ltcai 11.5.2 → 11.7.0

package/latticeai/api/agents.py

@@ -1,228 +0,0 @@
-"""Multi-Agent Runtime API router (v2).
-
-Exposes the built-in agent roles and an orchestrated run endpoint that connects
-to Workspace, Memory, Knowledge Graph, Workflow runs, and the Timeline. Paths
-are namespaced under ``/agents`` (plural) so they never collide with the
-existing single-agent ``/agent`` endpoints.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any, Callable, Dict, List, Optional
-
-from fastapi import APIRouter, HTTPException, Request
-from pydantic import BaseModel
-
-from latticeai.api.ui_redirects import app_redirect
-
-_CORE_EXECUTION_ROLES = ["planner", "executor", "reviewer"]
-_MEMORY_GROUNDED_ROLES = ["researcher", *_CORE_EXECUTION_ROLES]
-
-
-def _memory_grounded_roles(roles: List[str]) -> Optional[List[str]]:
-    """Ground standard user-initiated agent runs in Brain recall first.
-
-    Explicit specialist/custom pipelines keep their requested shape. The
-    desktop Brain and Work surfaces both send the historical three-role core
-    sequence, so normalizing it at the API boundary upgrades existing clients
-    without a frontend-only compatibility branch.
-    """
-    requested = list(roles or _CORE_EXECUTION_ROLES)
-    if requested == _CORE_EXECUTION_ROLES:
-        return list(_MEMORY_GROUNDED_ROLES)
-    return requested or None
-
-
-class AgentRunRequest(BaseModel):
-    goal: str
-    roles: List[str] = []
-    inputs: Dict[str, Any] = {}
-    max_retries: int = 2
-
-
-class MemorySnapshotRequest(BaseModel):
-    label: str = "agent memory snapshot"
-    reason: str = ""
-    memory_ids: List[str] = []
-
-
-def create_agents_router(
-    *,
-    store,
-    orchestrator_factory: Callable[[Optional[str], Optional[str]], Any],
-    require_user: Callable[[Request], str],
-    get_current_user: Callable[[Request], Optional[str]],
-    gate_read: Callable[[Request], Optional[str]],
-    gate_write: Callable[[Request], Optional[str]],
-    workspace_graph: Callable[[], Any],
-    append_audit_event: Callable[..., None],
-    ui_file_response: Optional[Callable[[Path], Any]] = None,
-    static_dir: Optional[Path] = None,
-    agent_runtime: Any = None,
-    run_executor: Any = None,
-) -> APIRouter:
-    from lattice_brain.runtime.agent_runtime import (
-        AgentRuntime,
-        AgentRuntimeUnavailable,
-    )
-    from lattice_brain.runtime.multi_agent import AGENT_ROLES, ROLE_AGENT_IDS
-
-    # Single AgentRuntime boundary: the router (and via it, the frontend) talks
-    # to this façade instead of reaching into the orchestrator/store directly.
-    runtime = agent_runtime or AgentRuntime(
-        store=store,
-        orchestrator_factory=orchestrator_factory,
-        workspace_graph=workspace_graph,
-        append_audit_event=append_audit_event,
-    )
-
-    router = APIRouter()
-
-    # ── AgentRuntime boundary endpoints ───────────────────────────────────
-    @router.get("/agents/api/runtime/status")
-    async def agent_runtime_status(request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        return runtime.status(scope=scope)
-
-    @router.get("/agents/api/runtime/health")
-    async def agent_runtime_health(request: Request):
-        require_user(request)
-        return runtime.health()
-
-    @router.get("/agents/api/runtime/config")
-    async def agent_runtime_config(request: Request):
-        require_user(request)
-        return runtime.config()
-
-    @router.get("/agents/api/runs/{run_id}/events")
-    async def agent_run_events(run_id: str, request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        try:
-            return runtime.events(run_id, scope=scope)
-        except FileNotFoundError as exc:
-            raise HTTPException(status_code=404, detail=f"Agent run not found: {run_id}") from exc
-
-    @router.post("/agents/api/runs/{run_id}/stop")
-    async def agent_run_stop(run_id: str, request: Request):
-        require_user(request)
-        scope = gate_write(request)
-        return runtime.stop(run_id, scope=scope)
-
-    @router.get("/agents")
-    async def agents_page(request: Request):
-        require_user(request)
-        return app_redirect("agents", request)
-
-    @router.get("/agents/api/roles")
-    async def agent_roles(request: Request):
-        require_user(request)
-        return {
-            "roles": [
-                {"role": role, "agent_id": ROLE_AGENT_IDS.get(role, f"agent:{role}")}
-                for role in AGENT_ROLES
-            ],
-            "default_pipeline": ["planner", "executor", "reviewer"],
-        }
-
-    @router.get("/agents/api/runs")
-    async def agent_runs(request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        return runtime.list_runs(scope=scope)
-
-    @router.get("/agents/api/handoffs")
-    async def agent_handoffs(request: Request, run_id: str = ""):
-        require_user(request)
-        scope = gate_read(request)
