ltcai 8.9.0 → 9.1.0

package/latticeai/runtime/network_config_runtime.py

@@ -0,0 +1,56 @@
+"""VPC network-profile config seam extracted from the legacy app factory.
+
+``DEFAULT_VPC_CONFIG`` and the load/save helpers used to live inline in
+``app_factory._build``. Behaviour and exported names are preserved exactly for
+the legacy ``server_app`` compatibility namespace; the only change is that they
+now live behind a builder so the factory stays a wiring path.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Dict
+
+
+def build_vpc_runtime(*, vpc_file: Path, logging: Any) -> Dict[str, Any]:
+    """Return ``DEFAULT_VPC_CONFIG`` and the VPC load/save helpers."""
+
+    default_vpc_config: Dict[str, Any] = {
+        "provider": "AWS",
+        "region": "ap-northeast-2",
+        "cidr_block": "10.42.0.0/16",
+        "private_subnets": ["10.42.10.0/24", "10.42.20.0/24"],
+        "endpoint": "ltcai-private.local",
+        "vpn_status": "standby",
+        "peering_status": "not_configured",
+        "notes": "로컬 MLX 브릿지를 프라이빗 서브넷 또는 VPN 뒤에서 운영할 때 쓰는 네트워크 프로필입니다.",
+        "updated_at": None,
+    }
+
+    def load_vpc_config() -> Dict:
+        if not os.path.exists(vpc_file):
+            return default_vpc_config.copy()
+        try:
+            with open(vpc_file, "r", encoding="utf-8") as f:
+                stored = json.load(f)
+            return {**default_vpc_config, **stored}
+        except Exception as e:
+            logging.warning("load_vpc_config failed (using defaults): %s", e)
+            return default_vpc_config.copy()
+
+    def save_vpc_config(config: Dict) -> None:
+        config["updated_at"] = datetime.now().isoformat()
+        with open(vpc_file, "w", encoding="utf-8") as f:
+            json.dump(config, f, ensure_ascii=False, indent=2)
+
+    return {
+        "DEFAULT_VPC_CONFIG": default_vpc_config,
+        "load_vpc_config": load_vpc_config,
+        "save_vpc_config": save_vpc_config,
+    }
+
+
+__all__ = ["build_vpc_runtime"]

package/latticeai/runtime/platform_runtime_wiring.py

@@ -24,13 +24,13 @@ def build_platform_automation_runtime(
     agent_registry: Any,
     data_dir: Any,
     append_audit_event: Callable[..., Any],
+    memory_service: Any = None,
     tz_name: Optional[str] = None,
 ) -> Dict[str, Any]:
     """Build platform services, automation services, and hook bindings.
 
-    The returned names intentionally match the historical local variables in
-    ``app_factory._build`` so ``dict(locals())`` continues to expose the legacy
-    ``server_app`` compatibility surface.
+    The returned names intentionally match the explicit composition-root
+    bindings consumed by the typed application stages.
     """
     from latticeai.runtime.automation_runtime import build_automation_runtime
     from latticeai.services.platform_runtime import PlatformRuntime
@@ -65,6 +65,7 @@ def build_platform_automation_runtime(
         llm_generate=_llm_generate_sync,
         llm_available=lambda: bool(getattr(model_router, "current_model_id", None)),
         agent_registry=agent_registry,
+        memory_recall=memory_service.recall if memory_service is not None else None,
     )
 
     automation_runtime = build_automation_runtime(

package/latticeai/runtime/review_wiring.py

@@ -27,7 +27,7 @@ def build_review_run_now_runner(platform: Any, http_exception: type[Exception])
             workflow_id,
             user_email,
             scope,
-            with_agent=False,
+            with_agent=True,
             inputs={"__review_item__": item.get("id")},
         )
 

