aethergraph 0.1.0a1__py3-none-any.whl → 0.1.0a2__py3-none-any.whl

aethergraph/services/auth/{dev.py → authn.py}

@@ -1,4 +1,3 @@
-# services/auth/dev.py
 class DevTokenAuthn:
     """Development token authenticator. Accepts any token, returns 'dev' as subject."""
 
@@ -7,10 +6,3 @@ class DevTokenAuthn:
 
     async def whoami(self, token: str | None) -> dict:
         return {"subject": token or "dev", "roles": ["admin"]}
-
-
-class AllowAllAuthz:
-    """Development authorizer that allows all actions."""
-
-    async def allow(self, actor: dict, action: str, resource: str) -> bool:
-        return True

aethergraph/services/auth/authz.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Literal, Protocol
+
+from fastapi import HTTPException, status
+
+if TYPE_CHECKING:
+    from aethergraph.api.v1.deps import RequestIdentity
+
+AuthZServiceScope = Literal["runs", "artifacts", "graphs", "admin", "system"]
+AuthZServiceAction = Literal["read", "write", "execute", "delete", "admin"]
+
+
+class AuthZService(Protocol):
+    async def authorize(
+        self,
+        *,
+        identity: RequestIdentity,
+        scope: AuthZServiceScope,
+        action: AuthZServiceAction,
+    ) -> None:
+        """Authorize the given identity to perform the action within the scope.
+
+        Raises HTTPException with status 403 if not authorized.
+        """
+        ...
+
+
+@dataclass
+class AllowAllAuthz(AuthZService):
+    """
+    Default OSS-safe behavior: everything is allowed.
+    Useful for local/demo, and as a safe fallback if authz isn't configured.
+    """
+
+    async def authorize(
+        self,
+        *,
+        identity: RequestIdentity,
+        scope: AuthZServiceScope,
+        action: AuthZServiceAction,
+    ) -> None:
+        """Always allow."""
+        return
+
+
+@dataclass
+class BasicAuthz(AuthZService):
+    """
+    Minimal policy based on mode and roles:
+      - local: allow everything
+      - demo: allow normal operations, block admin/system stuff
+      - cloud: allow everything except admin unless role "admin" is present
+    """
+
+    allow_local_admin: bool = False
+
+    async def authorize(
+        self,
+        *,
+        identity: RequestIdentity,
+        scope: AuthZServiceScope,
+        action: AuthZServiceAction,
+    ) -> None:
+        # Local dev: basically god-mode
+        if identity.mode == "local":
+            if self.allow_local_admin:
+                return
+            if scope != "admin":
+                return
+
+        # Demo mode: no admin / system endpoints
+        if identity.mode == "demo":
+            if scope in ("admin", "system"):
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail="Admin/system operations are disabled in demo mode.",
+                )
+            return
+
+        # Cloud mode: basic, role-based admin
+        if identity.mode == "cloud":
+            if scope in ("admin", "system"):
+                if "admin" not in identity.roles:
+                    raise HTTPException(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        detail="Admin privileges required.",
+                    )
+                return
+
+            # Non-admin scopes: for now, allow everything.
+            # Later you can restrict per-org / per-resource here.
+            return
+
+        # Fallback: if someone invents a new mode and forgets to handle it
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"Unknown auth mode: {identity.mode}",
+        )

aethergraph/services/channel/channel_bus.py

@@ -212,10 +212,28 @@ class ChannelBus:
             "resume_key": resume_key,
         }
 
+        # Enrich continuation meta with the same context fields we attach
+        # on normal channel events (if present on the continuation object).
+        session_id = getattr(continuation, "session_id", None)
+        if session_id is not None:
+            meta.setdefault("session_id", session_id)
+
+        agent_id = getattr(continuation, "agent_id", None)
+        if agent_id is not None:
+            meta.setdefault("agent_id", agent_id)
+
+        app_id = getattr(continuation, "app_id", None)
+        if app_id is not None:
+            meta.setdefault("app_id", app_id)
+
+        graph_id = getattr(continuation, "graph_id", None)
+        if graph_id is not None:
+            meta.setdefault("graph_id", graph_id)
+
         # Shape event
         if kind == "user_input":
             silent = False
-            if hasattr(continuation, "payload"):
+            if hasattr(continuation, "payload") and isinstance(continuation.payload, dict):
                 silent = continuation.payload.get("_silent", False)
 
             txt = prompt if isinstance(prompt, str) else None

aethergraph/services/channel/factory.py

@@ -1,8 +1,11 @@
 # channels/factory.py
+from __future__ import annotations
+
 import os
 from typing import Any
 
 from aethergraph.config.config import AppSettings
+from aethergraph.contracts.storage.event_log import EventLog
 from aethergraph.plugins.channel.adapters.console import ConsoleChannelAdapter
 from aethergraph.plugins.channel.adapters.file import FileChannelAdapter
 from aethergraph.plugins.channel.adapters.slack import SlackChannelAdapter
@@ -11,7 +14,9 @@ from aethergraph.plugins.channel.adapters.webhook import WebhookChannelAdapter
 from aethergraph.services.channel.channel_bus import ChannelBus
 
