridge('download', '0:0'), parser, bridge('upload', '10001:10001')],
+            'maxRetryCount': 0, 'maxRunDuration': '160s', 'computeResource': {'cpuMilli': '2000', 'memoryMib': '2048'}}}],
+        'allocationPolicy': {'location': {'allowedLocations': ['regions/' + owned['region']]},
+            'serviceAccount': {'email': owned['vmServiceAccount']},
+            'network': {'networkInterfaces': [{'network': owned['network'], 'subnetwork': owned['subnetwork'], 'noExternalIpAddress': True}]},
+            'instances': [{'policy': {'machineType': 'e2-standard-2', 'provisioningModel': 'STANDARD'}, 'blockProjectSshKeys': True}]},
+        'logsPolicy': {'destination': 'DESTINATION_UNSPECIFIED'}, 'labels': {'atmem-workload': 'document-parser'}}
+
+
+class GoogleDocumentApi:
+    def __init__(self, *, session=None, credential=None):
+        self.session = session or requests.Session(); self.session.trust_env = False
+        self.credential = credential or google_metadata_token
+
+    def send(self, method, url, *, body=None, data=None, params=None, limit=32768, allow_missing=False):
+        # Destinations are constructed internally, never supplied by a document,
+        # browser, model or source redirect. No environment proxies or redirects.
+        if not url.startswith(('https://batch.googleapis.com/v1/projects/', 'https://storage.googleapis.com/storage/v1/b/',
+                               'https://storage.googleapis.com/upload/storage/v1/b/')):
+            raise ValueError('Use the fixed native document APIs')
+        try:
+            token = self.credential()
+            if not isinstance(token, str) or not 8 <= len(token) <= 20000 or any(ord(c) < 33 or ord(c) > 126 for c in token): raise ValueError()
+            started = time.monotonic()
+            headers = {'Authorization': 'Bearer ' + token}
+            if data is not None: headers['Content-Type'] = 'application/octet-stream'
+            with self.session.request(method, url, headers=headers, json=body, data=data, params=params,
+                stream=True, allow_redirects=False, timeout=(2, 8)) as response:
+                if allow_missing and response.status_code == 404: return None
+                if response.status_code not in {200, 201, 204}: raise ValueError()
+                raw = bytearray()
+                for chunk in response.iter_content(16384):
+                    raw.extend(chunk)
+                    if len(raw) > limit or time.monotonic() - started > 15: raise ValueError()
+                return bytes(raw)
+        except Exception:
+            raise SourceUnavailable('document_job_unavailable') from None
+
+    def json(self, *args, **kwargs):
+        raw = self.send(*args, **kwargs)
+        if raw is None: return None
+        try:
+            value = json.loads(raw, object_pairs_hook=unique)
+            if not isinstance(value, dict): raise ValueError()
+            return value
+        except Exception: raise SourceUnavailable('document_job_unavailable') from None
+
+
+class GoogleDocumentObjects:
+    def __init__(self, bucket, api):
+        if not isinstance(bucket, str) or not re.fullmatch('[a-z0-9][a-z0-9-]{1,61}[a-z0-9]', bucket): raise ValueError('Use the owned ephemeral bucket')
+        self.bucket, self.api = bucket, api
+        self.base = 'https://storage.googleapis.com/storage/v1/b/' + bucket
+
+    def url(self, identifier, side): return self.base + '/o/' + quote(object_key(identifier, side), safe='')
+
+    def put(self, identifier, side, raw):
+        maximum = MAX_INPUT if side == 'input' else MAX_ENVELOPE
+        if not isinstance(raw, bytes) or not 0 < len(raw) <= maximum: raise ValueError('Invalid bounded document object')
+        value = self.api.json('POST', 'https://storage.googleapis.com/upload/storage/v1/b/' + self.bucket + '/o',
+            params={'uploadType': 'media', 'name': object_key(identifier, side), 'ifGenerationMatch': '0', 'fields': 'generation'}, data=raw)
+        generation = value.get('generation')
+        if not isinstance(generation, str) or not re.fullmatch('[1-9][0-9]{0,29}', generation): raise SourceUnavailable('document_job_unavailable')
+        return generation
+
+    def load(self, identifier, side, generation=None):
+        params = {'alt': 'media'}
+        if generation is not None:
+            if not isinstance(generation, str) or not re.fullmatch('[1-9][0-9]{0,29}', generation): raise ValueError('Invalid native generation')
+            params['generation'] = generation
+        return self.api.send('GET', self.url(identifier, side), params=params, limit=MAX_INPUT if side == 'input' else MAX_ENVELOPE)
+
+    def delete(self, identifier, side): self.api.send('DELETE', self.url(identifier, side), allow_missing=True)
+
+
+class GoogleBatchDocuments:
+    """Controller lifecycle; successful delete requests alone do not prove exit."""