package/latticeai/runtime/router_registration.py

@@ -8,17 +8,33 @@ exact include order while creating a narrow seam for the later
 
 from __future__ import annotations
 
+from dataclasses import dataclass
 from typing import Any
 
 from latticeai.services.router_context import InteractionRouterContext
 
 
+@dataclass(frozen=True)
+class RouterBundle:
+    """Final typed router stage after all domain routers are registered."""
+
+    app: Any
+    context: Any
+    route_count: int
+
+
+def build_router_bundle(app: Any, context: Any) -> RouterBundle:
+    return RouterBundle(app=app, context=context, route_count=len(getattr(app, "routes", ())))
+
+
 def build_static_routes_bundle(
     *,
     create_static_routes_router: Any,
     static_dir: Any,
     invite_gate_enabled: bool,
     invite_code: str,
+    invite_cookie_secret: str,
+    secure_cookies: bool,
     app_mode: str,
     model_router: Any,
     require_user: Any,
@@ -29,6 +45,8 @@ def build_static_routes_bundle(
         static_dir=static_dir,
         invite_gate_enabled=invite_gate_enabled,
         invite_code=invite_code,
+        invite_cookie_secret=invite_cookie_secret,
+        secure_cookies=secure_cookies,
         app_mode=app_mode,
         model_router=model_router,
         require_user=require_user,
@@ -37,6 +55,7 @@ def build_static_routes_bundle(
         "STATIC_ROUTES": static_routes,
         "ui_file_response": static_routes.ui_file_response,
         "local_sysinfo": static_routes.local_sysinfo,
+        "invite_authorized": static_routes.invite_authorized,
     }
 
 
@@ -61,6 +80,8 @@ def build_auth_admin_security_router_bundle(
     open_registration: bool,
     session_ttl: int,
     require_auth: bool,
+    secure_cookies: bool,
+    invite_authorized: Any,
     ensure_identity: Any,
     create_admin_router: Any,
     require_admin: Any,
@@ -113,6 +134,9 @@ def build_auth_admin_security_router_bundle(
         open_registration=open_registration,
         session_ttl=session_ttl,
         require_auth=require_auth,
+        secure_cookies=secure_cookies,
+        invite_gate_enabled=invite_gate_enabled,
+        invite_authorized=invite_authorized,
         ensure_identity=ensure_identity,
     )
 
@@ -290,8 +314,9 @@ def register_platform_feature_routers(
             require_user=require_user,
             require_admin=require_admin,
             append_audit_event=append_audit_event,
+            gate_write=platform.gate_write,
             register_skill=platform.register_plugin_skill,
-            plugin_runners_factory=lambda: platform.plugin_capability_runners(None, None),
+            plugin_runners_factory=platform.plugin_capability_runners,
             ui_file_response=ui_file_response,
             static_dir=static_dir,
         ),
@@ -356,6 +381,7 @@ def register_health_and_model_routers(
     create_models_router: Any,
     model_router: Any,
     require_user: Any,
+    require_admin: Any,
     load_users: Any,
     get_user_role: Any,
     install_engine: Any,
@@ -391,6 +417,7 @@ def register_health_and_model_routers(
         create_models_router(
             model_router=model_router,
             require_user=require_user,
+            require_admin=require_admin,
             get_current_user=get_current_user,
             load_users=load_users,
             get_user_role=get_user_role,
@@ -469,6 +496,7 @@ def register_interaction_routers(
         require_user = interaction_context.require_user
         embedding_info = interaction_context.embedding_info
         tool_context = interaction_context.tool_context
+        require_admin = tool_context.require_admin
         get_current_user = tool_context.get_current_user
         append_audit_event = tool_context.append_audit_event
         hooks = interaction_context.hooks
@@ -515,11 +543,13 @@ def register_interaction_routers(
         create_hooks_router(
             registry=hooks,
             require_user=require_user,
+            require_admin=require_admin,
             append_audit_event=append_audit_event,
         ),
         create_agent_registry_router(
             registry=agent_registry,
             require_user=require_user,
+            require_admin=require_admin,
             append_audit_event=append_audit_event,
         ),
         create_memory_router(
@@ -546,6 +576,7 @@ def register_review_and_brain_tail_routers(
     append_audit_event: Any,
     create_browser_router: Any,
     ingestion_pipeline: Any,
+    workspace_service: Any,
     create_portability_router: Any,
     kg_portability: Any,
     require_admin: Any,
@@ -573,6 +604,7 @@ def register_review_and_brain_tail_routers(
         create_browser_router(
             pipeline=ingestion_pipeline,
             require_user=require_user,
+            workspace_service=workspace_service,
         ),
         create_portability_router(
             service=kg_portability,
@@ -591,6 +623,7 @@ def register_review_and_brain_tail_routers(
             network=brain_network,
             identity=device_identity,
             require_user=require_user,
+            require_admin=require_admin,
         ),
         create_garden_router(gardener=gardener, require_user=require_user),
         create_setup_router(model_router=model_router, require_user=require_user),

