ltcai 11.5.2 → 11.7.0

package/latticeai/api/hooks.py

@@ -1,165 +0,0 @@
-"""Hooks platform API router (v3.2.0).
-
-Exposes the lifecycle :class:`~lattice_brain.runtime.hooks.HooksRegistry` over HTTP so
-the /app Hooks view can list, inspect, enable/disable, reorder, and register
-hooks. Full paths live in the decorators (no ``prefix=``), matching the rest of
-the API.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Callable, List, Optional
-
-from fastapi import APIRouter, HTTPException, Request
-from pydantic import BaseModel
-
-from lattice_brain.runtime.hooks import HooksRegistry
-
-
-class HookToggleRequest(BaseModel):
-    hook_id: str
-    enabled: bool = True
-
-
-class HookReorderRequest(BaseModel):
-    kind: str
-    ordered_ids: List[str] = []
-
-
-class HookRegisterRequest(BaseModel):
-    name: str
-    kind: str
-    description: str = ""
-    command: str = ""
-    order: Optional[int] = None
-    enabled: bool = True
-
-
-class HookRunRequest(BaseModel):
-    kind: Optional[str] = None
-    hook_id: Optional[str] = None
-    event: str = ""
-    payload: dict = {}
-
-
-def create_hooks_router(
-    *,
-    registry: HooksRegistry,
-    require_user: Callable[[Request], str],
-    # Production returns ``(email, users)``; small adapters return just the
-    # identity, which ``_require_admin_email`` below handles.
-    require_admin: Callable[[Request], Any],
-    append_audit_event: Callable[..., None],
-) -> APIRouter:
-    router = APIRouter()
-
-    def _require_admin_email(request: Request) -> str:
-        """Authorize a hook mutation and return the acting administrator."""
-        result = require_admin(request)
-        if isinstance(result, tuple):
-            return str(result[0] or "")
-        # Keep the router tolerant of small test/runtime adapters that return
-        # only the identity while the production access runtime returns
-        # ``(email, users)``.
-        return str(result or "")
-
-    @router.get("/api/hooks")
-    async def list_hooks(request: Request, kind: Optional[str] = None):
-        require_user(request)
-        return registry.list(kind=kind)
-
-    # NOTE: declared before the ``/{hook_id:path}`` catch-all so "runs" is not
-    # captured as a hook id.
-    @router.get("/api/hooks/runs")
-    async def hook_runs(request: Request, limit: int = 50, kind: Optional[str] = None):
-        require_user(request)
-        return registry.recent_runs(limit=limit, kind=kind)
-
-    @router.post("/api/hooks/run")
-    async def run_hooks(req: HookRunRequest, request: Request):
-        """Execute hooks now — by ``kind`` (all enabled hooks of that kind) or a
-        single ``hook_id``. Returns the dispatch record so callers can see what
-        ran, in what order, and whether the action was blocked."""
-        user = _require_admin_email(request)
-        try:
-            if req.hook_id:
-                result = registry.run_hook(req.hook_id, event=req.event or None, payload=req.payload, user_email=user)
-            elif req.kind:
-                result = registry.run_hooks(req.kind, event=req.event or None, payload=req.payload, user_email=user)
-            else:
-                raise HTTPException(status_code=400, detail="Provide a 'kind' or a 'hook_id' to run.")
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Hook not found: {exc}") from exc
-        except ValueError as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-        append_audit_event("hook_run", user_email=user, hook_id=req.hook_id, kind=req.kind, event=req.event)
-        return result
-
-    # Alias for the same dispatch action (fire == run).
-    @router.post("/api/hooks/fire")
-    async def fire_hooks(req: HookRunRequest, request: Request):
-        return await run_hooks(req, request)
-
-    @router.get("/api/hooks/{hook_id:path}")
-    async def inspect_hook(hook_id: str, request: Request):
-        require_user(request)
-        try:
-            return {"hook": registry.inspect(hook_id)}
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Hook not found: {hook_id}") from exc
-
-    @router.post("/api/hooks/enable")
-    async def enable_hook(req: HookToggleRequest, request: Request):
-        user = _require_admin_email(request)
-        try:
-            hook = registry.set_enabled(req.hook_id, req.enabled)
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Hook not found: {req.hook_id}") from exc
-        append_audit_event("hook_toggle", user_email=user, hook_id=req.hook_id, enabled=req.enabled)
-        return {"hook": hook}
-
-    @router.post("/api/hooks/disable")
-    async def disable_hook(req: HookToggleRequest, request: Request):
-        user = _require_admin_email(request)
-        try:
-            hook = registry.set_enabled(req.hook_id, False)
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Hook not found: {req.hook_id}") from exc
-        append_audit_event("hook_toggle", user_email=user, hook_id=req.hook_id, enabled=False)
-        return {"hook": hook}
-
-    @router.post("/api/hooks/reorder")
-    async def reorder_hooks(req: HookReorderRequest, request: Request):
-        _require_admin_email(request)
-        return registry.reorder(req.kind, req.ordered_ids)
-
-    @router.post("/api/hooks/register")
-    async def register_hook(req: HookRegisterRequest, request: Request):
-        user = _require_admin_email(request)
-        try:
-            entry = registry.register(
-                name=req.name,
-                kind=req.kind,
-                description=req.description,
-                command=req.command,
-                order=req.order,
-                enabled=req.enabled,
-            )
-        except ValueError as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-        append_audit_event("hook_register", user_email=user, hook_id=entry["id"], kind=entry["kind"])
-        return {"hook": entry}
-
-    @router.delete("/api/hooks/{hook_id:path}")
-    async def remove_hook(hook_id: str, request: Request):
-        user = _require_admin_email(request)
-        try:
-            result = registry.remove(hook_id)
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=f"Hook not found: {hook_id}") from exc
-        except ValueError as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-        append_audit_event("hook_remove", user_email=user, hook_id=hook_id)
-        return result
-
-    return router

package/latticeai/api/index_jobs.py

@@ -1,145 +0,0 @@
-"""Index jobs API (v11.5.0, plan §3a) — the trigger the embed queue never had.
-
-``vector_jobs`` has been a durable backlog since v11.1.0: an ingest whose
-inline embedding fails lands anyway, the node is queued, and
-``VectorEmbedQueue.tick`` will embed it *when someone runs a tick*. Nobody did.
-The only drain in the product was
-:meth:`~lattice_brain.ingestion.IngestionPipeline.drain_vector_queue`, callable
-from a test or a REPL and from nothing that runs on its own — which is what
-FEATURE_STATUS.md:179-185 says out loud.
-
-This router is the missing half: an HTTP surface a scheduler can call.
-
-* ``POST /api/index/drain`` — run one tick now, answer with what it did and
-  what is left.
-* ``GET  /api/index/queue`` — the backlog counts, read-only.
-
-Their two siblings under the same prefix live in ``search.py``
-(``/api/index/status``, ``/api/index/rebuild``): those answer *is the index
-complete* and *rebuild it from scratch*, which is the operator's hammer. This
-pair is the small, repeatable step a timer can take every minute.
-
-Two honest boundaries, stated here so the payloads are not read as more than
-they are:
-
-* **The backlog is machine-wide.** One SQLite queue serves every workspace, so
-  a drain embeds whatever is owed regardless of who asked, and the counts are
-  totals for this Brain. The workspace gate still runs on both paths — it is
-  the authorization check, not a filter — and the drain payload says
-  ``scope: "machine"`` rather than implying a scoped number.
-* **Draining is not indexing.** The tick delegates to the store's own indexer;
-  a node that fails goes back to ``pending`` until its retry budget runs out.
-  The response reports ``claimed``/``indexed``/``retried``/``failed`` verbatim
-  from the queue instead of summarising them into a success flag.
-"""
-
-from __future__ import annotations
-
-import asyncio
-from typing import Any, Callable, Dict, Optional
-
-from fastapi import APIRouter, Request
-from pydantic import BaseModel
-
-from lattice_brain.graph.vector_index import DEFAULT_TICK_LIMIT, VECTOR_JOB_STATUSES
-from latticeai.core.messages import http_error, resolve_language
-
-#: Bounds on one drain. The floor keeps a caller from asking for a no-op tick
-#: that still claims the queue's lock; the ceiling keeps one HTTP request from
-#: turning into an unbounded embedding run behind a client that will time out.
-MIN_DRAIN_LIMIT = 1
-MAX_DRAIN_LIMIT = 100
-
-
-class DrainRequest(BaseModel):
-    """How many queued nodes one drain may claim.
-
-    Omitted (or a body-less POST) means the queue's own tick size, so a caller
-    with no opinion inherits the number the queue was designed around.
-    """
-
-    limit: Optional[int] = None
-
-
-def create_index_jobs_router(
-    *,
-    pipeline: Any,
-    knowledge_graph: Any,
-    require_user: Callable[[Request], Any],
-    gate_read: Callable[[Request], Optional[str]],
-    gate_write: Callable[[Request], Optional[str]],
-) -> APIRouter:
-    router = APIRouter()
-
-    def _require_pipeline(request: Request) -> Any:
-        """The pipeline, or 503 — a drain without ingestion is not a 500."""
-        if pipeline is None or not pipeline.available():
-            raise http_error(503, "capture.ingestion_disabled", resolve_language(request))
-        return pipeline
-
-    def _queue_state() -> Dict[str, Any]:
-        """Backlog counts, or an explicit "not tracked" — never a fake zero.
-
-        A store without a durable queue reports ``available: false`` alongside
-        its zeros, because "0 pending" and "nothing is counting" are different
-        answers and a scheduler polling this would otherwise read the second as
-        the first.
-        """
-        queue = getattr(knowledge_graph, "vector_queue", None)
-        if queue is None or not queue.available:
-            return {
-                "available": False,
-                "counts": dict.fromkeys(VECTOR_JOB_STATUSES, 0),
-                "pending": 0,
-            }
-        return {
-            "available": True,
-            "counts": dict(queue.snapshot()),
-            "pending": int(queue.pending_count()),
-        }
-
-    @router.post("/api/index/drain")
-    async def drain_index_queue(request: Request, req: Optional[DrainRequest] = None):
-        """Run one background-embedding tick and report what it did.
-
-        Off the event loop: the tick opens SQLite and calls the embedder, and
-        this server has one loop for every user (10.9.0).
-        """
-        require_user(request)
-        gate_write(request)
-        active = _require_pipeline(request)
-        requested = req.limit if req is not None else None
-        limit = DEFAULT_TICK_LIMIT if requested is None else requested
-        if limit < MIN_DRAIN_LIMIT or limit > MAX_DRAIN_LIMIT:
-            raise http_error(
-                422,
-                "index.limit_out_of_range",
-                resolve_language(request),
-                min=MIN_DRAIN_LIMIT,
-                max=MAX_DRAIN_LIMIT,
-            )
-        tick = await asyncio.to_thread(active.drain_vector_queue, limit)
-        return {
-            **dict(tick),
-            "limit": limit,
-            "scope": "machine",
-            "queue": _queue_state(),
-        }
-
-    @router.get("/api/index/queue")
-    async def index_queue(request: Request):
-        """The embed backlog, counted. Reads nothing else and writes nothing."""
-        require_user(request)
-        gate_read(request)
-        _require_pipeline(request)
-        return _queue_state()
-
-    return router
-
-
-__all__ = [
-    "MAX_DRAIN_LIMIT",
-    "MIN_DRAIN_LIMIT",
-    "DrainRequest",
-    "create_index_jobs_router",
-]

package/latticeai/api/invitations.py

@@ -1,100 +0,0 @@
-"""Invitation API: create, list, and accept workspace invitations."""
-
-from __future__ import annotations
-
-from typing import Callable, Optional
-
-from fastapi import APIRouter, HTTPException, Request
-from pydantic import BaseModel
-
-
-class InvitationCreateRequest(BaseModel):
-    email: Optional[str] = None
-    workspace_id: Optional[str] = None
-    role: str = "member"
-    expires_hours: int = 168
-
-
-def create_invitations_router(
-    *,
-    invitation_store,
-    workspace_service,
-    require_admin: Callable,
-    require_user: Callable[[Request], str],
-    user_id_for_email: Callable[[Optional[str]], Optional[str]],
-    append_audit_event: Callable[..., None],
-) -> APIRouter:
-    router = APIRouter()
-
-    @router.get("/invitations")
-    async def list_invitations(request: Request):
-        require_admin(request)
-        return {"invitations": invitation_store.list()}
-
-    @router.post("/invitations")
-    async def create_invitation(req: InvitationCreateRequest, request: Request):
-        admin_email, _ = require_admin(request)
-        actor_id = user_id_for_email(admin_email)
-        if req.workspace_id:
-            try:
-                workspace_service.store._require_permission(
-                    workspace_service.store._load_org(workspace_service.store.load_state(), req.workspace_id),
-                    actor_id,
-                    "manage_members",
-                )
-            except FileNotFoundError as exc:
-                raise HTTPException(status_code=404, detail=f"Workspace not found: {req.workspace_id}") from exc
-            except ValueError as exc:
-                raise HTTPException(status_code=400, detail=str(exc)) from exc
-            except PermissionError as exc:
-                raise HTTPException(status_code=403, detail=str(exc)) from exc
-        if req.role not in {"owner", "admin", "member", "viewer"}:
-            raise HTTPException(status_code=400, detail="unknown invitation role")
-        invitation = invitation_store.create(
-            email=req.email,
-            workspace_id=req.workspace_id,
-            role=req.role,
-            created_by=actor_id,
-            expires_hours=req.expires_hours,
-        )
-        append_audit_event(
-            "invitation_created",
-            user_email=admin_email,
-            invitation_id=invitation.get("id"),
-            workspace_id=req.workspace_id,
-            role=req.role,
-        )
-        return {"invitation": invitation}
-
-    @router.post("/invitations/{token}/accept")
-    async def accept_invitation(token: str, request: Request):
-        email = require_user(request)
-        user_id = user_id_for_email(email)
-        if not user_id:
-            raise HTTPException(status_code=401, detail="Authentication required")
-        try:
-            invitation = invitation_store.accept(token, accepted_by=user_id, email=email or None)
-        except FileNotFoundError as exc:
-            raise HTTPException(status_code=404, detail="Invitation not found") from exc
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-        workspace_id = invitation.get("workspace_id")
-        if workspace_id:
-            try:
-                workspace_service.add_member(
-                    workspace_id,
-                    user_id=user_id,
-                    role=invitation.get("role") or "member",
-                    actor=invitation.get("created_by"),
-                )
-            except Exception as exc:
-                raise HTTPException(status_code=409, detail=str(exc)) from exc
-        append_audit_event(
-            "invitation_accepted",
-            user_email=email,
-            invitation_id=invitation.get("id"),
-            workspace_id=workspace_id,
-        )
-        return {"invitation": invitation}
-
-    return router