superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/server/routes/profiles.py

@@ -28,11 +28,18 @@ from .helpers import (
 from superlocalmemory.server.profile_runtime import (
     commit_daemon_profile_switch,
     get_profile_runtime,
+    TransitionDrainTimeout,
 )
 
 logger = logging.getLogger("superlocalmemory.routes.profiles")
 router = APIRouter()
 
+
+def _internal_error(detail: str = "Internal server error") -> HTTPException:
+    """SEC-H-02: log full traceback server-side; return a generic message to the client."""
+    logger.exception("profiles route error")
+    return HTTPException(status_code=500, detail=detail)
+
 # WebSocket manager reference (set by ui_server.py at startup)
 ws_manager = None
 
@@ -85,8 +92,8 @@ async def list_profiles(request: Request):
             "total_profiles": len(profiles),
         }
 
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Profile list error: {str(e)}")
+    except Exception:
+        raise _internal_error("Profile list error")
 
 
 @router.post("/api/profiles/{name}/switch")
@@ -112,17 +119,36 @@ async def switch_profile(name: str, request: Request):
             source_agent_id="http-profile-switch",
             profile_id=name,
         )
+        # RBAC (C4): a logged-in user may only activate a workspace they belong
+        # to — this is the read boundary. Switching sets the active tenant for
+        # subsequent reads, so a non-member must not be able to enter it. The
+        # machine owner (no user session) switches freely.
+        from superlocalmemory.server.rbac_enforce import resolve_principal
+        _principal = resolve_principal(request)
+        if _principal.get("kind") == "user":
+            _rbac = getattr(request.app.state, "rbac", None)
+            if _rbac is not None and _rbac.get_role(_principal["user_id"], name) is None:
+                raise HTTPException(
+                    status_code=403,
+                    detail="You are not a member of this workspace.",
+                )
         runtime = get_profile_runtime(request.app.state)
         previous = runtime.snapshot.profile_id
-        snapshot = await asyncio.to_thread(
-            runtime.transition,
-            name,
-            lambda prior, target: commit_daemon_profile_switch(
-                request.app.state,
-                prior,
-                target,
-            ),
-        )
+        try:
+            snapshot = await asyncio.to_thread(
+                runtime.transition,
+                name,
+                lambda prior, target: commit_daemon_profile_switch(
+                    request.app.state,
+                    prior,
+                    target,
+                ),
+            )
+        except TransitionDrainTimeout as exc:
+            raise HTTPException(
+                status_code=503,
+                detail=str(exc),
+            )
 
         count = _get_memory_count(name)
 
@@ -143,8 +169,8 @@ async def switch_profile(name: str, request: Request):
 
     except HTTPException:
         raise
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Profile switch error: {str(e)}")
+    except Exception:
+        raise _internal_error("Profile switch error")
 
 
 @router.post("/api/profiles/create")
@@ -166,18 +192,34 @@ async def create_profile(body: ProfileSwitch, request: Request):
             operation="update",
             source_agent_id="http-profile-create",
         )
+        # RBAC (C3): creating a tenant is an administrative action.
+        from superlocalmemory.access.rbac import Permission as _Perm
+        from superlocalmemory.server.rbac_enforce import require_manage as _rbac_manage
+        _principal = _rbac_manage(request)
         # Write to BOTH stores atomically
         desc = f'Memory profile: {name}'
         ensure_profile_in_db(name, desc)
         ensure_profile_in_json(name, desc)
 
+        # A logged-in user who creates a workspace becomes its admin so they
+        # can manage it immediately (profile_id == name here). The machine
+        # owner needs no membership row (implicit root).
+        if _principal.get("kind") == "user":
+            rbac = getattr(request.app.state, "rbac", None)
+            if rbac is not None:
+                try:
+                    rbac.set_membership(name, _principal["user_id"], "admin",
+                                        added_by=_principal["username"])
+                except Exception:
+                    pass
+
         authorization.complete()
         return {"success": True, "profile": name, "message": f"Profile '{name}' created"}
 
     except HTTPException:
         raise
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Profile create error: {str(e)}")
+    except Exception:
+        raise _internal_error("Profile create error")
 