package/latticeai/runtime/security_runtime.py

@@ -2,26 +2,123 @@
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Any, Dict
+import json
+import logging
+import secrets
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING, Dict
+
+from latticeai.runtime.stages import RuntimeStage
 
 if TYPE_CHECKING:
     from latticeai.core.config import Config
 
 
-def build_security_runtime(config: "Config") -> Dict[str, Any]:
+_SECURITY_SECRETS_FILE = "security_secrets.json"
+
+
+@dataclass(frozen=True)
+class SecurityRuntime(RuntimeStage):
+    SSO_DISCOVERY_URL: str
+    SSO_CLIENT_ID: str
+    SSO_CLIENT_SECRET: str
+    SSO_REDIRECT_URI: str
+    SSO_PROVIDER_NAME: str
+    RATE_LIMIT_ENABLED: bool
+    OPEN_REGISTRATION: bool
+    INVITE_CODE: str
+    INVITE_COOKIE_SECRET: str
+    INVITE_GATE_ENABLED: bool
+    SECURE_COOKIES: bool
+
+
+def _stored_security_secrets(data_dir: Path) -> Dict[str, str]:
+    path = data_dir / _SECURITY_SECRETS_FILE
+    if not path.exists():
+        return {}
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except Exception as exc:
+        # A corrupt secret store invalidates old invite cookies, but must never
+        # make startup fall back to a shared or predictable signing key.
+        logging.warning("invite-gate secret store is unreadable; rotating secrets: %s", exc)
+        return {}
+    if not isinstance(payload, dict):
+        return {}
+    return {
+        key: str(value)
+        for key, value in payload.items()
+        if key in {"invite_code", "invite_cookie_secret"} and value
+    }
+
+
+def _resolve_invite_gate_secrets(config: "Config") -> tuple[str, str]:
+    """Resolve stable, per-install invitation secrets.
+
+    No file is created while the invitation gate is disabled.  Once enabled,
+    missing values are generated with the OS CSPRNG and persisted atomically
+    with mode 0600 so restarts do not invalidate links or signed cookies.
+    Explicit environment values remain authoritative and are not copied to the
+    local secret file unnecessarily.
+    """
+
+    if not config.invite_gate_enabled:
+        return config.invite_code, config.invite_cookie_secret
+
+    from latticeai.core.io_utils import atomic_write_json
+
+    data_dir = Path(config.data_dir)
+    stored = _stored_security_secrets(data_dir)
+    invite_code = config.invite_code or stored.get("invite_code") or secrets.token_urlsafe(24)
+    cookie_secret = (
+        config.invite_cookie_secret
+        or stored.get("invite_cookie_secret")
+        or secrets.token_urlsafe(48)
+    )
+
+    persisted = dict(stored)
+    if not config.invite_code:
+        persisted["invite_code"] = invite_code
+    if not config.invite_cookie_secret:
+        persisted["invite_cookie_secret"] = cookie_secret
+    if persisted != stored:
+        atomic_write_json(data_dir / _SECURITY_SECRETS_FILE, persisted)
+    return invite_code, cookie_secret
+
+
+def build_security_runtime(config: "Config") -> SecurityRuntime:
     """Build auth/security-derived runtime settings from the central config."""
 