+    def __init__(self, config, *, api=None, ledger=None, deadline=140, poll_seconds=1):
+        self.config = MappingProxyType(configuration(config))
+        if type(deadline) is not int or not 1 <= deadline <= 140 or type(poll_seconds) not in {int, float} or not .01 <= poll_seconds <= 2:
+            raise ValueError('Use bounded owned document deadlines')
+        self.api = api or GoogleDocumentApi()
+        self.objects = GoogleDocumentObjects(self.config['bucket'], self.api)
+        self.deadline, self.poll_seconds = deadline, poll_seconds
+        self.parent = 'projects/' + self.config['projectId'] + '/locations/' + self.config['region']
+        self.base = 'https://batch.googleapis.com/v1/' + self.parent
+        self.target = hashlib.sha256(json.dumps({key:self.config[key]for key in ['projectId','region','bucket']},sort_keys=True,separators=(',',':')).encode()).hexdigest()
+        self.ledger = ledger
+
+    def __call__(self, raw, mime):
+        raise SourceUnavailable('source_validation_required')
+
+    def bind_runtime(self, provider, environment):
+        if (provider != 'gcp' or environment.get('PROJECT_ID') != self.config['projectId'] or
+            environment.get('REGION') != self.config['region'] or
+            environment.get('DATABASE_SERVICE_ACCOUNT') != self.config['workerServiceAccount']):
+            raise ValueError('Document execution must match the selected provider, project, region and worker identity')
+
+    def attach_runtime(self, auth, account_id):
+        if self.ledger is None:self.ledger=DocumentJobLedger(auth,account_id,self.target)
+        elif (not isinstance(self.ledger,DocumentJobLedger)or self.ledger.auth is not auth or
+              self.ledger.account_id!=account_id or self.ledger.target!=self.target):
+            raise ValueError('Use the owned persistent worker cleanup ledger')
+
+    def reconcile(self, *, limit=5):
+        if self.ledger is None:raise SourceUnavailable('document_job_recovery_required')
+        if type(limit)is not int or not 1<=limit<=20:raise ValueError('Use a bounded cleanup batch')
+        counts={'claimed':0,'retired':0,'settling':0,'failed':0}
+        for _ in range(limit):
+            lease=self.ledger.claim_due()
+            if lease is None:break
+            counts['claimed']+=1
+            try:
+                self.cleanup(self.parent+'/jobs/document-'+lease.request_id[:32],lease.request_id)
+            except Exception:
+                self.ledger.failed(lease);counts['failed']+=1
+            else:
+                retired=self.ledger.completed(lease);counts['retired'if retired else'settling']+=1
+        return counts
+
+    def from_source(self, raw, mime, guard):
+        if not callable(guard): raise ValueError('Supply the current source/company/job check')
+        identifier = uuid.uuid4().hex + uuid.uuid4().hex
+        metadata = request(raw, mime, identifier)
+        name = self.parent + '/jobs/document-' + identifier[:32]
+        url = 'https://batch.googleapis.com/v1/' + name
+        started = time.monotonic()
+        guard()
+        if self.ledger is None:raise SourceUnavailable('document_job_recovery_required')
+        lease=self.ledger.allocate(identifier)
+        def check():
+            self.ledger.guard(lease);guard();self.ledger.guard(lease)
+        # Cleanup always inspects this unique owned name, including lost create
+        # acknowledgements. It never lists/deletes another project's jobs/files.