 
 @router.delete("/api/profiles/{name}")
@@ -204,6 +246,10 @@ async def delete_profile(name: str, request: Request):
             source_agent_id="http-profile-delete",
             profile_id=name,
         )
+        # RBAC (C3): deleting a tenant is administrative. Check MANAGE on the
+        # profile being deleted (not the active one).
+        from superlocalmemory.server.rbac_enforce import require_manage as _rbac_manage
+        _rbac_manage(request, profile=name)
         # Move data to default before deleting (bypasses CASCADE)
         conn = get_db_connection()
         cursor = conn.cursor()
@@ -243,5 +289,5 @@ async def delete_profile(name: str, request: Request):
 
     except HTTPException:
         raise
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Profile delete error: {str(e)}")
+    except Exception:
+        raise _internal_error("Profile delete error")

package/src/superlocalmemory/server/routes/ratelimit.py

@@ -0,0 +1,124 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later — see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com
+
+"""Dashboard-editable rate limits (task #47).
+
+The soak found the loopback write limiter (correctly) returning 429 under
+heavy multi-system load. This exposes the write/read/window ceilings so an
+operator can raise them from the Governance panel:
+
+  GET /api/v3/ratelimit  — current effective limits (+ derived loopback)
+  PUT /api/v3/ratelimit  — set write/read/window; applied at runtime (no
+                           restart) and persisted to config.json
+
+Runtime apply goes through rate_limiter.set_limits(), which reconfigures every
+registered enforcement limiter live. Persistence reuses config_api's config.json
+helpers; load_persisted_limits() re-applies the saved override at daemon start.
+Admin-only (RBAC MANAGE), matching config_api.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, ConfigDict, Field
+
+from superlocalmemory.infra.rate_limiter import (
+    _loopback_read,
+    _loopback_write,
+    get_limits,
+    set_limits,
+)
+from superlocalmemory.server.routes.config_api import (
+    _atomic_write,
+    _read_config,
+    _require_admin,
+)
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/v3", tags=["ratelimit"])
+
+_CONFIG_KEY = "rate_limit"
+_MIN, _MAX_REQ, _MAX_WINDOW = 1, 100_000, 3600
+
+
+class RateLimitUpdate(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    write: int | None = Field(default=None, ge=_MIN, le=_MAX_REQ)
+    read: int | None = Field(default=None, ge=_MIN, le=_MAX_REQ)
+    window: int | None = Field(default=None, ge=_MIN, le=_MAX_WINDOW)
+
+
+def _effective() -> dict:
+    cur = get_limits()
+    return {
+        "write": cur["write"],
+        "read": cur["read"],
+        "window": cur["window"],
+        "loopback_write": _loopback_write(cur["write"]),
+        "loopback_read": _loopback_read(cur["read"]),
+    }
+
+
+def load_persisted_limits() -> None:
+    """Re-apply the persisted rate-limit override at daemon start (fail-open)."""
+    try:
+        saved = (_read_config().get(_CONFIG_KEY) or {})
+        if not isinstance(saved, dict):
+            return
+        w = saved.get("write")
+        r = saved.get("read")
+        win = saved.get("window")
+        if w is None and r is None and win is None:
+            return
+        set_limits(write=w, read=r, window=win)
+        logger.info("Rate limits restored from config.json: %s", get_limits())
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.debug("load_persisted_limits skipped: %s", exc)
+
+
+@router.get("/ratelimit")
+def get_ratelimit() -> JSONResponse:
+    return JSONResponse(_effective())
+
+
+@router.put("/ratelimit")
+async def put_ratelimit(request: Request) -> JSONResponse:
+    _require_admin(request)
+    try:
+        raw = await request.json()
+    except Exception:
+        raw = {}
+    try:
+        payload = RateLimitUpdate(**(raw or {}))
+    except Exception as exc:
+        return JSONResponse(status_code=422, content={"error": str(exc)})
+
+    if payload.write is None and payload.read is None and payload.window is None:
+        return JSONResponse(
+            status_code=422,
+            content={"error": "Provide at least one of write, read, window."},
+        )
+
+    # Runtime apply (reconfigures every live limiter — no restart).
+    effective = set_limits(
+        write=payload.write, read=payload.read, window=payload.window,
+    )
+
+    # Persist so the override survives restart.
+    try:
+        cfg = _read_config()
+        cfg[_CONFIG_KEY] = {
+            "write": effective["write"],
+            "read": effective["read"],
+            "window": effective["window"],
+        }
+        _atomic_write(cfg)
+    except Exception as exc:
+        logger.warning("rate-limit persist failed (applied at runtime): %s", exc)
+
+    return JSONResponse({"success": True, **_effective()})

package/src/superlocalmemory/server/routes/rbac.py

@@ -0,0 +1,367 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — RBAC / teams (C3)
+
+"""Dashboard-facing RBAC API: login/logout/whoami + user & role administration.
+
+Mounted at /api/rbac/*. Every route first proves machine auth (the dashboard
+holds the install token / the operator is on loopback) via
+require_http_mutation_actor, then applies RBAC where relevant:
+
+  * login/logout/whoami/status — machine auth only (identity bootstrap).
+  * user + membership + policy admin — MANAGE permission (owner or an admin).
+
+Creating the first user works out of the box: with zero users the caller is the
+implicit owner, who has MANAGE.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import threading
+import time
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException, Request, Response
+from pydantic import BaseModel
+
+from superlocalmemory.access.rbac import RbacError
+from superlocalmemory.server.rbac_enforce import (
+    get_rbac_engine, principal_info, require_manage, resolve_principal,
+)
+
+logger = logging.getLogger("superlocalmemory.routes.rbac")
+router = APIRouter(prefix="/api/rbac", tags=["rbac"])
+
+_SESSION_COOKIE = "slm_session"
+
+# Login throttle: lock an account after repeated failures within a window, to
+# blunt password spraying / brute force (scrypt alone allows ~20 tries/s).
+_LOGIN_MAX_FAILS = 5
+_LOGIN_WINDOW_SEC = 300
+# SEC-M-01: cap tracked usernames so a spray of unique usernames (one failed
+# login each) cannot grow this dict without bound (memory-exhaustion DoS).
+_LOGIN_MAX_TRACKED = 10_000
+_login_fails: dict[str, list] = {}
+_login_lock = threading.Lock()
+
+
+def _login_blocked(username: str) -> bool:
+    now = time.time()
+    with _login_lock:
+        fails = [t for t in _login_fails.get(username, []) if now - t < _LOGIN_WINDOW_SEC]
+        # SEC-M-01: evict entries that decayed to empty instead of parking a
+        # zero-length list forever (only successful logins used to pop them).
+        if fails:
+            _login_fails[username] = fails
+        else:
+            _login_fails.pop(username, None)
+        # Overflow guard: drop the oldest-inserted key if we exceed the cap.
+        if len(_login_fails) > _LOGIN_MAX_TRACKED:
+            _login_fails.pop(next(iter(_login_fails)), None)
+        return len(fails) >= _LOGIN_MAX_FAILS
+
+
+def _login_note(username: str, ok: bool) -> None:
+    with _login_lock:
+        if ok:
+            _login_fails.pop(username, None)
+        else:
+            _login_fails.setdefault(username, []).append(time.time())
+
+
+def _is_browser(request: Request) -> bool:
+    h = request.headers
+    return bool(h.get("referer") or h.get("origin") or h.get("cookie")
+                or h.get("sec-fetch-mode"))
+
+
+def _cookie_secure(request: Request) -> bool:
+    return (request.headers.get("x-forwarded-proto", "").lower() == "https"
+            or os.environ.get("SLM_DASHBOARD_HTTPS") == "1")
+
+
+# -- models --
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class CreateUserRequest(BaseModel):
+    username: str
+    password: str
+    display_name: str = ""
+    role: Optional[str] = None      # optional membership on the active profile
+    profile_id: Optional[str] = None
+
+
+class UpdateUserRequest(BaseModel):
+    display_name: Optional[str] = None
+    password: Optional[str] = None
+    status: Optional[str] = None
+
+
+class MemberRequest(BaseModel):
+    user_id: str
+    role: str
+    profile_id: Optional[str] = None
+
+
+class RemoveMemberRequest(BaseModel):
+    user_id: str
+    profile_id: Optional[str] = None
+
+
+class PolicyRequest(BaseModel):
+    require_login: bool
+
+
+# -- helpers --
+
+def _machine_guard(request: Request) -> None:
+    """Prove machine auth (operator / dashboard) before any RBAC route."""
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+
+    broker = getattr(request.app.state, "mesh_broker", None)
+    require_http_mutation_actor(
+        request,
+        getattr(request.app.state, "daemon_descriptor", None),
+        actor_kind="rbac-route",
+        mesh_secret=getattr(broker, "_shared_secret", None) if broker else None,
+    )
+
+
+def _engine(request: Request):
+    rbac = get_rbac_engine(request.app.state)
+    if rbac is None:
+        raise HTTPException(503, detail="RBAC subsystem not initialized")
+    return rbac
+
+
+def _active_profile() -> str:
+    from superlocalmemory.server.routes.helpers import get_active_profile
+
+    return get_active_profile()
+
+
+def _session_token(request: Request) -> str:
+    return (request.headers.get("X-SLM-User-Session", "")
+            or (request.cookies.get(_SESSION_COOKIE, "") or ""))
+
+
+def _require_authority_over_user(request: Request, target_user_id: str) -> None:
+    """Reject modifying a user the caller has no authority over (IDOR guard).
+
+    The machine owner is root. A logged-in admin may only act on a user who
+    shares at least one workspace on which the admin holds MANAGE.
+    """
+    from superlocalmemory.access.rbac import Permission
+    from superlocalmemory.server.rbac_enforce import resolve_principal
+
+    principal = resolve_principal(request)
+    if principal["kind"] == "owner":
+        return
+    rbac = _engine(request)
+    target_profiles = rbac.list_user_profiles(target_user_id)
+    if any(rbac.has_permission(principal["user_id"], p["profile_id"], Permission.MANAGE)
+           for p in target_profiles):
+        return
+    raise HTTPException(403, detail="You have no authority over this user.")
+
+
+# -- identity --
+
+@router.post("/login")
+async def login(req: LoginRequest, request: Request, response: Response):
+    _machine_guard(request)
+    uname = (req.username or "").strip()
+    if _login_blocked(uname):
+        raise HTTPException(429, detail="Too many attempts. Try again later.")
+    rbac = _engine(request)
+    user = rbac.verify_credentials(req.username, req.password)
+    if not user:
+        _login_note(uname, ok=False)
+        raise HTTPException(401, detail="Invalid username or password")
+    _login_note(uname, ok=True)
+    token = rbac.create_session(user["user_id"])
+    # HttpOnly cookie so dashboard JS never has to hold the session token;
+    # Secure when served over HTTPS (behind a TLS proxy).
+    response.set_cookie(
+        _SESSION_COOKIE, token, httponly=True, samesite="strict", path="/",
+        secure=_cookie_secure(request),
+    )
+    # Only echo the raw token to non-browser (CLI) clients that cannot use the
+    # cookie — browsers rely on the HttpOnly cookie and must not see it in the
+    # response body (proxy logs / devtools capture).
+    body = {"ok": True, "user": user}
+    if not _is_browser(request):
+        body["token"] = token
+    return body
+
+
+@router.post("/logout")
+async def logout(request: Request, response: Response):
+    _machine_guard(request)
+    rbac = _engine(request)
+    token = _session_token(request)
+    if token:
+        rbac.revoke_session(token)
+    response.delete_cookie(_SESSION_COOKIE, path="/")
+    return {"ok": True}
+
+
+@router.get("/whoami")
+async def whoami(request: Request):
+    _machine_guard(request)
+    return principal_info(request)
+
+
+@router.get("/status")
+async def status(request: Request):
+    _machine_guard(request)
+    rbac = _engine(request)
+    return {
+        "rbac_active": rbac.user_count() > 0,
+        "require_login": rbac.require_login(),
+        "user_count": rbac.user_count(),
+    }
+
+
+# -- user administration (MANAGE) --
+
+@router.get("/users")
+async def list_users(request: Request):
+    _machine_guard(request)
+    principal = require_manage(request)
+    rbac = _engine(request)
+    all_users = rbac.list_users()
+    if principal.get("kind") == "owner":
+        return {"users": all_users}
+    # A workspace admin only sees users who share a workspace they MANAGE
+    # (usernames/display names are PII — don't leak other tenants' rosters).
+    from superlocalmemory.access.rbac import Permission
+    mgr = {p["profile_id"] for p in rbac.list_user_profiles(principal["user_id"])
+           if rbac.has_permission(principal["user_id"], p["profile_id"], Permission.MANAGE)}
+    visible = [
+        u for u in all_users
+        if u["user_id"] == principal["user_id"]
+        or any(m["profile_id"] in mgr for m in rbac.list_user_profiles(u["user_id"]))
+    ]
+    return {"users": visible}
+
+
+@router.post("/users")
+async def create_user(req: CreateUserRequest, request: Request):
+    _machine_guard(request)
+    principal = require_manage(request)
+    rbac = _engine(request)
+    # Granting a role on a workspace requires MANAGE on THAT workspace.
+    if req.role:
+        require_manage(request, profile=req.profile_id or _active_profile())
+    try:
+        user = rbac.create_user(
+            req.username, req.password, display_name=req.display_name,
+            created_by=principal["username"],
+        )
+        if req.role:
+            rbac.set_membership(
+                req.profile_id or _active_profile(), user["user_id"],
+                req.role, added_by=principal["username"],
+            )
+    except RbacError as e:
+        # SEC-H-02 carve-out: RbacError messages are intentional domain
+        # validation messages (e.g. "Username already exists") and are safe
+        # to surface to the admin console. Log for audit trail.
+        logger.warning("rbac create_user rejected: %s", e)
+        raise HTTPException(400, detail=str(e))
+    return {"ok": True, "user": user}
+
+
+@router.patch("/users/{user_id}")
+async def update_user(user_id: str, req: UpdateUserRequest, request: Request):
+    _machine_guard(request)
+    require_manage(request)
+    _require_authority_over_user(request, user_id)
+    rbac = _engine(request)
+    try:
+        if req.display_name is not None or req.status is not None:
+            if req.status is not None:
+                rbac.set_status(user_id, req.status)
+            if req.display_name is not None:
+                # display_name update via direct engine call
+                conn = rbac._conn()
+                try:
+                    conn.execute(
+                        "UPDATE rbac_users SET display_name=? WHERE user_id=?",
+                        (req.display_name, user_id),
+                    )
+                    conn.commit()
+                finally:
+                    conn.close()
+        if req.password is not None:
+            rbac.set_password(user_id, req.password)
+    except RbacError as e:
+        logger.warning("rbac update_user rejected: %s", e)
+        raise HTTPException(400, detail=str(e))
+    return {"ok": True, "user": rbac.get_user(user_id)}
+
+
+@router.delete("/users/{user_id}")
+async def delete_user(user_id: str, request: Request):
+    _machine_guard(request)
+    require_manage(request)
+    _require_authority_over_user(request, user_id)
+    try:
+        _engine(request).delete_user(user_id)
+    except RbacError as e:
+        logger.warning("rbac delete_user not found: %s", e)
+        raise HTTPException(404, detail=str(e))
+    return {"ok": True}
+
+
+# -- membership administration (MANAGE) --
+
+@router.get("/members")
+async def list_members(request: Request, profile_id: Optional[str] = None):
+    _machine_guard(request)
+    prof = profile_id or _active_profile()
+    # MANAGE on the TARGET workspace, not merely the active one — otherwise an
+    # admin of one workspace could enumerate another's members.
+    require_manage(request, profile=prof)
+    return {"profile_id": prof, "members": _engine(request).list_members(prof)}
+
+
+@router.post("/members")
+async def set_member(req: MemberRequest, request: Request):
+    _machine_guard(request)
+    prof = req.profile_id or _active_profile()
+    principal = require_manage(request, profile=prof)
+    rbac = _engine(request)
+    try:
+        m = rbac.set_membership(prof, req.user_id, req.role,
+                                added_by=principal["username"])
+    except RbacError as e:
+        logger.warning("rbac set_membership rejected: %s", e)
+        raise HTTPException(400, detail=str(e))
+    return {"ok": True, "membership": m}
+
+
+@router.delete("/members")
+async def remove_member(req: RemoveMemberRequest, request: Request):
+    _machine_guard(request)
+    prof = req.profile_id or _active_profile()
+    require_manage(request, profile=prof)
+    _engine(request).remove_membership(prof, req.user_id)
+    return {"ok": True}
+
+
+# -- policy (MANAGE) --
+
+@router.post("/policy")
+async def set_policy(req: PolicyRequest, request: Request):
+    _machine_guard(request)
+    require_manage(request)
+    _engine(request).set_require_login(req.require_login)
+    return {"ok": True, "require_login": req.require_login}

