cmdbox 0.6.0.4__py3-none-any.whl → 0.6.1.1__py3-none-any.whl

cmdbox/app/mcp.py

@@ -0,0 +1,375 @@
+from cmdbox.app import common, options
+from cmdbox.app.options import Options
+from cmdbox.app.auth import signin
+from pathlib import Path
+from typing import Callable, List, Dict, Any, Tuple
+import argparse
+import logging
+import locale
+import json
+import time
+import re
+import os
+
+
+class Mcp:
+    default_host:str = os.environ.get('REDIS_HOST', 'localhost')
+    default_port:int = int(os.environ.get('REDIS_PORT', '6379'))
+    default_pass:str = os.environ.get('REDIS_PASSWORD', 'password')
+    default_svname:str = os.environ.get('SVNAME', 'server')
+
+    def __init__(self, logger:logging.Logger, data:Path, sign:signin.Signin, appcls=None, ver=None,):
+        """
+        MCP (Multi-Channel Protocol) クラスの初期化
+
+        Args:
+            logger (logging.Logger): ロガー
+            data (Path): データのパス
+            sign (signin.Signin): サインインオブジェクト
+            appcls (type, optional): アプリケーションクラス. Defaults to None.
+            ver (module, optional): バージョンモジュール. Defaults to None.
+        """
+        self.logger = logger
+        self.data = data
+        self.appcls = appcls
+        self.ver = ver
+        self.signin = sign
+
+    def create_mcpserver(self, args:argparse.Namespace) -> Any:
+        """
+        mcpserverを作成します
+
+        Args:
+            args (argparse.Namespace): 引数
+
+        Returns:
+            Any: FastMCP
+        """
+        from fastmcp import FastMCP
+        from fastmcp.server.auth import BearerAuthProvider
+        cls = self.signin.__class__
+        publickey_str = cls.verify_jwt_publickey_str if hasattr(cls, 'verify_jwt_publickey_str') else None
+        issuer = cls.verify_jwt_issuer if hasattr(cls, 'verify_jwt_issuer') else None
+        audience = cls.verify_jwt_audience if hasattr(cls, 'verify_jwt_audience') else None
+        if publickey_str is not None and issuer is not None and audience is not None:
+            self.logger.info(f"Using BearerAuthProvider with public key, issuer: {issuer}, audience: {audience}")
+            auth = BearerAuthProvider(
+                public_key=publickey_str,
+                issuer=issuer,
+                audience=audience
+            )
+            mcp = FastMCP(name=self.ver.__appid__, auth=auth)
+        else:
+            self.logger.info(f"Using BearerAuthProvider without public key, issuer, or audience.")
+            mcp = FastMCP(name=self.ver.__appid__)
+        return mcp
+
+    def create_session_service(self, args:argparse.Namespace) -> Any:
+        """
+        セッションサービスを作成します
+
+        Args:
+            args (argparse.Namespace): 引数
+
+        Returns:
+            BaseSessionService: セッションサービス
+        """
+        from google.adk.events import Event
+        from google.adk.sessions import DatabaseSessionService, InMemorySessionService, session
+        from typing_extensions import override
+        if hasattr(args, 'agent_session_dburl') and args.agent_session_dburl is not None:
+            class _DatabaseSessionService(DatabaseSessionService):
+                @override
+                async def append_event(self, session: session.Session, event: Event) -> Event:
+                    # 永続化されるセッションには <important> タグを含めない
+                    bk_parts = event.content.parts.copy()
+                    for part in event.content.parts:
+                        if not part.text: continue
+                        part.text = re.sub(r"<important>.*</important>", "", part.text)
+                    for part in bk_parts:
+                        if not part.text: continue
+                        part.text = part.text.replace("<important>", "").replace("</important>", "")
+                    ret = await super().append_event(session, event)
+                    ret.content.parts = bk_parts
+                    return ret
+            dss = _DatabaseSessionService(db_url=args.agent_session_dburl)
+            #dss.db_engine.echo = True
+            return dss
+        else:
+            return InMemorySessionService()
+
+    def create_agent(self, logger:logging.Logger, args:argparse.Namespace, tools:List[Callable]) -> Any:
+        """
+        エージェントを作成します
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+            tools (List[Callable]): 関数
+
+        Returns:
+            Agent: エージェント
+        """
+        if logger.level == logging.DEBUG:
+            logger.debug(f"create_agent processing..")