 
-def make_channel_adapters_from_env(cfg: AppSettings) -> dict[str, Any]:
+def make_channel_adapters_from_env(
+    cfg: AppSettings, event_log: EventLog | None = None
+) -> dict[str, Any]:
     # Always include console adapter
     adapters = {"console": ConsoleChannelAdapter()}
 
@@ -29,6 +34,13 @@ def make_channel_adapters_from_env(cfg: AppSettings) -> dict[str, Any]:
 
     # include webhook adapter
     adapters["webhook"] = WebhookChannelAdapter()
+
+    # Always include webui adapter
+    from aethergraph.plugins.channel.adapters.webui import WebUIChannelAdapter
+
+    if event_log is None:
+        raise ValueError("event_log must be provided to create WebUIChannelAdapter")
+    adapters["ui"] = WebUIChannelAdapter(event_log=event_log)
     return adapters
 
 

aethergraph/services/channel/ingress.py

@@ -0,0 +1,311 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from dataclasses import dataclass
+from typing import Any
+
+import aiohttp
+
+from aethergraph.services.continuations.continuation import Continuation, Correlator
+
+
+@dataclass
+class IncomingFile:
+    """
+    Generic description of a file coming from an external UI.
+
+    You can:
+      - pre-upload somewhere and pass url/uri, or
+      - provide a public url and let AG download + store as artifact.
+    """
+
+    id: str | None = None  # Optional identifier for the file
+    name: str | None = None  # Optional name of the file
+    mimetype: str | None = None  # Optional MIME type of the file
+    size: int | None = None  # Optional size of the file in bytes
+    url: str | None = None  # URL where the file is located
+    uri: str | None = None  # URI where the file is located
+    extra: dict[str, Any] = None  # Any extra metadata
+
+
+@dataclass
+class IncomingMessage:
+    """
+    Transport-agnostic inbound message shape.
+    Used by HTTP/WS handlers and any custom code that wants to resume via channel.
+    """
+
+    scheme: str  # e.g. "ext", "mychat", "slack-http", etc.
+    channel_id: str  # Channel identifier
+    thread_id: str | None = None  # Optional thread/conversation identifier
+
+    # For ask_text / ask_file continuations
+    text: str | None = None  # Text content of the message
+    files: Iterable[IncomingFile] | None = None  # Attached files
+
+    # For approval
+    choice: str | None = None  # User's choice/response
+
+    # Optional structured metadata
+    meta: dict[str, Any] | None = None
+
+
+class ChannelIngress:
+    """
+    Canonical entry point for inbound messages from external channels.
+
+    Typical flow:
+      UI -> HTTP/WS -> ChannelIngress.handle(...) -> cont_store + resume_router
+    """
+
+    def __init__(self, *, container, logger=None):
+        self.c = container
+        # Validate and assign dependencies
+
+        assert container is not None, "Either provide all dependencies or a container"
+        self.artifacts = container.artifacts if hasattr(container, "artifacts") else None
+        self.kv_hot = container.kv_hot if hasattr(container, "kv_hot") else None
+        self.cont_store = container.cont_store if hasattr(container, "cont_store") else None
+        self.resume_router = (
+            container.resume_router if hasattr(container, "resume_router") else None
+        )
+
+        if logger is not None:
+            self.logger = logger
+        else:
+            container_logger = getattr(container, "logger", None)
+            self.logger = container_logger.for_channel() if container_logger else None
+
+    def _channel_key(self, scheme: str, channel_id: str) -> str:
+        """
+        Build a canonical channel key string from scheme + channel_id.
+
+        - For the generic "ext" channel, we use "ext:chan/<id>".
+        - For Slack/Telegram/etc. we can just use "<scheme>:<channel_id>" so we can
+          preserve their existing formats.
+        """
+        if scheme == "ext":
+            return f"{scheme}:chan/{channel_id}"
+        # Slack: channel_id = "team/T:chan/C" => "slack:team/T:chan/C"
+        # Telegram: channel_id = "chat/<id>[:topic/<topic_id>]" => "tg:chat/..."
+        return f"{scheme}:{channel_id}"
+
+    def _log(self, level: str, msg: str, **kwargs):
+        if not self.logger:
+            print(f"[{level.upper()}] {msg} | {kwargs}")
+            return
+        log_fn = getattr(self.logger, level.lower(), self.logger.info)
+        log_fn(msg, extra=kwargs)
+
+    async def _download_url(self, url: str) -> bytes:
+        """
+        Simple downloader for public URLs.
+        """
+        async with aiohttp.ClientSession() as sess, sess.get(url) as r:
+            r.raise_for_status()
+            return await r.read()
+
+    async def _stage_file(
+        self,
+        *,
+        data: bytes,
+        file_id: str | None,
+        name: str,
+        ch_key: str,
+        cont: Continuation,
+    ) -> str:
+        """
+        Write bytes to tmp path, then save via ArtifactStore.save_file(...).
+        Returns the Artifact.uri (string).
+        """
+        tmp = await self.artifacts.plan_staging_path(planned_ext=f"_{file_id or name}")
+
+        with open(tmp, "wb") as f:
+            f.write(data)
+
+        run_id = cont.run_id if cont else "ad-hoc"
+        node_id = cont.node_id if cont else "channel-ingress"
+
+        art = await self.artifacts.save_file(
+            path=tmp,
+            kind="upload",
+            run_id=run_id,
+            graph_id="channel",
+            node_id=node_id,
+            tool_name="channel.upload",
+            tool_version="0.0.1",
+            suggested_uri=None,
+            pin=False,