package/src/superlocalmemory/server/routes/stats.py

@@ -19,6 +19,12 @@ logger = logging.getLogger("superlocalmemory.routes.stats")
 router = APIRouter()
 
 
+def _internal_error(detail: str = "Internal server error") -> HTTPException:
+    """SEC-H-02: log full traceback server-side; return a generic message to the client."""
+    logger.exception("stats route error")
+    return HTTPException(status_code=500, detail=detail)
+
+
 @router.get("/api/stats")
 async def get_stats():
     """Get comprehensive system statistics."""
@@ -237,8 +243,8 @@ async def get_stats():
             },
         }
 
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Stats error: {str(e)}")
+    except Exception:
+        raise _internal_error("Stats error")
 
 
 @router.get("/api/timeline")
@@ -305,8 +311,8 @@ async def get_timeline(
             "parameters": {"days": days, "group_by": group_by},
         }
 
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Timeline error: {str(e)}")
+    except Exception:
+        raise _internal_error("Timeline error")
 
 
 @router.get("/api/patterns")
@@ -436,5 +442,6 @@ async def get_patterns():
             "pattern_types": list(grouped.keys()), "confidence_stats": confidence_stats,
         }
 
-    except Exception as e:
-        return {"patterns": {}, "total_patterns": 0, "error": str(e)}
+    except Exception:
+        logger.exception("patterns route error")
+        return {"patterns": {}, "total_patterns": 0, "error": "Internal server error"}