+        language, _ = locale.getlocale()
+        is_japan = language.find('Japan') >= 0 or language.find('ja_JP') >= 0
+        description = f"{self.ver.__appid__}に登録されているコマンド提供"
+        instruction = f"あなたはコマンドの意味を熟知しているエキスパートです。" + \
+                      f"ユーザーがコマンドを実行したいとき、あなたは以下の手順に従ってコマンドを確実に実行してください。\n" + \
+                      f"1. ユーザーのクエリからが実行したいコマンドを特定します。\n" + \
+                      f"2. コマンド実行に必要なパラメータのなかで、ユーザーのクエリから取得できないものは、コマンド定義にあるデフォルト値を指定して実行してください。\n" + \
+                      f"3. もしエラーが発生した場合は、ユーザーにコマンド名とパラメータとエラー内容を提示してください。\n"
+
+        description = description if is_japan else \
+                      f"Command offer registered in {self.ver.__appid__}."
+        instruction = instruction if is_japan else \
+                      f"You are the expert who knows what the commands mean." + \
+                      f"When a user wants to execute a command, you follow these steps to ensure that the command is executed.\n" + \
+                      f"1. Identify the command you want to execute from the user's query.\n" + \
+                      f"2. Any parameters required to execute the command that cannot be obtained from the user's query should be executed with the default values provided in the command definition.\n" + \
+                      f"3. If an error occurs, provide the user with the command name, parameters, and error description.\n"
+
+        description = args.agent_description if args.agent_description else description
+        instruction = args.agent_instruction if args.agent_instruction else instruction
+        if logger.level == logging.DEBUG:
+            logger.debug(f"google-adk loading..")
+        from google.adk.agents import Agent
+        if logger.level == logging.DEBUG:
+            logger.debug(f"litellm loading..")
+        from google.adk.models.lite_llm import LiteLlm
+        # loggerの初期化
+        common.reset_logger("LiteLLM Proxy")
+        common.reset_logger("LiteLLM Router")
+        common.reset_logger("LiteLLM")
+        if args.llmprov == 'openai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmapikey is None: raise ValueError("llmapikey is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    api_key=args.llmapikey,
+                    endpoint=args.llmendpoint,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'azureopenai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmendpoint is None: raise ValueError("llmendpoint is required.")
+            if args.llmapikey is None: raise ValueError("llmapikey is required.")
+            if args.llmapiversion is None: raise ValueError("llmapiversion is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    api_key=args.llmapikey,
+                    endpoint=args.llmendpoint,
+                    api_version=args.llmapiversion,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'vertexai':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmlocation is None: raise ValueError("llmlocation is required.")
+            if args.llmsvaccountfile is not None: 
+                with open(args.llmsvaccountfile, "r", encoding="utf-8") as f:
+                    vertex_credentials = json.load(f)
+            elif args.llmprojectid is None: raise ValueError("llmprojectid is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=args.llmmodel,
+                    #vertex_project=args.llmprojectid,
+                    vertex_credentials=vertex_credentials,
+                    vertex_location=args.llmlocation,
+                    #seed=args.llmseed,
+                    #temperature=args.llmtemperature,
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        elif args.llmprov == 'ollama':
+            if args.llmmodel is None: raise ValueError("llmmodel is required.")
+            if args.llmendpoint is None: raise ValueError("llmendpoint is required.")
+            agent = Agent(
+                name=args.agent_name,
+                model=LiteLlm(
+                    model=f"ollama/{args.llmmodel}",
+                    api_base=args.llmendpoint,
+                    temperature=args.llmtemperature,
+                    stream=True
+                ),
+                description=description,
+                instruction=instruction,
+                tools=tools,
+            )
+        else:
+            raise ValueError("llmprov is required.")