+            labels={
+                "source": "channel",
+                "channel": ch_key,
+                "name": name,
+                "inbound_file_id": file_id or "",
+            },
+            metrics=None,
+            preview_uri=None,
+        )
+
+        saved_uri = getattr(art, "uri", None)
+        if not saved_uri:
+            self._log(
+                "error",
+                "Failed to save uploaded file as artifact",
+                channel=ch_key,
+            )
+
+        return saved_uri
+
+    async def _handle_files(
+        self,
+        msg: IncomingMessage,
+        *,
+        ch_key: str,
+        cont: Continuation,
+    ) -> list[dict[str, Any]]:
+        """
+        Normalize and optionally persist incoming files to artifact store.
+
+        Returns a list of file_refs that mirror the Slack file_refs shape:
+          {id, name, mimetype, size, uri, url, platform, channel_key, ...}
+        """
+        if not msg.files:
+            return []
+
+        file_refs: list[dict[str, Any]] = []
+        for f in msg.files:
+            name = f.name or f.id or "unnamed"
+            file_id = f.id or name
+            mimetype = f.mimetype or "application/octet-stream"
+            size = f.size or 0
+            uri = f.uri
+            url = f.url
+
+            # Optional: auto-download if url is provided and no uri
+            # this is not executed when we stage files with channel-specific upload handlers that already provide uri
+            if (not uri) and url:
+                try:
+                    data_bytes = await self._download_url(url)
+                    uri = await self._stage_file(
+                        data=data_bytes,
+                        file_id=file_id,
+                        name=name,
+                        ch_key=ch_key,
+                        cont=cont,
+                    )
+                except Exception as e:
+                    self._log("warning", f"Ingress: file download failed: {e}", channel_key=ch_key)
+
+            ref = {
+                "id": file_id,
+                "name": name,
+                "mimetype": mimetype,
+                "size": size,
+                "uri": uri,
+                "url": url,
+                "platform": msg.scheme,
+                "channel_key": ch_key,
+            }
+            if f.extra:
+                ref["extra"] = dict(f.extra)
+
+            file_refs.append(ref)
+
+        # Append to per-channel inbox, dedup by id
+        inbox_key = f"inbox://{ch_key}"
+        await self.kv_hot.list_append_unique(
+            inbox_key,
+            file_refs,
+            id_key="id",
+        )
+        return file_refs
+
+    async def _find_continuation(
+        self, *, scheme: str, ch_key: str, thread_id: str | None
+    ) -> Continuation | None:
+        """
+        Find pending continuation for this channel/thread.
+        """
+        cont = None
+        if thread_id:
+            corr = Correlator(scheme=scheme, channel=ch_key, thread=thread_id, message="")
+            cont = await self.cont_store.find_by_correlator(corr=corr)
+
+        if not cont:
+            # Fallback: look for any continuation for this channel
+            corr2 = Correlator(scheme=scheme, channel=ch_key, thread="", message="")
+            cont = await self.cont_store.find_by_correlator(corr=corr2)
+
+        return cont
+
+    # ---- Public method ----
+    async def handle(self, msg: IncomingMessage) -> bool:
+        """
+        Handle an inbound message and resume a waiting continuation if any.
+
+        Returns:
+          True  -> a continuation was found and resumed
+          False -> nothing was listening on this channel (fire-and-forget)
+        """
+        scheme = msg.scheme
+        ch_key = self._channel_key(scheme, msg.channel_id)
+
+        cont = await self._find_continuation(
+            scheme=scheme,
+            ch_key=ch_key,
+            thread_id=msg.thread_id,
+        )
+
+        # Normalize and persist any attached files
+        file_refs = []
+        if msg.files:
+            file_refs = await self._handle_files(
+                msg,
+                ch_key=ch_key,
+                cont=cont,
+            )
+
+        if not cont:
+            # No continuation found, log and return
+            self._log(
+                "info",
+                "Ingress: no continuation found for inbound message",
+                channel_key=ch_key,
+            )
+            return False
+
+        # Build payload for resumption
+        kind = cont.kind
+        meta = msg.meta or {}
+
+        if kind == "approval":
+            choice = (msg.choice or (msg.text or "")).strip() or "reject"
+            payload: dict[str, Any] = {
+                "choice": choice,
+                "channel_key": ch_key,
+                "thread_id": msg.thread_id,
+                "meta": meta,
+            }
+        elif kind in ("user_files", "user_input_or_files"):
+            payload = {
+                "text": msg.text or "",
+                "files": file_refs,
+                "channel_key": ch_key,
+                "thread_id": msg.thread_id,
+                "meta": meta,
+            }
+        else:
+            payload = {
+                "text": msg.text or "",
+                "channel_key": ch_key,
+                "thread_id": msg.thread_id,
+                "meta": meta,
+            }
+
+        await self.resume_router.resume(
+            run_id=cont.run_id,
+            node_id=cont.node_id,
+            token=cont.token,
+            payload=payload,
+        )
+        return True