     from latticeai.core.security import configure_trusted_proxies
 
     configure_trusted_proxies(config.trusted_proxies)
-    return {
-        "SSO_DISCOVERY_URL": config.sso_discovery_url,
-        "SSO_CLIENT_ID": config.sso_client_id,
-        "SSO_CLIENT_SECRET": config.sso_client_secret,
-        "SSO_REDIRECT_URI": config.sso_redirect_uri,
-        "SSO_PROVIDER_NAME": config.sso_provider_name,
-        "RATE_LIMIT_ENABLED": config.rate_limit_enabled,
-        "OPEN_REGISTRATION": config.open_registration,
-        "INVITE_CODE": config.invite_code,
-        "INVITE_GATE_ENABLED": config.invite_gate_enabled,
-    }
+    invite_code, invite_cookie_secret = _resolve_invite_gate_secrets(config)
+    secure_cookies = bool(config.is_public or config.network_exposed)
+    if secure_cookies:
+        logging.warning(
+            "Public/non-loopback mode: authentication and Secure cookies are forced; "
+            "serve Lattice AI through HTTPS/TLS or browser sessions will be rejected."
+        )
+    if config.invite_gate_enabled and not config.invite_code:
+        logging.warning(
+            "No LATTICEAI_INVITE_CODE was configured; generated a private per-install "
+            "invite code in %s.",
+            Path(config.data_dir) / _SECURITY_SECRETS_FILE,
+        )
+    return SecurityRuntime(
+        SSO_DISCOVERY_URL=config.sso_discovery_url,
+        SSO_CLIENT_ID=config.sso_client_id,
+        SSO_CLIENT_SECRET=config.sso_client_secret,
+        SSO_REDIRECT_URI=config.sso_redirect_uri,
+        SSO_PROVIDER_NAME=config.sso_provider_name,
+        RATE_LIMIT_ENABLED=config.rate_limit_enabled,
+        OPEN_REGISTRATION=config.open_registration,
+        INVITE_CODE=invite_code,
+        INVITE_COOKIE_SECRET=invite_cookie_secret,
+        INVITE_GATE_ENABLED=config.invite_gate_enabled,
+        SECURE_COOKIES=secure_cookies,
+    )
+
+
+__all__ = ["SecurityRuntime", "build_security_runtime"]