+        if logger.level == logging.DEBUG:
+            logger.debug(f"create_agent complate.")
+        return agent
+
+    def create_runner(self, logger:logging.Logger, args:argparse.Namespace, session_service, agent) -> Any:
+        """
+        ランナーを作成します
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+            session_service (BaseSessionService): セッションサービス
+            agent (Agent): エージェント
+
+        Returns:
+            Runner: ランナー
+        """
+        from google.adk.runners import Runner
+        return Runner(
+            app_name=self.ver.__appid__,
+            agent=agent,
+            session_service=session_service,
+        )
+
+    def init_agent_runner(self, logger:logging.Logger, args:argparse.Namespace) -> Tuple[Any, Any]:
+        """
+        エージェントの初期化を行います
+
+        Args:
+            logger (logging.Logger): ロガー
+            args (argparse.Namespace): 引数
+
+        Returns:
+            Tuple[Any, Any]: ランナーとFastMCP
+        """
+        if logger.level == logging.DEBUG:
+            logger.debug(f"init_agent_runner processing..")
+        # loggerの初期化
+        common.reset_logger("httpx")
+        common.reset_logger("google_adk.google.adk.sessions.database_session_service")
+        common.reset_logger("mcp.server.streamable_http_manager")
+        # モジュールインポート
+        from fastmcp import FastMCP
+        from google.adk.sessions import BaseSessionService
+        mcp:FastMCP = self.create_mcpserver(args)
+        session_service:BaseSessionService = self.create_session_service(args)
+        options = Options.getInstance()
+        tools:Callable[[logging.Logger, argparse.Namespace, float, Dict], Tuple[int, Dict[str, Any], Any]] = []
+
+        def _ds(d:str) -> str:
+            return f'"{d}"' if d is not None else 'None'
+        def _t2s(o:Dict[str, Any], req=True) -> str:
+            t, m, d, r = o["type"], o["multi"], o["default"], o["required"]
+            if t == Options.T_BOOL: return ("List[bool]=[]" if m else f"bool={d}") if req else ("List[bool]" if m else f"bool")
+            if t == Options.T_DATE: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_DATETIME: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_DICT: return ("List[dict]=[]" if m else f"dict={d}") if req else ("List[dict]" if m else f"dict")
+            if t == Options.T_DIR or t == Options.T_FILE:
+                if d is not None: d = str(d).replace('\\', '/')
+                return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_FLOAT: return ("List[float]=[]" if m else f"float={d}") if req else ("List[float]" if m else f"float")
+            if t == Options.T_INT: return ("List[int]=[]" if m else f"int={d}") if req else ("List[int]" if m else f"int")
+            if t == Options.T_STR: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            if t == Options.T_TEXT: return ("List[str]=[]" if m else f"str={_ds(d)}") if req else ("List[str]" if m else f"str")
+            raise ValueError(f"Unknown type: {t} for option {o['opt']}")
+        def _arg(o:Dict[str, Any], is_japan) -> str:
+            t, d = o["type"], o["default"]
+            s = f'        {o["opt"]}:'
+            if t == Options.T_DIR or t == Options.T_FILE:
+                d = str(d).replace("\\", "/")
+            s += f'{_t2s(o, False)}={d}:'
+            #s += f'Optional[{_t2s(o, False)}]={d}:'
+            s += f'{o["discription_ja"] if is_japan else o["discription_en"]}'
+            return s
+        def _coercion(a:argparse.Namespace, key:str, dval) -> str:
+            dval = f'opt["{key}"] if "{key}" in opt else ' + f'"{dval}"' if isinstance(dval, str) else dval
+            aval = args.__dict__[key] if hasattr(args, key) and args.__dict__[key] else None
+            aval = f'"{aval}"' if isinstance(aval, str) else aval
