agent-api-server 2.1.14__tar.gz → 2.1.16__tar.gz

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.3
 Name: agent-api-server
-Version: 2.1.14
+Version: 2.1.16
 Summary: A Langgraph agent API server that implements Langgraph agent's web capabilities and can interact with chatbot
 Author: zijie.zhang@advantech.com.cn
 Requires-Python: >=3.10,<3.13
@@ -613,13 +613,13 @@ ACP 采用**代理模式（Proxy Mode）**，CLI 进程作为编辑器与 FastAP
 
 ```bash
 # 从 PyPI 安装
-pip install agent-api-server==2.1.14
+pip install agent-api-server==2.1.16
 
 # 或从本地 wheel 安装
-pip install dist/agent_api_server-2.1.14-py3-none-any.whl
+pip install dist/agent_api_server-2.1.16-py3-none-any.whl
 ```
 
-`2.1.14` 使用本仓库的 LangGraph 0.6 依赖，并包含 WisePortal 组织适配。PyPI 上另有使用 LangGraph 1.x 的 `2.2.x` 版本，安装本版本时请指定版本号。
+`2.1.16` 使用本仓库的 LangGraph 0.6 依赖，并包含 WisePortal 组织适配、Redis `mode=standalone` 地址兼容，以及配置中心、SSO 和 ServiceHub 启动修复。PyPI 上另有使用 LangGraph 1.x 的 `2.2.x` 版本，安装本版本时请指定版本号。
 
 ACP 命令使用仓库中的 Go 实现，需要在源码目录单独构建，并将生成的程序放入 `PATH`：
 
@@ -948,6 +948,8 @@ pip install agent-api-server[a2a]
 SSO_URL=http://sso/v4.0
 CLIENT_ID=your_client_id
 CLIENT_SECRET=your_client_secret
+# 自动查询/注册 SSO 客户端时使用；不同应用应使用不同名称。
+# SSO_SERVICE_NAME=your-agent-service
 
 # 数据库
 POSTGRES_URL=postgresql://user:password@host:port/dbname
@@ -971,6 +973,13 @@ AGENT_AUTO_REGISTRATION=false
 ENABLE_A2A=false
 ```
 
+`SSO_URL` 支持服务根地址或带 `/v4.0` 的地址，也可带末尾斜杠。
+`CLIENT_ID` 和 `CLIENT_SECRET` 同时配置时直接使用；两项均为空时自动查询或注册
+SSO 客户端，只配置其中一项会报错。`SSO_SERVICE_NAME` 未设置时兼容旧名称
+`KB-Insight`，其他应用应显式设置自己的名称。
+提供 `ENSAAS_SERVICES` 时，ServiceHub 的数据库、Redis 和可选存储凭证会在
+创建连接对象前加载，用户名及密码中的特殊字符会进行 URL 编码。
+
 ### WisePortal 配置
 
 服务启动时会从 `${CONFIG_CENTER_ADDRESS}/v1/public/configs`
@@ -980,6 +989,15 @@ ENABLE_A2A=false
 配置读取失败时记录警告并保留当前开关值，初始默认值为 `false`。
 REST 与独立 MCP 服务都会在启动时读取配置；修改配置后需重启服务。
 
+同一公共接口返回的 `datacenter`、`cluster`、`workspace`、`namespace` 会在初始化
+SSO 前写入同名环境变量，供 SSO 客户端查询、注册和客户端 Token 范围校验使用，
+与 WisePortal 开关是否开启无关。接口返回的非空字符串优先；字段缺失或为空、
+或配置读取失败时保留已有环境变量。启动日志会输出实际使用的 SSO 范围，并提示仍缺失的字段。
+
+设置 `ENABLE_CONFIG_CENTER=true` 后，还会从 `/v1/services` 读取 SSO 和 Model Manager
+的 API 地址，同步到全局配置与同名环境变量。此接口读取失败或某个地址为空时，
+保留原有地址；关闭该开关仍会读取上述公共配置。
+
 - 关闭时，REST 继续读取 Cookie `TSTenant`，MCP 继续读取 Header `TSTenant`。
 - 开启时，优先读取 Header `Org-Str-Id`，其次 Header `orgStrId`、Cookie `orgStrId`，
   将该值作为 `TSTenant`。缺少组织字段时不会回退到旧租户字段。

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/README.md

@@ -572,13 +572,13 @@ ACP 采用**代理模式（Proxy Mode）**，CLI 进程作为编辑器与 FastAP
 