-        return store.list_handoffs(workspace_id=scope, run_id=run_id or None)
-
-    @router.get("/agents/api/runs/{run_id}")
-    async def agent_run_detail(run_id: str, request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        try:
-            return runtime.get_run(run_id, scope=scope)
-        except FileNotFoundError as exc:
-            raise HTTPException(status_code=404, detail=f"Agent run not found: {run_id}") from exc
-
-    @router.get("/agents/api/runs/{run_id}/replay")
-    async def agent_run_replay(run_id: str, request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        try:
-            return runtime.replay(run_id, scope=scope)
-        except FileNotFoundError as exc:
-            raise HTTPException(status_code=404, detail=f"Agent run not found: {run_id}") from exc
-
-    @router.get("/agents/api/memory/snapshots")
-    async def agent_memory_snapshots(request: Request, limit: int = 50):
-        require_user(request)
-        scope = gate_read(request)
-        return store.list_memory_snapshots(workspace_id=scope, limit=limit)
-
-    @router.post("/agents/api/memory/snapshots")
-    async def agent_memory_snapshot(req: MemorySnapshotRequest, request: Request):
-        current_user = require_user(request)
-        scope = gate_write(request)
-        snapshot = store.create_memory_snapshot(
-            label=req.label,
-            reason=req.reason,
-            memory_ids=req.memory_ids or None,
-            user_email=current_user or None,
-            workspace_id=scope,
-        )
-        return {"snapshot": snapshot}
-
-    @router.post("/agents/api/run")
-    async def agent_run(req: AgentRunRequest, request: Request):
-        current_user = require_user(request)
-        scope = gate_write(request)
-        grounded_roles = _memory_grounded_roles(req.roles)
-        try:
-            if run_executor is not None:
-                return await run_executor.start_agent(
-                    req.goal,
-                    user_email=current_user or None,
-                    scope=scope,
-                    roles=grounded_roles,
-                    inputs=req.inputs,
-                    max_retries=req.max_retries,
-                )
-            # Worker thread: an LLM-backed run blocks on model generation and
-            # must not stall the event loop (the sync model bridge also
-            # requires a loop-free thread).
-            import asyncio
-
-            return await asyncio.to_thread(
-                runtime.start,
-                req.goal,
-                user_email=current_user or None,
-                scope=scope,
-                roles=grounded_roles,
-                inputs=req.inputs,
-                max_retries=req.max_retries,
-            )
-        except ValueError as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-        except AgentRuntimeUnavailable as exc:
-            raise HTTPException(status_code=409, detail=str(exc)) from exc
-        except PermissionError as exc:
-            # A pre_run hook gated this run (e.g. a policy/permission hook).
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-
-    @router.post("/agents/api/run/preview")
-    async def agent_run_preview(req: AgentRunRequest, request: Request):
-        require_user(request)
-        scope = gate_read(request)
-        return runtime.preview(
-            req.goal,
-            scope=scope,
-            roles=_memory_grounded_roles(req.roles),
-            inputs=req.inputs,
-            max_retries=req.max_retries,
-        )
-
-    return router

package/latticeai/api/auth.py

@@ -1,383 +0,0 @@
-"""Authentication API router: register, login, logout, SSO, profile."""
-
-import base64
-import hashlib
-import logging
-import secrets
-import time
-from dataclasses import dataclass
-from typing import Any, Awaitable, Callable, Dict, Optional
-from urllib.parse import urlencode
-
-from fastapi import APIRouter, Request
-from fastapi.responses import JSONResponse, RedirectResponse
-from pydantic import BaseModel
-
-from latticeai.core.config import SSO_CALLBACK_PATH
-from latticeai.core.http_origin import request_external_origin
-from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
-from latticeai.core.oidc import (
-    OIDCValidationError,
-)
-from latticeai.core.oidc import (
-    fetch_jwks as _default_fetch_jwks,
-)
-from latticeai.core.oidc import (
-    verify_id_token as _default_verify_id_token,
-)
-from latticeai.core.users import normalize_email
-
-
-class UserRegister(BaseModel):
-    email: str
-    password: str
-    name: str
-    nickname: str
-
-
-class UserLogin(BaseModel):
-    email: str
-    password: str
-
-
-class ChangePasswordRequest(BaseModel):
-    current_password: str
-    new_password: str
-
-
-class UpdateProfileRequest(BaseModel):
-    name: Optional[str] = None
-    nickname: Optional[str] = None
-
-
-@dataclass(frozen=True)
-class _SSOLoginState:
-    """Server-side SSO transaction state consumed exactly once."""