aethergraph/services/channel/queue_adapter.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from typing import Any
+
+from aethergraph.contracts.services.channel import ChannelAdapter, OutEvent
+from aethergraph.services.continuations.continuation import Correlator
+
+
+class QueueChannelAdapter(ChannelAdapter):
+    """
+    Generic adapter that writes OutEvents into a per-channel outbox in kv_hot.
+
+    This is meant to be paired with:
+      - /ws/channel   (to stream events to browser/clients)
+      - optional /channel/outbox polling endpoint
+
+    Capabilities: full superset to avoid downgrades in ChannelBus._smart_fallback.
+    """
+
+    # Slack-level capability set; user code can still choose to ignore some fields.
+    capabilities: set[str] = {"text", "buttons", "image", "file", "edit", "stream"}
+
+    def __init__(self, container, *, scheme: str = "ext"):
+        self.c = container
+        self.scheme = scheme
+
+    async def send(self, event: OutEvent) -> dict | None:
+        """
+        Serialize OutEvent to a JSON-friendly dict and append to the channel outbox.
+
+        Consumers (WS client, HTTP polling, etc.) can render this however they like.
+        """
+        ch_key = event.channel  # expected to already look like "ext:chan/<id>" or similar
+        outbox_key = f"outbox://{ch_key}"
+
+        # Minimal normalization; keep as much info as possible for UI.
+        payload: dict[str, Any] = {
+            "type": event.type,
+            "channel": event.channel,
+            "text": event.text,
+            "meta": event.meta,
+            "rich": event.rich,
+            "upsert_key": event.upsert_key,
+            "file": event.file,
+            "buttons": [],
+        }
+
+        # Buttons: flatten for clients (label/value/style/url)
+        if event.buttons:
+            btns = []
+            for b in event.buttons:
+                btns.append(
+                    {
+                        "label": getattr(b, "label", None),
+                        "value": getattr(b, "value", None),
+                        "style": getattr(b, "style", None),
+                        "url": getattr(b, "url", None),
+                    }
+                )
+            payload["buttons"] = btns
+
+        # simple timestamp if you have a clock service; otherwise omit
+        if hasattr(self.c, "clock"):
+            payload["ts"] = self.c.clock.now_ts()
+
+        await self.c.kv_hot.list_append(outbox_key, [payload])
+
+        return {
+            "correlator": Correlator(
+                scheme=self.scheme,
+                channel=ch_key,
+                thread=(event.meta or {}).get("thread") or "",
+                message=None,
+            )
+        }