 ```bash
 # 从 PyPI 安装
-pip install agent-api-server==2.1.14
+pip install agent-api-server==2.1.16
 
 # 或从本地 wheel 安装
-pip install dist/agent_api_server-2.1.14-py3-none-any.whl
+pip install dist/agent_api_server-2.1.16-py3-none-any.whl
 ```
 
-`2.1.14` 使用本仓库的 LangGraph 0.6 依赖，并包含 WisePortal 组织适配。PyPI 上另有使用 LangGraph 1.x 的 `2.2.x` 版本，安装本版本时请指定版本号。
+`2.1.16` 使用本仓库的 LangGraph 0.6 依赖，并包含 WisePortal 组织适配、Redis `mode=standalone` 地址兼容，以及配置中心、SSO 和 ServiceHub 启动修复。PyPI 上另有使用 LangGraph 1.x 的 `2.2.x` 版本，安装本版本时请指定版本号。
 
 ACP 命令使用仓库中的 Go 实现，需要在源码目录单独构建，并将生成的程序放入 `PATH`：
 
@@ -907,6 +907,8 @@ pip install agent-api-server[a2a]
 SSO_URL=http://sso/v4.0
 CLIENT_ID=your_client_id
 CLIENT_SECRET=your_client_secret
+# 自动查询/注册 SSO 客户端时使用；不同应用应使用不同名称。
+# SSO_SERVICE_NAME=your-agent-service
 
 # 数据库
 POSTGRES_URL=postgresql://user:password@host:port/dbname
@@ -930,6 +932,13 @@ AGENT_AUTO_REGISTRATION=false
 ENABLE_A2A=false
 ```
 
+`SSO_URL` 支持服务根地址或带 `/v4.0` 的地址，也可带末尾斜杠。
+`CLIENT_ID` 和 `CLIENT_SECRET` 同时配置时直接使用；两项均为空时自动查询或注册
+SSO 客户端，只配置其中一项会报错。`SSO_SERVICE_NAME` 未设置时兼容旧名称
+`KB-Insight`，其他应用应显式设置自己的名称。
+提供 `ENSAAS_SERVICES` 时，ServiceHub 的数据库、Redis 和可选存储凭证会在
+创建连接对象前加载，用户名及密码中的特殊字符会进行 URL 编码。
+
 ### WisePortal 配置
 
 服务启动时会从 `${CONFIG_CENTER_ADDRESS}/v1/public/configs`
@@ -939,6 +948,15 @@ ENABLE_A2A=false
 配置读取失败时记录警告并保留当前开关值，初始默认值为 `false`。
 REST 与独立 MCP 服务都会在启动时读取配置；修改配置后需重启服务。
 
+同一公共接口返回的 `datacenter`、`cluster`、`workspace`、`namespace` 会在初始化
+SSO 前写入同名环境变量，供 SSO 客户端查询、注册和客户端 Token 范围校验使用，
+与 WisePortal 开关是否开启无关。接口返回的非空字符串优先；字段缺失或为空、
+或配置读取失败时保留已有环境变量。启动日志会输出实际使用的 SSO 范围，并提示仍缺失的字段。
+
+设置 `ENABLE_CONFIG_CENTER=true` 后，还会从 `/v1/services` 读取 SSO 和 Model Manager
+的 API 地址，同步到全局配置与同名环境变量。此接口读取失败或某个地址为空时，
+保留原有地址；关闭该开关仍会读取上述公共配置。
+
 - 关闭时，REST 继续读取 Cookie `TSTenant`，MCP 继续读取 Header `TSTenant`。
 - 开启时，优先读取 Header `Org-Str-Id`，其次 Header `orgStrId`、Cookie `orgStrId`，
   将该值作为 `TSTenant`。缺少组织字段时不会回退到旧租户字段。