-
-    issued_at: float
-    nonce: str
-    code_verifier: str
-    invite_authorized: bool
-    #: Exactly what was sent to ``authorize``. The token exchange must repeat
-    #: it byte for byte or the provider rejects the code, so it is carried
-    #: rather than recomputed from a second request that may differ.
-    redirect_uri: str = ""
-
-
-# The nonce and PKCE verifier bind the callback/token to this login attempt.
-# The signed invite cookie is verified once at login and reduced to a
-# server-side claim, so the callback never trusts a client-supplied invite bit.
-_sso_states: Dict[str, _SSOLoginState] = {}
-
-
-def create_auth_router(
-    *,
-    load_users: Callable[[], Dict],
-    save_users: Callable[[Dict], None],
-    hash_password: Callable[[str], str],
-    verify_and_migrate: Callable[[str, str, str, Dict], bool],
-    create_session: Callable[[str], str],
-    get_session_email: Callable[[str], Optional[str]],
-    invalidate_session: Callable[[str], None],
-    extract_bearer_token: Callable[[Request], Optional[str]],
-    get_user_role: Callable[[str, Optional[Dict]], str],
-    require_user: Callable[[Request], str],
-    check_ip_rate_limit: Callable[..., None],
-    client_ip: Callable[[Request], str],
-    get_sso_settings: Callable[[], Dict],
-    get_sso_discovery: Callable[[], Any],
-    public_sso_config: Callable[..., Dict],
-    open_registration: bool,
-    session_ttl: int,
-    require_auth: bool = True,
-    secure_cookies: bool = False,
-    ensure_identity: Optional[Callable[[str, Dict], None]] = None,
-    invite_gate_enabled: bool = False,
-    invite_authorized: Optional[Callable[[Request], bool]] = None,
-    default_redirect_uri: Optional[str] = None,
-    verify_id_token: Callable[..., Dict] = _default_verify_id_token,
-    fetch_jwks: Callable[[str], Awaitable[Dict]] = _default_fetch_jwks,
-) -> APIRouter:
-    router = APIRouter()
-
-    def _enforce_password_policy(password: str, language: str = DEFAULT_LANGUAGE) -> None:
-        # Real policy (v4): length >= 8 with letters AND digits. A 4-char
-        # minimum was not a policy.
-        pw = str(password or "")
-        if len(pw) < 8 or not any(c.isalpha() for c in pw) or not any(c.isdigit() for c in pw):
-            raise http_error(400, "auth.password_too_weak", language)
-
-    @router.post("/register")
-    async def register(req: UserRegister, request: Request):
-        lang = resolve_language(request)
-        check_ip_rate_limit(client_ip(request), "register", max_calls=5, window_secs=3600)
-        invite_claim = bool(
-            invite_gate_enabled
-            and invite_authorized is not None
-            and invite_authorized(request)
-        )
-        if invite_gate_enabled and not invite_claim:
-            raise http_error(403, "auth.invitation_required", lang)
-        # Closed public registration stays closed unless the operator enabled
-        # the invite gate and this exact request carries a valid signed claim.
-        if not open_registration and not invite_claim:
-            raise http_error(403, "auth.registration_disabled", lang)
-        _enforce_password_policy(req.password, lang)
-        email = normalize_email(req.email)
-        users = load_users()
-        if email in users:
-            raise http_error(400, "auth.email_taken", lang)
-        role = "admin" if not users else "user"
-        users[email] = {
-            "password": hash_password(req.password),
-            "name": req.name,
-            "nickname": req.nickname,
-            "role": role,
-            "disabled": False,
-        }
-        if ensure_identity is not None:
-            ensure_identity(email, users[email])
-        save_users(users)
-        msg = "회원가입 성공! 첫 번째 사용자로 관리자 권한이 부여되었습니다." if role == "admin" else "회원가입 성공!"
-        return {"status": "ok", "message": msg, "role": role}
-
-    @router.post("/login")
-    async def login(req: UserLogin, request: Request):
-        lang = resolve_language(request)
-        check_ip_rate_limit(client_ip(request), "login", max_calls=10, window_secs=300)
-        email = normalize_email(req.email)
-        users = load_users()
-        user = users.get(email)
-        if not user or not verify_and_migrate(email, req.password, user.get("password", ""), users):
-            raise http_error(401, "auth.bad_credentials", lang)
-        if user.get("disabled"):
-            raise http_error(403, "auth.account_disabled", lang)
-        role = get_user_role(email, users)
-        token = create_session(email)
-        response = JSONResponse(content={
-            "status": "ok",
-            "nickname": user["nickname"],
-            "name": user["name"],
-            "email": email,
-            "role": role,
-            "is_admin": role == "admin",
-        })
-        response.set_cookie(
-            key="session_token",
-            value=token,
-            httponly=True,
-            secure=secure_cookies,
-            samesite="lax",
-            max_age=session_ttl,
-        )
-        return response
-
-    @router.get("/auth/sso/config")
-    async def sso_config_endpoint():
-        return public_sso_config()
-
-    def _resolve_redirect_uri(request: Request, settings: Dict) -> str:
-        """Where the provider should send the browser back to.
-
-        A configured URI is registered with the provider and is used verbatim.
-        Only the *built-in default* — which names the worker's own port, and is
-        therefore unreachable whenever a gateway fronts it — is replaced by the
-        front door this login actually arrived through.
-        """
-        configured = str(settings.get("redirect_uri") or "")
-        if not default_redirect_uri or configured != default_redirect_uri:
-            return configured
-        origin = request_external_origin(request)
-        return f"{origin}{SSO_CALLBACK_PATH}" if origin else configured
-
-    @router.get("/auth/sso/login")
-    async def sso_login(request: Request):
-        lang = resolve_language(request)
-        settings = get_sso_settings()
-        discovery = await get_sso_discovery()
-        if not settings.get("enabled") or not discovery:
-            raise http_error(503, "sso.not_configured", lang)
-        state = secrets.token_urlsafe(16)
-        nonce = secrets.token_urlsafe(16)
-        # PKCE (S256): bind the token exchange to this login, so an
-        # intercepted authorization code is useless without the verifier.
-        code_verifier = secrets.token_urlsafe(48)
-        code_challenge = (
-            base64.urlsafe_b64encode(hashlib.sha256(code_verifier.encode("ascii")).digest())
-            .rstrip(b"=")
-            .decode("ascii")
-        )
-        invite_claim = bool(
-            not invite_gate_enabled
-            or (
-                invite_authorized is not None
-                and invite_authorized(request)
-            )
-        )
-        redirect_uri = _resolve_redirect_uri(request, settings)
-        _sso_states[state] = _SSOLoginState(
-            issued_at=time.time(),
-            nonce=nonce,
-            code_verifier=code_verifier,
-            invite_authorized=invite_claim,
-            redirect_uri=redirect_uri,
-        )
-        params = urlencode({
-            "client_id": settings["client_id"],
-            "response_type": "code",
-            "redirect_uri": redirect_uri,
-            "scope": settings.get("scopes") or "openid email profile",
-            "state": state,
-            "nonce": nonce,
-            "code_challenge": code_challenge,
-            "code_challenge_method": "S256",
-        })
-        return RedirectResponse(f"{discovery['authorization_endpoint']}?{params}")
-
-    @router.get("/auth/sso/callback")
-    async def sso_callback(request: Request, code: str = "", state: str = "", error: str = ""):
-        lang = resolve_language(request)
-        entry = _sso_states.pop(state, None)
-        if entry is None or time.time() - entry.issued_at > 300:
-            raise http_error(400, "sso.invalid_state", lang)
-        if error:
-            return RedirectResponse(f"/?{urlencode({'sso_error': error})}")
-        settings = get_sso_settings()
-        discovery = await get_sso_discovery()
-        if not settings.get("enabled") or not discovery:
-            raise http_error(503, "sso.config_error", lang)
-        import httpx as _httpx
-        async with _httpx.AsyncClient() as c:
-            r = await c.post(discovery["token_endpoint"], data={
-                "grant_type": "authorization_code",
-                "code": code,
-                "redirect_uri": entry.redirect_uri or settings["redirect_uri"],
-                "client_id": settings["client_id"],
-                "client_secret": settings["client_secret"],
-                "code_verifier": entry.code_verifier,
-            }, headers={"Accept": "application/json"}, timeout=15)
-            tokens = r.json()
-        id_token = tokens.get("id_token")
-        if not id_token:
-            raise http_error(400, "sso.no_id_token", lang)
-        # Never trust a decoded JWT payload: verify signature (against the
-        # provider JWKS), issuer, audience, expiry and the login nonce before
-        # using any claim. Any failure is fail-closed (401).