+        try:
+            self.ledger.guard(lease)
+            generation = self.objects.put(identifier, 'input', raw)
+            self.ledger.advance(lease,'job_pending')
+            check()
+            value = self.api.json('POST', self.base + '/jobs', params={'jobId': name.rsplit('/', 1)[1]},
+                body=job_spec(dict(self.config), metadata, generation))
+            if value.get('name') != name: raise SourceUnavailable('document_job_unavailable')
+            self.ledger.advance(lease,'job_running')
+            while True:
+                check()
+                if time.monotonic() - started > self.deadline: raise SourceUnavailable('document_job_unavailable')
+                current = self.api.json('GET', url)
+                if current.get('name') != name: raise SourceUnavailable('document_job_unavailable')
+                state = current.get('status', {}).get('state')
+                if state == 'SUCCEEDED': break
+                if state not in {'QUEUED', 'SCHEDULED', 'RUNNING'}: raise SourceUnavailable('document_job_unavailable')
+                time.sleep(self.poll_seconds)
+            self.ledger.advance(lease,'succeeded')
+            check()
+            encoded = self.objects.load(identifier, 'result')
+            value = result(raw, mime, identifier, encoded)
+            check()
+            return value
+        finally:
+            cleanup=self.ledger.claim_owner(lease)
+            try:self.cleanup(name,identifier)
+            except BaseException:
+                self.ledger.failed(cleanup)
+                raise
+            else:self.ledger.completed(cleanup)
+
+    def cleanup(self, name, identifier):
+        failure = False
+        try:
+            operation = self.api.json('DELETE', 'https://batch.googleapis.com/v1/' + name, allow_missing=True)
+            if operation is not None:
+                expected = self.parent + '/operations/'
+                op = operation.get('name')
+                if not isinstance(op, str) or not re.fullmatch(re.escape(expected) + '[A-Za-z0-9_-]{1,200}', op): raise ValueError()
+                deadline = time.monotonic() + 30
+                while True:
+                    if type(operation.get('done', False)) is not bool: raise ValueError()
+                    if operation.get('done', False): break
+                    if time.monotonic() > deadline: raise ValueError()
+                    time.sleep(self.poll_seconds)
+                    operation = self.api.json('GET', 'https://batch.googleapis.com/v1/' + op)
+                    if operation.get('name') != op: raise ValueError()
+                if operation.get('error'): raise ValueError()
+        except Exception: failure = True
+        for side in ['input', 'result']:
+            try: self.objects.delete(identifier, side)
+            except Exception: failure = True
+        if failure: raise SourceUnavailable('document_job_cleanup_unavailable') from None

package/src/runtime/enterprise_google_transfer.py

@@ -0,0 +1,85 @@
+"""Trusted, sequential Google Batch byte transfer; never execute a document.
+
+Only the download/upload runnables have native VM network/identity access. They
+use fixed native APIs and one bounded per-file mount. The parser never runs in
+this image, and no service is left listening for it.
+"""
+import json
+import os
+from pathlib import Path
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from enterprise_document_contract import MAX_INPUT
+from enterprise_document_job import MAX_ENVELOPE, read_file, request, result, unique
+from enterprise_google_jobs import GoogleDocumentApi, GoogleDocumentObjects, transfer_metadata
+
+
+def metadata(encoded):
+    if not isinstance(encoded, str) or not 0 < len(encoded.encode()) <= 4096: raise ValueError('Invalid owned transfer metadata')
+    value = json.loads(encoded, object_pairs_hook=unique)
+    fields = {'format', 'projectId', 'region', 'bucket', 'request', 'inputGeneration'}
+    if not isinstance(value, dict) or set(value) != fields or value['format'] != 'enterprise-google-document-transfer-v1': raise ValueError('Invalid owned transfer metadata')
+    import re
+    for key, pattern in {'projectId': '[a-z][a-z0-9-]{4,28}[a-z0-9]', 'region': '[a-z]+-[a-z]+[1-9][0-9]?', 'bucket': '[a-z0-9][a-z0-9-]{1,61}[a-z0-9]'}.items():
+        if not isinstance(value[key], str) or not re.fullmatch(pattern, value[key]): raise ValueError('Invalid owned transfer destination')
+    if value != transfer_metadata(value, value['request'], value['inputGeneration']): raise ValueError('Invalid owned transfer metadata')
+    return value
+
+
+def directory(parent, name, *, create=False):
+    if create: os.mkdir(name, 0o700, dir_fd=parent)
+    return os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=parent)
+
+
+def download(value, objects, mount='/work'):
+    """Root/CHOWN only to prepare isolated UID10001 mounts, then this exits."""