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/agent_registration.py

@@ -1,5 +1,6 @@
 """Agent registration and listener management service."""
 import os
+import asyncio
 import threading
 from typing import List, Dict, Any
 
@@ -29,25 +30,29 @@ class AgentRegistrationService:
             SSOInitializationError: If SSO initialization fails
         """
         try:
-            sso_service = SSOService(
+            sso_service = await asyncio.to_thread(
+                SSOService,
                 sso_config=SSOConfig(
                     sso_address=global_config.SSO_URL,
                     client_id=global_config.CLIENT_ID,
                     client_secret=global_config.CLIENT_SECRET,
+                    service_name=global_config.SSO_SERVICE_NAME,
                 )
             )
 
             client_id, client_secret = sso_service.get_client_id_and_secret()
             logger.debug("SSO credentials obtained - Client ID: %s", client_id)
 
-            self._client_token = sso_service.generate_client_token(
-                client_id, client_secret
+            self._client_token = await asyncio.to_thread(
+                sso_service.generate_client_token, client_id, client_secret
             )
 
+            global_config.CLIENT_ID = client_id
+            global_config.CLIENT_SECRET = client_secret
             global_config.CLIENT_TOKEN = self._client_token
             os.environ['CLIENT_TOKEN'] = self._client_token
 
-            logger.info(f"SSO initialization completed successfully, CLIENT_TOKEN is {self._client_token}")
+            logger.info("SSO initialization completed successfully")
             return self._client_token
 
         except Exception as e:

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/app.py

@@ -61,6 +61,7 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     """Single source of truth for application lifecycle.
 
     Initialization order:
+    0. Configuration and credentials
     1. Infrastructure (Postgres + Redis)
     2. Schema migration (advisory-lock protected, multi-worker safe)
     3. SSO + Agent registration + Listeners (if not already done by init_fastapi_server)
@@ -70,11 +71,15 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     from agent_api_server.startup import ApplicationStartup
 
     startup = ApplicationStartup()
-    checkpointer = AsyncPostgresCheckpointer.get_worker_instance()
-    cache = AsyncRedisThreadStorage.get_worker_instance()
 
     try:
-        await initialize_wiseportal_config()
+        if not ApplicationStartup._initialized:
+            await initialize_wiseportal_config()
+            await startup._initialize_credentials()
+
+        # Constructors snapshot their connection URLs, so configuration must be ready first.
+        checkpointer = AsyncPostgresCheckpointer.get_worker_instance()
+        cache = AsyncRedisThreadStorage.get_worker_instance()
 
         # 1. Infrastructure (always run, these are per-worker)
         await checkpointer.initialize()
@@ -90,7 +95,6 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
         # 3. Credentials, SSO, Agent registration, Listeners
         # Only run if not already initialized by init_fastapi_server()
         if not ApplicationStartup._initialized:
-            await startup._initialize_credentials()
             await startup.registration_service.initialize_sso()
 
             agents = await startup._load_agent_config()

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/cache/redis_cache.py

@@ -9,6 +9,7 @@ from uuid import uuid4
 from dataclasses import dataclass
 import redis.asyncio as redis
 from agent_api_server.configs import global_config
+from agent_api_server.shared.redis_url import normalize_redis_url
 from redis.exceptions import RedisError, WatchError
 
 logger = logging.getLogger(__name__)
@@ -65,9 +66,13 @@ class AsyncRedisThreadStorage:
 
     @staticmethod
     def _get_redis_url() -> str:
-        """获取安全的Redis连接字符串（隐藏密码）"""
-        redis_url = global_config.REDIS_URL
-        safe_redis_url = redis_url.split('@')[0] + '@[REDACTED]' if '@' in redis_url else redis_url
+        """Normalize the configured Redis URL and redact credentials in logs."""
+        redis_url = normalize_redis_url(global_config.REDIS_URL)
+        scheme = redis_url.partition("://")[0]
+        safe_redis_url = (
+            f"{scheme}://[REDACTED]@{redis_url.rsplit('@', 1)[1]}"
+            if '@' in redis_url else redis_url
+        )
         logger.debug("Using Redis URL: %s", safe_redis_url)
         return redis_url
 
@@ -382,4 +387,4 @@ class AsyncRedisThreadStorage:
                 return bool(exists) and status != b"stopped"
         except RedisError as e:
             logger.error(f"Failed to check stop flag: {str(e)}")
-            return False
+            return False

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/config_center/config_center.py

@@ -244,17 +244,50 @@ def parse_wiseportal_enabled(value) -> bool:
     return value is True or (isinstance(value, str) and value.strip().lower() == "true")
 
 
-async def initialize_wiseportal_config() -> None:
-    """Load the portal mode during server startup."""
-    client = AsyncConfigCenterClient()
+async def _initialize_public_config(client: AsyncConfigCenterClient) -> None:
     try:
         config = await client.public_config()
         global_config.isWisePortal = config["isWisePortal"]
+        scope_fields = ("datacenter", "cluster", "workspace", "namespace")
+        for field in scope_fields:
+            value = config.get(field)
+            if isinstance(value, str) and value.strip():
+                # SSOClient and verify_client_token both read these environment keys.
+                os.environ[field] = value.strip()
+
         logger.info("WisePortal mode: %s", global_config.isWisePortal)
+        logger.info("SSO scope: %s", {field: os.getenv(field) for field in scope_fields})
+        missing = [field for field in scope_fields if not os.getenv(field, "").strip()]
+        if missing:
+            logger.warning(
+                "Missing SSO scope fields: %s; configure them in /v1/public/configs "
+                "or environment variables",
+                ", ".join(missing),
+            )
     except (httpx.HTTPError, ValueError, TypeError, AttributeError) as exc:
         logger.warning(
-            "Unable to load WisePortal public config; retaining isWisePortal=%s: %s",
+            "Unable to load public config; retaining existing SSO scope and isWisePortal=%s: %s",
             global_config.isWisePortal, exc,
         )
+
+
+async def initialize_wiseportal_config() -> None:
+    """Load public scope and optional service discovery before clients are created."""
+    client = AsyncConfigCenterClient()
+    try:
+        await _initialize_public_config(client)
+        if global_config.ENABLE_CONFIG_CENTER:
+            try:
+                services = await client.service_config()
+                for field in ("SSO_URL", "MODEL_MANAGER_SERVICE_URL"):
+                    address = services.get(field)
+                    if isinstance(address, str) and address.strip():
+                        address = address.strip().rstrip("/")
+                        setattr(global_config, field, address)
+                        # Legacy model-manager paths still read the environment.
+                        os.environ[field] = address
+                logger.info("ConfigCenter service addresses loaded")
+            except (httpx.HTTPError, ValueError, TypeError, AttributeError) as exc:
+                logger.warning("Unable to load service config; retaining existing addresses: %s", exc)
     finally:
         await client.close()

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/configs/config.py

@@ -12,6 +12,9 @@ class SSOConfig(BaseSettings):
     CLIENT_ID: str = Field(default="", description="The client-id of server")
     CLIENT_SECRET: str = Field(default="", description="The client secret of server")
     CLIENT_TOKEN: str = Field(default="", description="The client token of server")
+    SSO_SERVICE_NAME: str = Field(
+        default="", description="SSO client service name; defaults to KB-Insight for compatibility"
+    )
 
 
 class CacheConfig(BaseSettings):

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/listener/redis_listener.py

@@ -8,6 +8,7 @@ import redis
 
 from agent_api_server.configs import global_config
 from agent_api_server.listener.base import MessageListener
+from agent_api_server.shared.redis_url import normalize_redis_url
 
 import logging
 
@@ -48,7 +49,7 @@ class RedisListener(MessageListener):
         """Establish Redis connection and subscribe to channels."""
         try:
             self.redis_client = redis.Redis.from_url(
-                url=global_config.MODEL_MANAGER_REDIS_URL,
+                url=normalize_redis_url(global_config.MODEL_MANAGER_REDIS_URL),
                 socket_timeout=10,
                 socket_keepalive=True,
                 health_check_interval=15,

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/memory/postgres.py

@@ -5,6 +5,7 @@ from typing import Optional, cast, Dict, Any
 from psycopg_pool import AsyncConnectionPool
 from psycopg.rows import dict_row
 from psycopg import OperationalError, AsyncConnection
+from psycopg.conninfo import conninfo_to_dict
 from agent_api_server.configs import global_config
 from tenacity import (
     retry,
@@ -75,8 +76,9 @@ class AsyncPostgresCheckpointer:
     def _get_conn_str() -> str:
         """获取安全的连接字符串（隐藏密码）"""
         conn_str = global_config.POSTGRES_URL
-        safe_conn_str = conn_str.split('@')[0] + '@[REDACTED]' if '@' in conn_str else conn_str
-        logger.debug("Using connection string: %s", safe_conn_str)
+        connection = conninfo_to_dict(conn_str)
+        logger.debug("Using PostgreSQL connection: host=%s port=%s dbname=%s",
+                     connection.get("host"), connection.get("port"), connection.get("dbname"))
         return conn_str
 
     @classmethod
@@ -264,4 +266,4 @@ class AsyncPostgresCheckpointer:
 
     @property
     def is_initialized(self):
-        return self._is_initialized
+        return self._is_initialized

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/service_hub/service_hub.py

@@ -3,6 +3,7 @@ import os
 import logging
 from typing import Dict, List, Union
 from dataclasses import dataclass, field
+from urllib.parse import quote
 
 logger = logging.getLogger(__name__)
 
@@ -85,31 +86,35 @@ class ServiceHubCredentials:
             raise CredentialNotFoundError("PostgreSQL credentials not found")
 
         cred = self.postgres[0]
-        return f"postgresql://{cred.username}:{cred.password}@{cred.internal_hosts}/{cred.database}"
+        return (
+            f"postgresql://{quote(cred.username, safe='')}:{quote(cred.password, safe='')}"
+            f"@{cred.internal_hosts}/{quote(cred.database, safe='')}"
+        )
 
     def to_redis_dsn(self) -> str:
         if not self.redis:
             raise CredentialNotFoundError("Redis credentials not found")
 
         cred = self.redis[0]
+        username = quote(cred.username, safe="")
+        password = quote(cred.password, safe="")
 
         if not cred.password and not cred.username:
             return f"redis://{cred.internal_hosts}:{cred.port}"
 
         if cred.password and not cred.username:
-            return f"redis://:{cred.password}@{cred.internal_hosts}:{cred.port}"
+            return f"redis://:{password}@{cred.internal_hosts}:{cred.port}"
 
         if cred.username and not cred.password:
-            return f"redis://{cred.username}@{cred.internal_hosts}:{cred.port}"
+            return f"redis://{username}@{cred.internal_hosts}:{cred.port}"
 
         if cred.username and cred.password:
-            return f"redis://{cred.username}:{cred.password}@{cred.internal_hosts}:{cred.port}"
+            return f"redis://{username}:{password}@{cred.internal_hosts}:{cred.port}"
 
     def get_blobstore_s3_config(self) -> Dict[str, str]:
         """Get Blobstore credentials as S3-compatible configuration dictionary"""
         if not self.blobstore:
-            logger.warning("Blobstore credentials not found")
-            return {}
+            raise CredentialNotFoundError("Blobstore credentials not found")
 
         cred = self.blobstore[0]
         return {
@@ -182,7 +187,10 @@ class ServiceHubCredentialParser:
             endpoint=data.get("credentials", {}).get("endpoint", ""),
             external_hosts=data.get("credentials", {}).get("externalHosts", ""),
             internal_hosts=data.get("credentials", {}).get("internalHosts", ""),
-            signature_version=data.get("credentials", {}).get("signature-version", ""),
+            signature_version=(
+                data.get("credentials", {}).get("signatureVersion")
+                or data.get("credentials", {}).get("signature-version", "")
+            ),
             type=data.get("credentials", {}).get("type", ""),
             instance_name=data.get("instance_name", ""),
             label=data.get("label", ""),
@@ -230,4 +238,4 @@ class ServiceHubCredentialParser:
 class ServiceHubCredentialLoader:
     @staticmethod
     def load_credentials() -> ServiceHubCredentials:
-        return ServiceHubCredentialParser.parse(os.getenv("ENSAAS_SERVICES"))
+        return ServiceHubCredentialParser.parse(os.getenv("ENSAAS_SERVICES"))

agent_api_server-2.1.16/agent_api_server/shared/redis_url.py

@@ -0,0 +1,22 @@
+"""Adapt Redis URLs from configuration providers for redis-py clients."""
+
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+
+
+def normalize_redis_url(url: str) -> str:
+    """Remove standalone topology metadata while retaining connection options.
+
+    redis-py forwards URL query parameters to the connection constructor, which
+    does not accept the config center's ``mode`` parameter. Other topologies
+    require dedicated clients and must not silently use a standalone client.
+    """
+    parsed = urlsplit(url)
+    parameters = parse_qsl(parsed.query, keep_blank_values=True)
+    modes = [value for name, value in parameters if name == "mode"]
+    if not modes:
+        return url
+    if any(mode.lower() != "standalone" for mode in modes):
+        raise ValueError("Unsupported Redis mode; only mode=standalone is supported")
+
+    query = urlencode([(name, value) for name, value in parameters if name != "mode"])
+    return urlunsplit(parsed._replace(query=query))

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/sso_service/sdk/client.py

@@ -11,6 +11,14 @@ logger = logging.getLogger(__name__)
 
 CLIENT_CREDENTIALS = "client_credentials"
 CURRENT_SERVICE_NAME = "KB-Insight"
+SSO_REQUEST_TIMEOUT = 30.0
+
+
+def normalize_sso_address(address: str) -> str:
+    if not isinstance(address, str) or not address.strip():
+        raise ValueError("SSO service address is required")
+    address = address.strip().rstrip("/")
+    return address if address.endswith("/v4.0") else f"{address}/v4.0"
 
 
 class ClientRequest:
@@ -117,32 +125,40 @@ class SsoToken:
 
 class SSOClient:
     def __init__(self, service_name: Optional[str] = None):
+        service_name = service_name or os.getenv("SSO_SERVICE_NAME") or CURRENT_SERVICE_NAME
         self.client_info = ClientInfo(
             datacenter=os.getenv("datacenter"),
             cluster=os.getenv("cluster"),
             workspace=os.getenv("workspace"),
             namespace=os.getenv("namespace"),
             app_id=os.getenv("appID") or os.getenv("appId"),
-            app_name=service_name or CURRENT_SERVICE_NAME,
-            service_name=service_name or CURRENT_SERVICE_NAME,
+            app_name=service_name,
+            service_name=service_name,
         )
 
     def query_sso_client(self, address: str, req: ClientRequest) -> ClientInfo:
-        path = f"{address}/clients/{quote(req.app_name)}"
-        path += f"?namespace={req.namespace}&workspace={req.workspace}&cluster={req.cluster}&datacenter={req.datacenter}&serviceName={quote(req.service_name)}&appId={req.app_id}"
+        path = f"{normalize_sso_address(address)}/clients/{quote(req.app_name, safe='')}"
+        params = {
+            "namespace": req.namespace,
+            "workspace": req.workspace,
+            "cluster": req.cluster,
+            "datacenter": req.datacenter,
+            "serviceName": req.service_name,
+            "appId": req.app_id,
+        }
 
         credential = self.new_srp_token_credential(req.service_name)
         headers = outbound_headers({credential["header_name"]: credential["header_value"]})
 
-        response = requests.get(path, headers=headers)
+        response = requests.get(path, params=params, headers=headers, timeout=SSO_REQUEST_TIMEOUT)
         response.raise_for_status()
         return ClientInfo.from_dict(response.json())
 
     def register_client(self, address: str, req: ClientRequest) -> ClientInfo:
-        path = f"{address}/clients"
+        path = f"{normalize_sso_address(address)}/clients"
         body = json.dumps(req.to_dict())
 
-        logger.info({body})
+        logger.info("Registering SSO client for service %s", req.service_name)
 
         credential = self.new_srp_token_credential(req.service_name)
         headers = {
@@ -150,12 +166,14 @@ class SSOClient:
             "Content-Type": "application/json"
         }
 
-        response = requests.post(path, headers=outbound_headers(headers), data=body)
+        response = requests.post(
+            path, headers=outbound_headers(headers), data=body, timeout=SSO_REQUEST_TIMEOUT
+        )
         response.raise_for_status()
         return ClientInfo.from_dict(response.json())
 
     def update_sso_client(self, address: str, client_id: str, req: ClientRequest) -> ClientInfo:
-        path = f"{address}/clients/{client_id}"
+        path = f"{normalize_sso_address(address)}/clients/{quote(client_id, safe='')}"
         body = json.dumps(req.to_dict())
 
         credential = self.new_srp_token_credential(req.service_name)
@@ -164,39 +182,46 @@ class SSOClient:
             "Content-Type": "application/json"
         }
 
-        response = requests.put(path, headers=outbound_headers(headers), data=body)
+        response = requests.put(
+            path, headers=outbound_headers(headers), data=body, timeout=SSO_REQUEST_TIMEOUT
+        )
         response.raise_for_status()
         return ClientInfo.from_dict(response.json())
 
     def query_sso_client_token(self, address: str) -> SsoToken:
-        path = f"{address}/oauth/token"
-        path += f"?grant_type={CLIENT_CREDENTIALS}&client_id={self.client_info.client_id}&client_secret={self.client_info.client_secret}&duration=eternal"
+        path = f"{normalize_sso_address(address)}/oauth/token"
+        params = {
+            "grant_type": CLIENT_CREDENTIALS,
+            "client_id": self.client_info.client_id,
+            "client_secret": self.client_info.client_secret,
+            "duration": "eternal",
+        }
 
-        response = requests.post(path, headers=outbound_headers())
+        response = requests.post(
+            path, params=params, headers=outbound_headers(), timeout=SSO_REQUEST_TIMEOUT
+        )
         response.raise_for_status()
         return SsoToken.from_dict(response.json())
 
     def set_sso_client(self, address: str) -> None:
-        if not address.endswith("/v4.0"):
-            address += "/v4.0"
+        address = normalize_sso_address(address)
 
         try:
             rsp = self.query_sso_client(address, self.client_info)
         except requests.exceptions.HTTPError as e:
-            if "Not Found" in str(e):
+            if e.response is not None and e.response.status_code == 404:
                 rsp = self.register_client(address, self.client_info)
             else:
-                raise e
+                raise
 
         if rsp is None:
             raise Exception("Failed to set SSO client")
 
         if rsp.app_id != self.client_info.app_id:
-            try:
-                new_rsp = self.update_sso_client(address, rsp.client_id, self.client_info)
-                rsp = new_rsp
-            except requests.exceptions.HTTPError as e:
-                logger.error(f"Failed to update SSO client: {e}")
+            rsp = self.update_sso_client(address, rsp.client_id, self.client_info)
+
+        if not rsp.client_id or not rsp.client_secret:
+            raise ValueError("SSO response is missing clientId or clientSecret")
 
         self.client_info = rsp
         return None
@@ -217,9 +242,9 @@ def get_sso_client_id_and_secret(address: str, service: str) -> tuple:
     try:
         sso.set_sso_client(address)
     except Exception as e:
-        raise ValueError(f"get sso clientId and ClientSecret err: {e}")
+        raise ValueError(f"get sso clientId and ClientSecret err: {e}") from e
 
-    logger.debug(
-        f"ServiceName: {sso.client_info.service_name}, ClientID: {sso.client_info.client_id}, ClientSecret: {sso.client_info.client_secret}")
+    logger.debug("SSO credentials obtained for service %s, client ID %s",
+                 sso.client_info.service_name, sso.client_info.client_id)
 
     return sso.client_info.client_id, sso.client_info.client_secret

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/sso_service/sso_service.py

@@ -6,16 +6,18 @@ from typing import List, Optional, Dict, Any
 
 import httpx
 from agent_api_server.shared.request_context import outbound_headers
-from .sdk import SSOClient, get_sso_client_id_and_secret
+from .sdk import SSOClient
+from .sdk.client import normalize_sso_address
 
 logger = logging.getLogger(__name__)
 
 
 class SSOConfig:
-    def __init__(self, sso_address: str, client_id: str, client_secret: str):
-        self.sso_address = sso_address
+    def __init__(self, sso_address: str, client_id: str, client_secret: str, service_name: str = ""):
+        self.sso_address = normalize_sso_address(sso_address)
         self.client_id = client_id
         self.client_secret = client_secret
+        self.service_name = service_name
 
 
 def get_client_info_by_client_token(token: str) -> Dict[str, Any]:
@@ -60,11 +62,17 @@ class SSOService:
         self.sso_config = sso_config
         self.client_token = None
 
-        # Initialize SSOClient
-        self.sso_client = SSOClient()
-        self.sso_config.client_id, self.sso_config.client_secret = get_sso_client_id_and_secret(
-            sso_config.sso_address, ""
-        )
+        if bool(sso_config.client_id) != bool(sso_config.client_secret):
+            raise ValueError("CLIENT_ID and CLIENT_SECRET must be configured together")
+
+        self.sso_client = SSOClient(sso_config.service_name)
+        if sso_config.client_id and sso_config.client_secret:
+            self.sso_client.client_info.client_id = sso_config.client_id
+            self.sso_client.client_info.client_secret = sso_config.client_secret
+        else:
+            self.sso_client.set_sso_client(sso_config.sso_address)
+            self.sso_config.client_id = self.sso_client.client_info.client_id
+            self.sso_config.client_secret = self.sso_client.client_info.client_secret
 
     def get_client_token(self) -> Optional[str]:
         return self.client_token
@@ -172,7 +180,11 @@ class SSOService:
 
             # 获取 JSON 数据
             token_data = response.json()
-            return token_data.get("accessToken")
+            access_token = token_data.get("accessToken")
+            if not isinstance(access_token, str) or not access_token:
+                raise ValueError("SSO response is missing accessToken")
+            self.client_token = access_token
+            return access_token
 
     def get_client_id_and_secret(self) -> tuple[str, str]:
         return self.sso_config.client_id, self.sso_config.client_secret

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/agent_api_server/startup.py

@@ -93,13 +93,17 @@ class ApplicationStartup:
             credentials = ServiceHubCredentialLoader.load_credentials()
             logger.info("Credentials loaded from ServiceHub")
 
-            global_config.POSTGRES_URL = credentials.get("POSTGRES_URL", "")
-            global_config.REDIS_URL = credentials.get("REDIS_URL", "")
+            postgres_url = credentials.to_postgres_dsn()
+            redis_url = credentials.to_redis_dsn()
+            storage = credentials.get_blobstore_s3_config() if credentials.blobstore else {}
 
-            if "BLOB_ENDPOINT" in credentials:
-                global_config.STORAGE_ENDPOINT = credentials["BLOB_ENDPOINT"]
-                global_config.ACCESS_KEY = credentials.get("ACCESS_KEY", "")
-                global_config.SECRET_KEY = credentials.get("SECRET_KEY", "")
+            global_config.POSTGRES_URL = postgres_url
+            global_config.REDIS_URL = redis_url
+
+            if storage:
+                global_config.STORAGE_ENDPOINT = storage["endpoint"]
+                global_config.ACCESS_KEY = storage["access_key"]
+                global_config.SECRET_KEY = storage["secret_key"]
 
             logger.info("Credentials initialized successfully")
 

{agent_api_server-2.1.14 → agent_api_server-2.1.16}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-api-server"
-version = "2.1.14"
+version = "2.1.16"
 description = "A Langgraph agent API server that implements Langgraph agent's web capabilities and can interact with chatbot"
 authors = [
     {name = "zijie.zhang@advantech.com.cn"}