package/latticeai/runtime/sso_config_runtime.py

@@ -0,0 +1,128 @@
+"""SSO / OIDC config + discovery seam extracted from the app factory.
+
+Owns the whole SSO surface that used to be inline in ``app_factory._build``:
+the env-default resolution, the ``sso_config.json`` load/save, the public
+(secret-stripped) view, and the OIDC discovery document cache.
+
+Unlike the previous split (config inline in the factory + a separate discovery
+cache in ``sso_runtime``), the discovery cache now lives in the *same* closure
+as ``save_sso_config``, so saving a new SSO config actually invalidates the
+cached discovery document. The old inline ``save_sso_config`` reassigned a
+factory-local cache variable that ``_get_sso_discovery`` never read, so the
+invalidation was a silent no-op — this consolidation fixes that.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+
+def build_sso_config_runtime(
+    *,
+    sso_file: Path,
+    discovery_url: str,
+    client_id: str,
+    client_secret: str,
+    redirect_uri: str,
+    provider_name: str,
+    logging: Any,
+) -> Dict[str, Any]:
+    """Return the SSO config helpers + discovery accessor as a name → value dict."""
+
+    # Single shared discovery cache: save_sso_config and _get_sso_discovery both
+    # close over it, so a config change is observed on the next discovery fetch.
+    _discovery_cache: Dict[str, Any] = {"data": None, "url": ""}
+    _sso_states: Dict[str, float] = {}
+
+    def _sso_env_defaults() -> Dict[str, object]:
+        return {
+            "enabled": bool(discovery_url and client_id and client_secret),
+            "provider_name": provider_name,
+            "discovery_url": discovery_url,
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "redirect_uri": redirect_uri,
+            "scopes": "openid email profile",
+        }
+
+    def load_sso_config() -> Dict[str, object]:
+        config = _sso_env_defaults()
+        if sso_file.exists():
+            try:
+                data = json.loads(sso_file.read_text(encoding="utf-8"))
+                if isinstance(data, dict):
+                    config.update({k: v for k, v in data.items() if v is not None})
+            except Exception as e:
+                logging.warning("load_sso_config failed (using env/defaults): %s", e)
+        config["provider_name"] = str(config.get("provider_name") or "SSO")
+        config["discovery_url"] = str(config.get("discovery_url") or "")
+        config["client_id"] = str(config.get("client_id") or "")
+        config["client_secret"] = str(config.get("client_secret") or "")
+        config["redirect_uri"] = str(config.get("redirect_uri") or redirect_uri)
+        config["scopes"] = str(config.get("scopes") or "openid email profile")
+        config["enabled"] = bool(config.get("enabled")) and bool(
+            config["discovery_url"] and config["client_id"] and config["client_secret"]
+        )
+        return config
+
+    def get_sso_settings() -> Dict[str, object]:
+        return load_sso_config()
+
+    def public_sso_config(config: Optional[Dict[str, object]] = None) -> Dict[str, object]:
+        cfg = config or get_sso_settings()
+        return {
+            "enabled": bool(cfg.get("enabled")),
+            "provider_name": cfg.get("provider_name") or "",
+            "discovery_url": cfg.get("discovery_url") or "",
+            "client_id": cfg.get("client_id") or "",
+            "redirect_uri": cfg.get("redirect_uri") or redirect_uri,
+            "scopes": cfg.get("scopes") or "openid email profile",
+            "secret_configured": bool(cfg.get("client_secret")),
+        }
+
+    def save_sso_config(update: Dict[str, object]) -> Dict[str, object]:
+        current = load_sso_config()
+        if update.get("client_secret") == "":
+            update.pop("client_secret", None)
+        current.update({k: v for k, v in update.items() if v is not None})
+        current["enabled"] = bool(current.get("enabled")) and bool(
+            current.get("discovery_url") and current.get("client_id") and current.get("client_secret")
+        )
+        sso_file.write_text(json.dumps(current, ensure_ascii=False, indent=2), encoding="utf-8")
+        _discovery_cache["data"] = None
+        _discovery_cache["url"] = ""
+        return current
+
+    async def _get_sso_discovery() -> Optional[Dict]:
+        settings = get_sso_settings()
+        url = settings.get("discovery_url", "")
+        if _discovery_cache["data"] and _discovery_cache["url"] == url:
+            return _discovery_cache["data"]
+        if not url:
+            return None
+        try:
+            import httpx as _httpx
+            async with _httpx.AsyncClient() as c:
+                r = await c.get(url, timeout=10)
+                r.raise_for_status()
+                _discovery_cache["data"] = r.json()
+                _discovery_cache["url"] = url
+        except Exception as e:
+            logging.warning("SSO discovery failed: %s", e)
+            return None
+        return _discovery_cache["data"]
+
+    return {
+        "_sso_env_defaults": _sso_env_defaults,
+        "load_sso_config": load_sso_config,
+        "get_sso_settings": get_sso_settings,
+        "public_sso_config": public_sso_config,
+        "save_sso_config": save_sso_config,
+        "_get_sso_discovery": _get_sso_discovery,
+        "_sso_states": _sso_states,
+    }
+
+
+__all__ = ["build_sso_config_runtime"]

package/latticeai/runtime/stages.py

@@ -0,0 +1,27 @@
+"""Typed mapping base for application assembly stages."""
+
+from __future__ import annotations
+
+from dataclasses import fields
+from typing import Any, Iterator, Mapping
+
+
+class RuntimeStage(Mapping[str, Any]):
+    """Dataclass mixin that preserves the legacy mapping access during DI migration."""
+
+    def __getitem__(self, key: str) -> Any:
+        if key not in self:
+            raise KeyError(key)
+        return getattr(self, key)
+
+    def __iter__(self) -> Iterator[str]:
+        return (field.name for field in fields(self))
+
+    def __len__(self) -> int:
+        return len(fields(self))
+
+    def __contains__(self, key: object) -> bool:
+        return isinstance(key, str) and any(field.name == key for field in fields(self))
+
+
+__all__ = ["RuntimeStage"]