+    expected = value['request']; identifier = expected['requestId']
+    raw = objects.load(identifier, 'input', value['inputGeneration'])
+    if request(raw, expected['mediaType'], identifier) != expected: raise ValueError('Document input binding changed')
+    root = source = target = None
+    try:
+        root = os.open(mount, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        # Refuse previous per-file state, even if contents appear compatible.
+        source = directory(root, 'input', create=True)
+        target = directory(root, 'output', create=True)
+        for name, content in [('document', raw), ('request.json', json.dumps(expected, separators=(',', ':')).encode())]:
+            fd = os.open(name, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o400, dir_fd=source)
+            with os.fdopen(fd, 'wb') as stream:
+                stream.write(content); stream.flush(); os.fsync(stream.fileno()); os.fchown(stream.fileno(), 10001, 10001)
+        os.fchmod(source, 0o500); os.fchown(source, 10001, 10001); os.fchown(target, 10001, 10001)
+        os.fsync(source); os.fsync(target); os.fsync(root)
+    finally:
+        for fd in (target, source, root):
+            if fd is not None: os.close(fd)
+
+
+def upload(value, objects, mount='/work'):
+    root = source = target = None
+    try:
+        root = os.open(mount, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        source, target = directory(root, 'input'), directory(root, 'output')
+        raw = read_file(source, 'document', MAX_INPUT)
+        expected = value['request']
+        if request(raw, expected['mediaType'], expected['requestId']) != expected: raise ValueError('Document input binding changed')
+        encoded = read_file(target, 'result.json', MAX_ENVELOPE)
+        result(raw, expected['mediaType'], expected['requestId'], encoded)
+        objects.put(expected['requestId'], 'result', encoded)
+    finally:
+        for fd in (target, source, root):
+            if fd is not None: os.close(fd)
+
+
+def main():
+    # No document content, token, upstream response or traceback enters job logs.
+    try:
+        if sys.argv[1:] not in [['download'], ['upload']]: raise ValueError()
+        mode = sys.argv[1]
+        if os.getuid() != (0 if mode == 'download' else 10001): raise ValueError()
+        value = metadata(os.environ['DOCUMENT_JOB'])
+        objects = GoogleDocumentObjects(value['bucket'], GoogleDocumentApi())
+        (download if mode == 'download' else upload)(value, objects)
+    except Exception:
+        raise SystemExit(2) from None
+
+
+if __name__ == '__main__': main()

package/src/runtime/enterprise_http.py

@@ -0,0 +1,212 @@
+"""Company-session API and native source consent callbacks.
+
+Existing company login supplies the verified API bearer token at bootstrap. The
+browser cannot choose an account, source account, model, URL or permission mapping.
+Native secrets/model/decoding/SQL transports are separate owned adapters.