-        issuer = discovery.get("issuer") or ""
-        try:
-            jwks = await fetch_jwks(discovery.get("jwks_uri", ""))
-            payload = verify_id_token(
-                id_token,
-                jwks=jwks,
-                issuer=issuer,
-                audience=settings["client_id"],
-                nonce=entry.nonce,
-            )
-        except OIDCValidationError as exc:
-            logging.warning("SSO ID token rejected: %s", exc)
-            raise http_error(401, "sso.token_verification_failed", lang)
-        except Exception as exc:  # discovery/JWKS fetch failure → fail closed
-            logging.warning("SSO token validation error: %s", exc)
-            raise http_error(502, "sso.provider_verification_failed", lang)
-        email = normalize_email(payload.get("email") or payload.get("preferred_username") or payload.get("upn") or "")
-        if not email:
-            raise http_error(400, "sso.email_unavailable", lang)
-        users = load_users()
-        if email not in users:
-            if invite_gate_enabled and not entry.invite_authorized:
-                raise http_error(403, "sso.invitation_required", lang)
-            is_first = len(users) == 0
-            users[email] = {
-                "password": "",
-                "name": payload.get("name", email.split("@")[0]),
-                "nickname": payload.get("given_name", email.split("@")[0]),
-                "role": "admin" if is_first else "user",
-                "disabled": False,
-                "sso": True,
-            }
-            if ensure_identity is not None:
-                ensure_identity(email, users[email])
-            save_users(users)
-        if users[email].get("disabled"):
-            raise http_error(403, "auth.account_disabled", lang)
-        token = create_session(email)
-        resp = RedirectResponse("/app", status_code=302)
-        resp.set_cookie(
-            "session_token",
-            token,
-            httponly=True,
-            secure=secure_cookies,
-            samesite="lax",
-            max_age=session_ttl,
-        )
-        return resp
-
-    @router.post("/logout")
-    async def logout(request: Request):
-        token = extract_bearer_token(request)
-        if token:
-            invalidate_session(token)
-        response = JSONResponse(content={"status": "ok"})
-        response.delete_cookie(
-            "session_token",
-            secure=secure_cookies,
-            httponly=True,
-            samesite="lax",
-        )
-        return response
-
-    @router.post("/account/change-password")
-    async def change_password(req: ChangePasswordRequest, request: Request):
-        lang = resolve_language(request)
-        email = normalize_email(require_user(request))
-        if not email:
-            raise http_error(401, "auth.login_required", lang)
-        _enforce_password_policy(req.new_password, lang)
-        users = load_users()
-        user = users.get(email)
-        if not user:
-            raise http_error(404, "auth.user_not_found", lang)
-        if not verify_and_migrate(email, req.current_password, user.get("password", ""), users):
-            raise http_error(401, "auth.current_password_wrong", lang)
-        users[email]["password"] = hash_password(req.new_password)
-        save_users(users)
-        return {"status": "ok", "message": "비밀번호가 변경되었습니다."}
-
-    @router.patch("/account/profile")
-    async def update_profile(req: UpdateProfileRequest, request: Request):
-        lang = resolve_language(request)
-        email = normalize_email(require_user(request))
-        if not email:
-            raise http_error(401, "auth.login_required", lang)
-        if req.name is not None and not req.name.strip():
-            raise http_error(400, "auth.name_required", lang)
-        if req.nickname is not None and not req.nickname.strip():
-            raise http_error(400, "auth.nickname_required", lang)
-        users = load_users()
-        user = users.get(email)
-        if not user:
-            raise http_error(404, "auth.user_not_found", lang)
-        if req.name is not None:
-            users[email]["name"] = req.name.strip()
-        if req.nickname is not None:
-            users[email]["nickname"] = req.nickname.strip()
-        save_users(users)
-        return {"status": "ok", "name": users[email]["name"], "nickname": users[email]["nickname"]}
-
-    @router.get("/account/profile")
-    async def get_profile(request: Request):
-        lang = resolve_language(request)
-        email = normalize_email(require_user(request))
-        if not email:
-            if require_auth:
-                raise http_error(401, "auth.login_required", lang)
-            return {"email": "", "name": "Local User", "nickname": "You", "role": "admin", "is_admin": True}
-        users = load_users()
-        user = users.get(email)
-        if not user:
-            raise http_error(404, "auth.user_not_found", lang)
-        role = get_user_role(email, users)
-        return {"email": email, "name": user.get("name", ""), "nickname": user.get("nickname", ""),
-                "role": role, "is_admin": role == "admin"}
-
-    return router