package/latticeai/runtime/user_key_runtime.py

@@ -0,0 +1,106 @@
+"""User profile + provider API-key helpers extracted from the app factory.
+
+The helpers close over the user store, keyring adapter, identity migration, and
+plaintext-key policy. Returning callables preserves the legacy ``server_app``
+namespace while keeping ``app_factory._build`` focused on wiring.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+
+def build_user_key_runtime(
+    *,
+    load_users: Any,
+    save_users: Any,
+    ensure_user_identity: Any,
+    keyring: Any,
+    allow_plaintext_api_keys: bool,
+    logging: Any,
+    http_exception: Any,
+) -> Dict[str, Any]:
+    """Return history-user and provider API-key helpers."""
+
+    def get_history_user(email: Optional[str], nickname: Optional[str] = None) -> Dict:
+        if not email:
+            return {"user_email": None, "user_nickname": nickname or None}
+        users = load_users()
+        user = users.get(email, {})
+        return {
+            "user_email": email,
+            "user_nickname": nickname or user.get("nickname") or user.get("name") or email,
+        }
+
+    def get_user_api_key(email: Optional[str], provider: str) -> Optional[str]:
+        if not email:
+            return None
+        keyring_key = f"{email}:{provider}"
+        if keyring is not None:
+            try:
+                key = keyring.get_password("LatticeAI", keyring_key)
+                if key:
+                    return key.strip()
+            except Exception as exc:
+                logging.warning("keyring read failed for %s: %s", provider, exc)
+        users = load_users()
+        user = users.get(email) or {}
+        api_keys = user.get("api_keys") or {}
+        key = api_keys.get(provider)
+        if isinstance(key, str) and key.strip() and allow_plaintext_api_keys:
+            return key.strip()
+        return None
+
+    def set_user_api_key(email: str, provider: str, key: str) -> None:
+        keyring_key = f"{email}:{provider}"
+        if keyring is not None:
+            try:
+                keyring.set_password("LatticeAI", keyring_key, key)
+                users = load_users()
+                user = users.get(email)
+                if user and "api_keys" in user:
+                    user["api_keys"].pop(provider, None)
+                    if not user["api_keys"]:
+                        user.pop("api_keys", None)
+                    save_users(users)
+                return
+            except Exception as exc:
+                logging.warning("keyring write failed for %s: %s", provider, exc)
+                if not allow_plaintext_api_keys:
+                    raise http_exception(
+                        status_code=500,
+                        detail="OS keyring에 API 키를 저장하지 못했습니다. keyring 설정을 확인하거나 LATTICEAI_ALLOW_PLAINTEXT_API_KEYS=true를 명시적으로 설정하세요.",
+                    )
+
+        if not allow_plaintext_api_keys:
+            raise http_exception(
+                status_code=500,
+                detail="keyring 패키지를 사용할 수 없어 API 키를 안전하게 저장할 수 없습니다.",
+            )
+
+        users = load_users()
+        user = users.get(email)
+        if not user:
+            user = {
+                "password_hash": "",
+                "salt": "",
+                "name": email,
+                "nickname": email,
+                "role": "user",
+                "disabled": False,
+            }
+        ensure_user_identity(email, user)
+        api_keys = user.get("api_keys") or {}
+        api_keys[provider] = key
+        user["api_keys"] = api_keys
+        users[email] = user
+        save_users(users)
+
+    return {
+        "get_history_user": get_history_user,
+        "get_user_api_key": get_user_api_key,
+        "set_user_api_key": set_user_api_key,
+    }
+
+
+__all__ = ["build_user_key_runtime"]

package/latticeai/server_app.py

@@ -13,6 +13,8 @@ from __future__ import annotations
 
 from typing import Any, List
 
+from latticeai.runtime.namespace_runtime import SERVER_APP_EXPORTS
+
 
 def _runtime():
     from latticeai.app_factory import get_shared_runtime
@@ -25,6 +27,8 @@ def __getattr__(name: str) -> Any:
         # Never let dunder probes (importlib, inspect, pickling) trigger the
         # full application construction.
         raise AttributeError(name)
+    if name not in SERVER_APP_EXPORTS:
+        raise AttributeError(f"module 'latticeai.server_app' has no attribute '{name}'")
     try:
         return getattr(_runtime(), name)
     except AttributeError as exc:
@@ -34,7 +38,7 @@ def __getattr__(name: str) -> Any:
 
 
 def __dir__() -> List[str]:
-    return sorted(set(globals()) | set(vars(_runtime())))
+    return sorted(set(globals()) | set(SERVER_APP_EXPORTS))
 
 
 def main() -> None: