a2a-lite 0.2.0__tar.gz → 0.2.1__tar.gz

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: a2a-lite
-Version: 0.2.0
+Version: 0.2.1
 Summary: Simplified wrapper for Google's A2A Protocol SDK
 Author: A2A Lite Contributors
 License-Expression: Apache-2.0

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "a2a-lite"
-version = "0.2.0"
+version = "0.2.1"
 description = "Simplified wrapper for Google's A2A Protocol SDK"
 readme = "README.md"
 license = "Apache-2.0"

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/__init__.py

@@ -102,7 +102,7 @@ from .auth import (
     require_auth,
 )
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 __all__ = [
     # Core

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/agent.py

@@ -332,6 +332,10 @@ class Agent:
             task_store=self._task_store,
         )
 
+        # The SDK's InMemoryTaskStore handles protocol-level task lifecycle
+        # (task creation, state transitions per the A2A spec). This is separate
+        # from self._task_store which provides application-level tracking
+        # (progress updates, custom status) exposed via TaskContext to skills.
         request_handler = DefaultRequestHandler(
             agent_executor=executor,
             task_store=InMemoryTaskStore(),
@@ -485,6 +489,7 @@ class Agent:
             task_store=self._task_store,
         )
 
+        # SDK task store for protocol-level lifecycle (separate from app-level self._task_store)
         request_handler = DefaultRequestHandler(
             agent_executor=executor,
             task_store=InMemoryTaskStore(),

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/auth.py

@@ -60,6 +60,17 @@ class AuthRequest:
     method: str = "POST"
     path: str = "/"
 
+    def get_header(self, name: str) -> Optional[str]:
+        """Get a header value (case-insensitive)."""
+        # Try exact match first, then case-insensitive
+        if name in self.headers:
+            return self.headers[name]
+        lower = name.lower()
+        for k, v in self.headers.items():
+            if k.lower() == lower:
+                return v
+        return None
+
 
 @dataclass
 class AuthResult:
@@ -128,8 +139,8 @@ class APIKeyAuth(AuthProvider):
         return hashlib.sha256(key.encode()).hexdigest()
 
     async def authenticate(self, request: AuthRequest) -> AuthResult:
-        # Check header
-        key = request.headers.get(self.header)
+        # Check header (case-insensitive)
+        key = request.get_header(self.header)
 
         # Check query param
         if not key and self.query_param:
@@ -179,7 +190,7 @@ class BearerAuth(AuthProvider):
         self.header = header
 
     async def authenticate(self, request: AuthRequest) -> AuthResult:
-        auth_header = request.headers.get(self.header, "")
+        auth_header = request.get_header(self.header) or ""
 
         if not auth_header.startswith("Bearer "):
             return AuthResult.failure("Bearer token required")
@@ -228,7 +239,7 @@ class OAuth2Auth(AuthProvider):
         self._jwks_client = None
 
     async def authenticate(self, request: AuthRequest) -> AuthResult:
-        auth_header = request.headers.get("Authorization", "")
+        auth_header = request.get_header("Authorization") or ""
 
         if not auth_header.startswith("Bearer "):
             return AuthResult.failure("Bearer token required")

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/cli.py

@@ -75,7 +75,7 @@ version = "0.1.0"
 description = "A2A Agent: {name}"
 requires-python = ">=3.10"
 dependencies = [
-    "a2a-lite>=0.2.0",
+    "a2a-lite>=0.2.1",
 ]
 '''
     (project_path / "pyproject.toml").write_text(pyproject)

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/executor.py

@@ -59,6 +59,22 @@ class LiteAgentExecutor(AgentExecutor):
         from a2a.utils import new_agent_text_message
 
         try:
+            # Authenticate the request
+            if self.auth_provider:
+                from .auth import AuthRequest, NoAuth
+                if not isinstance(self.auth_provider, NoAuth):
+                    headers = {}
+                    if context.call_context and context.call_context.state:
+                        headers = context.call_context.state.get('headers', {})
+                    auth_request = AuthRequest(headers=headers)
+                    auth_result = await self.auth_provider.authenticate(auth_request)
+                    if not auth_result.authenticated:
+                        error_msg = json.dumps({
+                            "error": auth_result.error or "Authentication failed",
+                        })
+                        await event_queue.enqueue_event(new_agent_text_message(error_msg))
+                        return
+
             # Extract message and parts
             message, parts = self._extract_message_and_parts(context)
 
@@ -120,7 +136,14 @@ class LiteAgentExecutor(AgentExecutor):
         if skill_name is None:
             if not self.skills:
                 return {"error": "No skills registered"}
-            skill_name = list(self.skills.keys())[0]
+            # Only auto-select if there's exactly one skill
+            if len(self.skills) == 1:
+                skill_name = list(self.skills.keys())[0]
+            else:
+                return {
+                    "error": "No skill specified. Use {\"skill\": \"name\", \"params\": {...}} format.",
+                    "available_skills": list(self.skills.keys()),
+                }
 
         if skill_name not in self.skills:
             return {
@@ -167,11 +190,19 @@ class LiteAgentExecutor(AgentExecutor):
         metadata: Dict[str, Any],
     ) -> Dict[str, Any]:
         """Convert parameters to Pydantic models and file parts if needed."""
+        import typing
         handler = skill_def.handler
-        hints = getattr(handler, '__annotations__', {})
+        try:
+            hints = typing.get_type_hints(handler)
+        except Exception:
+            hints = getattr(handler, '__annotations__', {})
+
+        from .parts import FilePart, DataPart
 
         converted = {}
         for param_name, value in params.items():
+            if param_name == 'return':
+                continue
             param_type = hints.get(param_name)
 
             if param_type is None:
@@ -185,9 +216,7 @@ class LiteAgentExecutor(AgentExecutor):
                 continue
 
             # Convert FilePart
-            type_name = str(param_type)
-            if "FilePart" in type_name:
-                from .parts import FilePart
+            if _is_or_subclass(param_type, FilePart):
                 if isinstance(value, dict):
                     # Handle both A2A format and simple dict format
                     if "file" in value:
@@ -208,8 +237,7 @@ class LiteAgentExecutor(AgentExecutor):
                 continue
 
             # Convert DataPart
-            if "DataPart" in type_name:
-                from .parts import DataPart
+            if _is_or_subclass(param_type, DataPart):
                 if isinstance(value, dict):
                     # Handle both A2A format and simple dict format
                     if "type" in value and value.get("type") == "data":

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/middleware.py

@@ -159,7 +159,12 @@ def retry_middleware(max_retries: int = 3, delay: float = 1.0):
 
 def rate_limit_middleware(requests_per_minute: int = 60):
     """
-    Create a simple rate limiting middleware.
+    Create a simple in-process rate limiting middleware.
+
+    Note: This rate limiter is per-process. Under multi-worker uvicorn
+    (e.g., ``--workers 4``), each worker tracks limits independently.
+    For shared rate limiting across workers, use an external store
+    (Redis, etc.) and a custom middleware.
 
     Example:
         agent.add_middleware(rate_limit_middleware(requests_per_minute=100))

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/tasks.py

@@ -30,7 +30,7 @@ from __future__ import annotations
 import asyncio
 import logging
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 from enum import Enum
 from typing import Any, Callable, Dict, List, Optional
 from uuid import uuid4
@@ -55,7 +55,7 @@ class TaskStatus:
     state: TaskState
     message: Optional[str] = None
     progress: Optional[float] = None  # 0.0 to 1.0
-    timestamp: datetime = field(default_factory=datetime.utcnow)
+    timestamp: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
 
     def to_dict(self) -> Dict[str, Any]:
         return {
@@ -77,8 +77,8 @@ class Task:
     error: Optional[str] = None
     artifacts: List[Any] = field(default_factory=list)
     history: List[TaskStatus] = field(default_factory=list)
-    created_at: datetime = field(default_factory=datetime.utcnow)
-    updated_at: datetime = field(default_factory=datetime.utcnow)
+    created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
+    updated_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
 
     def update_status(
         self,
@@ -89,7 +89,7 @@ class Task:
         """Update task status."""
         self.history.append(self.status)
         self.status = TaskStatus(state=state, message=message, progress=progress)
-        self.updated_at = datetime.utcnow()
+        self.updated_at = datetime.now(timezone.utc)
 
 
 class TaskContext:

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/src/a2a_lite/testing.py

@@ -214,7 +214,7 @@ class AgentTestClient:
                 result = await gen
                 results.append(result)
 
-        asyncio.get_event_loop().run_until_complete(run_handler())
+        asyncio.run(run_handler())
         return results
 
 

{a2a_lite-0.2.0 → a2a_lite-0.2.1}/tests/test_auth.py

@@ -175,3 +175,118 @@ class TestCompositeAuth:
         result = await auth.authenticate(request)
 
         assert result.authenticated is False
+
+
+class TestAuthIntegration:
+    """Test that auth is actually enforced in the HTTP request pipeline."""
+
+    def _make_agent_with_auth(self):
+        from a2a_lite import Agent
+        agent = Agent(
+            name="SecureAgent",
+            description="Auth integration test",
+            auth=APIKeyAuth(keys=["valid-key"]),
+        )
+
+        @agent.skill("secret")
+        async def secret(data: str) -> str:
+            return f"secret: {data}"
+
+        return agent
+
+    def test_unauthenticated_request_rejected(self):
+        """Requests without a valid API key should be rejected."""
+        from starlette.testclient import TestClient
+        import json
+        from uuid import uuid4
+
+        agent = self._make_agent_with_auth()
+        app = agent.get_app()
+        client = TestClient(app)
+
+        request_body = {
+            "jsonrpc": "2.0",
+            "method": "message/send",
+            "id": uuid4().hex,
+            "params": {
+                "message": {
+                    "role": "user",
+                    "parts": [{"type": "text", "text": json.dumps({"skill": "secret", "params": {"data": "hello"}})}],
+                    "messageId": uuid4().hex,
+                }
+            }
+        }
+
+        response = client.post("/", json=request_body)
+        data = response.json()
+
+        # The response should contain an auth error, not the skill result
+        result_text = data.get("result", {}).get("parts", [{}])[0].get("text", "")
+        assert "error" in result_text.lower() or "auth" in result_text.lower() or "key" in result_text.lower()
+        assert "secret: hello" not in result_text
+
+    def test_authenticated_request_succeeds(self):
+        """Requests with a valid API key should succeed."""
+        from starlette.testclient import TestClient
+        import json
+        from uuid import uuid4
+
+        agent = self._make_agent_with_auth()
+        app = agent.get_app()
+        client = TestClient(app)
+
+        request_body = {
+            "jsonrpc": "2.0",
+            "method": "message/send",
+            "id": uuid4().hex,
+            "params": {
+                "message": {
+                    "role": "user",
+                    "parts": [{"type": "text", "text": json.dumps({"skill": "secret", "params": {"data": "hello"}})}],
+                    "messageId": uuid4().hex,
+                }
+            }
+        }
+
+        response = client.post(
+            "/",
+            json=request_body,
+            headers={"X-API-Key": "valid-key"},
+        )
+        data = response.json()
+
+        result_text = data.get("result", {}).get("parts", [{}])[0].get("text", "")
+        assert "secret: hello" in result_text
+
+    def test_wrong_key_rejected(self):
+        """Requests with an invalid API key should be rejected."""
+        from starlette.testclient import TestClient
+        import json
+        from uuid import uuid4
+
+        agent = self._make_agent_with_auth()
+        app = agent.get_app()
+        client = TestClient(app)
+
+        request_body = {
+            "jsonrpc": "2.0",
+            "method": "message/send",
+            "id": uuid4().hex,
+            "params": {
+                "message": {
+                    "role": "user",
+                    "parts": [{"type": "text", "text": json.dumps({"skill": "secret", "params": {"data": "hello"}})}],
+                    "messageId": uuid4().hex,
+                }
+            }
+        }
+
+        response = client.post(
+            "/",
+            json=request_body,
+            headers={"X-API-Key": "wrong-key"},
+        )
+        data = response.json()
+
+        result_text = data.get("result", {}).get("parts", [{}])[0].get("text", "")
+        assert "secret: hello" not in result_text