+"""
+from dataclasses import dataclass
+import html
+import json
+import re
+from urllib.parse import parse_qs,urlsplit
+from fastapi import FastAPI,Request
+from fastapi.responses import JSONResponse,HTMLResponse,RedirectResponse,Response
+from starlette.concurrency import run_in_threadpool
+from enterprise_identity import trusted_https
+from enterprise_sources import SourceDenied,SourceUnavailable,checked_url
+from public_faq import InvalidAnswer,object_pairs
+
+COOKIE='__Host-enterprise-session'
+CSRF='x-csrf-token'
+
+
+@dataclass(frozen=True)
+class SourceConnection:
+    label: str
+    kind: str
+    driver: object
+
+
+def problem(code,status):
+    messages={'signin':'Sign in with your company account to continue.','forbidden':'Your account cannot access this workspace. Ask your workspace owner for access.','request':'Check your question or refresh this page and try again.','setup':'Your workspace owner needs to enable a company source for your account.','source':'Connect your company sources before asking a question.','busy':'Your source connection is updating. Try again in a moment.','capacity':'You already have questions processing. Wait for one to finish or cancel it before asking another.','unavailable':'Your workspace could not finish this answer. Please try again shortly.','answer':'This answer could not be verified against your current sources. Please try again.'}
+    return JSONResponse({'error':{'code':code,'message':messages[code]}},status_code=status)
+
+
+def callback_notice(label):
+    title='We could not finish connecting '+label
+    return HTMLResponse('<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>'+html.escape(title)+'</title><main><h1>'+html.escape(title)+'</h1><p>Return to your workspace, sign in if needed, and choose Connect again.</p><a href="/">Return to your workspace</a></main></html>',status_code=400)
+
+
+def create_app(identity,sessions,connections,make_engine,*,public_origin,web_config=None,static_root=None,answers=None,allow_synchronous=True):
+    if type(allow_synchronous)is not bool:raise ValueError('Use the owned question transport mode')
+    trusted_https(public_origin);origin=urlsplit(public_origin)
+    if origin.path not in {'','/'}or public_origin.endswith('/'):raise ValueError('Use the canonical owned HTTPS origin without a trailing slash')
+    if not isinstance(connections,dict)or not 1<=len(connections)<=20 or not callable(make_engine):raise ValueError('Supply owned native source and application adapters')
+    grants=set()
+    for alias,entry in connections.items():
+        if not isinstance(alias,str)or not re.fullmatch(r'[a-z][a-z0-9_-]{0,31}',alias)or not isinstance(entry,SourceConnection)or entry.kind not in {'graph','confluence'}or not isinstance(entry.label,str)or not 1<=len(entry.label)<=80:raise ValueError('Invalid configured source connection')
+        driver=entry.driver
+        if driver.store is not sessions.auth or driver.redirect!=public_origin+'/oauth/callback/'+alias:raise ValueError('Source consent must use the owned store and exact callback')
+        key=(entry.kind,driver.client,getattr(driver,'tenant',None))
+        if key in grants:raise ValueError('Use one consent/cache per vendor grant and share it across its document sources')
+        grants.add(key)
+    app=FastAPI(docs_url=None,redoc_url=None,openapi_url=None)
+    callback_paths={'/oauth/callback/'+alias for alias in connections}
+    auth=sessions.auth
+    if answers is not None and(answers.store.auth is not auth or answers.store.account_id!=identity.account_id or answers.connections!=connections):raise ValueError('Queued answers must use the same owned account, authority and sources')
+    csp="default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
+    if web_config is not None:
+        if answers is None:raise ValueError('The browser workspace requires the durable question service')
+        from enterprise_web import install_web
+        csp=install_web(app,identity,connections,web_config,static_root)
+    def cookie(request):
+        fields=[part.strip().split('=',1)for header in request.headers.getlist('cookie')for part in header.split(';')]
+        matches=[value for field,*value in fields if field==COOKIE]
+        if len(matches)>1:raise SourceDenied('company_identity_required')
+        return request.cookies.get(COOKIE,'')
+    async def actor(request,*,csrf=False):
+        session=await run_in_threadpool(sessions.authenticate,cookie(request))
+        if session.principal.account_id!=identity.account_id:raise SourceDenied('company_identity_required')
+        if csrf:
+            if request.headers.get('origin')!=public_origin:raise SourceDenied('browser_request_denied')
+            session.require_csrf(request.headers.get(CSRF,''))
+        return session
+    async def body(request,limit=8192):
+        data=bytearray()
+        async for chunk in request.stream():
+            data.extend(chunk)
+            if len(data)>limit:raise ValueError('Body exceeds the owned request limit')
+        return bytes(data)
+    async def json_body(request):
+        if request.headers.get('content-type','').split(';')[0].strip().lower()!='application/json':raise ValueError('Use JSON')
+        value=json.loads(await body(request),object_pairs_hook=object_pairs)
+        if not isinstance(value,dict):raise ValueError('Use an object')
+        return value
+    def source(alias):
+        if alias not in connections:raise ValueError('Unknown source')
+        return connections[alias]
+    @app.middleware('http')
+    async def boundary(request,next_handler):
+        try:
+            callback=request.url.path in callback_paths
+            supplied=request.headers.get('origin')
+            if not callback and supplied and supplied!=public_origin:response=problem('forbidden',403)
+            else:response=await next_handler(request)
+        except SourceDenied as error:
+            code=str(error)
+            if code in {'company_identity_required','company_identity_expired'}:response=problem('signin',401)
+            elif code=='source_consent_unavailable':response=problem('unavailable',503)
+            elif code=='source_mapping_required':response=problem('setup',403)
+            elif code in {'source_reconnection_required','source_consent_required'}:response=problem('source',409)
+            else:response=problem('forbidden',403)
+        except SourceUnavailable as error:response=problem('capacity',429)if str(error)=='query_capacity_reached'else problem('busy'if str(error)=='source_refresh_in_progress'else'unavailable',503)
+        except InvalidAnswer:response=problem('answer',503)
+        except(ValueError,UnicodeError,RecursionError):response=problem('request',400)
+        except Exception:response=problem('unavailable',503)
+        response.headers.update({'Cache-Control':'no-store','Pragma':'no-cache','X-Content-Type-Options':'nosniff','Referrer-Policy':'no-referrer','Strict-Transport-Security':'max-age=31536000','Content-Security-Policy':csp})
+        return response
+    @app.get('/healthz')
+    def health():return {'status':'running'}
+    @app.post('/api/session')
+    async def bootstrap(request:Request):
+        if request.headers.get('origin')!=public_origin:raise SourceDenied('browser_request_denied')
+        if await json_body(request)!={}:raise ValueError('No caller identity fields')
+        header=request.headers.get('authorization','')
+        principal=await run_in_threadpool(identity.verify,header[7:]if header.startswith('Bearer ')else'')
+        created=await run_in_threadpool(sessions.create,principal,cookie(request))
+        response=JSONResponse({'signedIn':True,'csrfToken':created.csrf})
+        response.set_cookie(COOKIE,created.token,max_age=created.max_age,secure=True,httponly=True,samesite='none',path='/')
+        return response
+    @app.get('/api/session')
+    async def describe(request:Request):
+        # Non-simple header blocks cross-site scripts/tags from retrieving CSRF.
+        # No CORS capability is granted to another origin.
+        if request.headers.get('x-workspace-request')!='session':raise SourceDenied('browser_request_denied')
+        user=await actor(request)
+        rows=[]
+        for alias,entry in connections.items():rows.append({'id':alias,'name':entry.label,'status':await run_in_threadpool(auth.connection_status,user.principal,entry.driver.source_id)})
+        return {'signedIn':True,'csrfToken':user.csrf,'sources':rows}
+    @app.delete('/api/session')
+    async def logout(request:Request):
+        user=await actor(request,csrf=True);await run_in_threadpool(sessions.revoke,user)
+        response=Response(status_code=204);response.delete_cookie(COOKIE,path='/',secure=True,httponly=True,samesite='none');return response
+    @app.post('/api/sources/{alias}/connect')
+    async def connect(alias:str,request:Request):
+        user=await actor(request,csrf=True);entry=source(alias)
+        if await json_body(request)!={}:raise ValueError('No caller source or callback settings')
+        if await run_in_threadpool(auth.connection_status,user.principal,entry.driver.source_id)=='needs_setup':raise SourceDenied('source_mapping_required')
+        start=await run_in_threadpool(entry.driver.start,user.principal,user.browser_nonce)
+        checked_url(start.url,{'login.microsoftonline.com'if entry.kind=='graph'else'auth.atlassian.com'})
+        return {'authorizationUrl':start.url}
+    @app.delete('/api/sources/{alias}')
+    async def disconnect(alias:str,request:Request):
+        user=await actor(request,csrf=True);entry=source(alias);await run_in_threadpool(auth.disconnect,user.principal,entry.driver.source_id);return Response(status_code=204)
+    @app.api_route('/oauth/callback/{alias}',methods=['GET','POST'])
+    async def callback(alias:str,request:Request):
+        entry=source(alias)
+        try:
+            if request.method!=('POST'if entry.kind=='graph'else'GET'):raise ValueError('Incorrect consent response method')
+            user=await actor(request)
+            if request.method=='POST':
+                if request.headers.get('content-type','').split(';')[0].strip().lower()!='application/x-www-form-urlencoded':raise ValueError('Incorrect consent content type')
+                params=parse_qs((await body(request,16384)).decode('utf-8'),keep_blank_values=True,strict_parsing=True,max_num_fields=12)
+            else:
+                if len(request.url.query)>16384:raise ValueError('Consent response too large')
+                params=parse_qs(request.url.query,keep_blank_values=True,strict_parsing=True,max_num_fields=12)
+            if any(len(values)!=1 for values in params.values())or not params.get('state'):raise ValueError('Invalid consent response')
+            if params.get('error'):
+                await run_in_threadpool(auth.consume,user.principal,entry.driver.source_id,user.browser_nonce,params['state'][0]);return callback_notice(entry.label)
+            if not params.get('code'):raise ValueError('Missing consent code')
+            await run_in_threadpool(entry.driver.finish,user.principal,user.browser_nonce,params['state'][0],params['code'][0])
+            return RedirectResponse('/?connection=connected&source='+alias,status_code=303)
+        except Exception:return callback_notice(entry.label)
+    @app.post('/api/ask')
+    async def ask(request:Request):
+        if not allow_synchronous:return JSONResponse({'error':{'code':'request','message':'Use the workspace to submit your question.'}},status_code=410)
+        user=await actor(request,csrf=True);value=await json_body(request)
+        if set(value)!={'question'}or not isinstance(value['question'],str)or not value['question'].strip()or len(value['question'])>1000:raise ValueError('Supply only the question')
+        def answer():
+            def authorize(subject):
+                if subject!=user.principal.key:raise SourceDenied('company_identity_required')
+                sessions.authenticate(cookie(request))
+            from enterprise_knowledge import current_engine
+            engine=current_engine(auth,connections,user.principal,make_engine,authorize)
+            result=engine.answer(value['question'],user.principal.key)
+            # Independent final company-session gate, beyond source document gates.
+            sessions.authenticate(cookie(request))
+            return result
+        return await run_in_threadpool(answer)
+    @app.post('/api/queries')
+    async def submit_question(request:Request):
+        user=await actor(request,csrf=True);value=await json_body(request)
+        if answers is None:raise SourceUnavailable('question_worker_unavailable')
+        if set(value)!={'question','requestId'}or not isinstance(value['question'],str)or not value['question'].strip()or len(value['question'])>1000:raise ValueError('Supply a question and request identity')
+        from enterprise_queries import QueryConflict
+        try:identity=await run_in_threadpool(answers.store.submit,user,value['question'],value['requestId'])
+        except QueryConflict:return JSONResponse({'error':{'code':'request','message':'This question could not be submitted. Please send it again.'}},status_code=409)
+        return JSONResponse({'id':identity,'status':'queued'},status_code=202)
+    @app.get('/api/queries/{query_id}')
+    async def question_status(query_id:str,request:Request):
+        if request.headers.get('x-workspace-request')!='session':raise SourceDenied('browser_request_denied')
+        user=await actor(request)
+        if answers is None:raise SourceUnavailable('question_worker_unavailable')
+        from enterprise_queries import QueryMissing
+        try:result=await run_in_threadpool(answers.status,user,query_id)
+        except QueryMissing:return JSONResponse({'error':{'code':'request','message':'This question is no longer available.'}},status_code=404)
+        await run_in_threadpool(sessions.authenticate,cookie(request))
+        return result
+    @app.get('/api/queries')
+    async def pending_questions(request:Request):
+        if request.headers.get('x-workspace-request')!='session':raise SourceDenied('browser_request_denied')
+        user=await actor(request)
+        if answers is None:raise SourceUnavailable('question_worker_unavailable')
+        return {'queries':await run_in_threadpool(answers.store.pending,user)}
+    @app.delete('/api/queries/{query_id}')
+    async def cancel_question(query_id:str,request:Request):
+        user=await actor(request,csrf=True)
+        if answers is None:raise SourceUnavailable('question_worker_unavailable')
+        from enterprise_queries import QueryMissing
+        try:await run_in_threadpool(answers.store.cancel,user,query_id)
+        except QueryMissing:return JSONResponse({'error':{'code':'request','message':'This question is no longer available.'}},status_code=404)
+        return Response(status_code=204)
+    return app

package/src/runtime/enterprise_identity.py

@@ -0,0 +1,52 @@
+"""Existing company API identity; no replacement IdP or source-token claims.
+
+Issuer, API audience, JWKS URL, delegated scope and account are operator-owned
+configuration. Live membership remains a separate required database check.
+"""
+from dataclasses import dataclass,field
+import hashlib
+import re
+import time
+from urllib.parse import urlsplit
+import jwt
+from enterprise_sources import SourceDenied
+
+
+def trusted_https(value):
+    try:parts=urlsplit(value);port=parts.port
+    except (TypeError,ValueError):raise ValueError('Invalid owned identity endpoint')from None
+    if parts.scheme!='https'or not parts.hostname or (port is not None and not 1<=port<=65535)or parts.username or parts.password or parts.query or parts.fragment or any(ord(c)<33 for c in value):raise ValueError('Invalid owned identity endpoint')
+    return value
+
+
+@dataclass(frozen=True)
+class CompanyPrincipal:
+    account_id: str
+    issuer: str
+    subject: str = field(repr=False)
+    expires_at: int
+
+    @property
+    def key(self):return hashlib.sha256((self.issuer+'\0'+self.subject).encode()).hexdigest()
+
+    def require(self):
+        if type(self.expires_at)is not int or self.expires_at<=time.time()+5:raise SourceDenied('company_identity_expired')
+
+
+class CompanyIdentity:
+    def __init__(self,account_id,issuer,audience,jwks_uri,scope='knowledge.read',*,jwks=None):
+        if not isinstance(account_id,str)or not re.fullmatch(r'[a-zA-Z0-9_-]{1,128}',account_id):raise ValueError('Use the owned company account')
+        if not isinstance(audience,str)or not 1<=len(audience)<=300 or not isinstance(scope,str)or not re.fullmatch(r'[A-Za-z0-9_./:-]{1,200}',scope):raise ValueError('Use the owned API audience and delegated scope')
+        self.account_id=account_id;self.issuer=trusted_https(issuer);self.audience=audience;self.scope=scope
+        self.jwks_uri=trusted_https(jwks_uri)
+        self.jwks=jwks or jwt.PyJWKClient(self.jwks_uri,timeout=3,lifespan=300,cache_keys=False)
+
+    def verify(self,token):
+        try:
+            if not isinstance(token,str)or not 1<=len(token)<=16384:raise ValueError('Invalid token')
+            key=self.jwks.get_signing_key_from_jwt(token).key
+            claims=jwt.decode(token,key,algorithms=['RS256'],issuer=self.issuer,audience=self.audience,options={'require':['iss','sub','aud','exp','iat']})
+            scope=claims.get('scp',claims.get('scope'))
+            if not isinstance(scope,str)or self.scope not in scope.split()or claims['aud']!=self.audience or not isinstance(claims['sub'],str)or not 1<=len(claims['sub'].encode())<=255 or any(ord(c)<32 for c in claims['sub'])or any(type(claims[k])is not int for k in ['iat','exp'])or not 0<claims['exp']-claims['iat']<=3600:raise ValueError('Invalid company API credential')
+            principal=CompanyPrincipal(self.account_id,self.issuer,claims['sub'],claims['exp']);principal.require();return principal
+        except Exception:raise SourceDenied('company_identity_required')from None