+            ret = f'opt["{key}"] = {aval}' if aval is not None else f'opt["{key}"] = {dval}'
+            return ret
+        language, _ = locale.getlocale()
+        is_japan = language.find('Japan') >= 0 or language.find('ja_JP') >= 0
+        for mode in options.get_mode_keys():
+            for cmd in options.get_cmd_keys(mode):
+                if not options.get_cmd_attr(mode, cmd, 'use_agent'):
+                    continue
+                discription = options.get_cmd_attr(mode, cmd, 'discription_ja' if is_japan else 'discription_en')
+                choices = options.get_cmd_choices(mode, cmd, False)
+                if len([opt for opt in choices if 'opt' in opt and opt['opt'] == 'signin_file']) <= 0:
+                    choices.append(dict(opt="signin_file", type=Options.T_FILE, default=f'.{self.ver.__appid__}/user_list.yml', required=True, multi=False, hide=True, choice=None,
+                        discription_ja="サインイン可能なユーザーとパスワードを記載したファイルを指定します。省略した時は認証を要求しません。",
+                        discription_en="Specify a file containing users and passwords with which they can signin. If omitted, no authentication is required."),)
+                fn = f"{mode}_{cmd}"
+                func_txt  = f'def {fn}(' + ", ".join([f'{o["opt"]}:{_t2s(o, False)}' for o in choices]) + '):\n'
+                func_txt += f'    """\n'
+                func_txt += f'    {discription}\n'
+                func_txt += f'    Args:\n'
+                func_txt += "\n".join([_arg(o, is_japan) for o in choices])
+                func_txt += f'\n'
+                func_txt += f'    Returns:\n'
+                func_txt += f'        Dict[str, Any]:{"処理結果" if is_japan else "Processing Result"}\n'
+                func_txt += f'    """\n'
+                func_txt += f'    scope = signin.get_request_scope()\n'
+                func_txt += f'    logger = common.default_logger()\n'
+                func_txt += f'    opt = dict()\n'
+                func_txt += f'    opt["mode"] = "{mode}"\n'
+                func_txt += f'    opt["cmd"] = "{cmd}"\n'
+                func_txt += f'    opt["data"] = opt["data"] if hasattr(opt, "data") else common.HOME_DIR / ".{self.ver.__appid__}"\n'
+                func_txt += f'    opt["format"] = False\n'
+                func_txt += f'    opt["output_json"] = None\n'
+                func_txt += f'    opt["output_json_append"] = False\n'
+                func_txt += f'    opt["debug"] = logger.level == logging.DEBUG\n'
+                func_txt += '\n'.join([f'    opt["{o["opt"]}"] = {o["opt"]}' for o in choices])+'\n'
+                func_txt += f'    {_coercion(args, "host", self.default_host)}\n'
+                func_txt += f'    {_coercion(args, "port", self.default_port)}\n'
+                func_txt += f'    {_coercion(args, "password", self.default_pass)}\n'
+                func_txt += f'    {_coercion(args, "svname", self.default_svname)}\n'
+                func_txt += f'    {_coercion(args, "retry_count", 3)}\n'
+                func_txt += f'    {_coercion(args, "retry_interval", 3)}\n'
+                func_txt += f'    {_coercion(args, "timeout", 15)}\n'
+                func_txt += f'    {_coercion(args, "output_json", None)}\n'
+                func_txt += f'    {_coercion(args, "output_json_append", False)}\n'
+                func_txt += f'    {_coercion(args, "stdout_log", False)}\n'
+                func_txt += f'    {_coercion(args, "capture_stdout", False)}\n'
+                func_txt += f'    {_coercion(args, "capture_maxsize", 1024*1024)}\n'
+                func_txt += f'    {_coercion(args, "tag", None)}\n'
+                func_txt += f'    {_coercion(args, "clmsg_id", None)}\n'
+                func_txt += f'    opt["signin_file"] = signin_file if signin_file else ".{self.ver.__appid__}/user_list.yml"\n'
+                func_txt += f'    args = argparse.Namespace(**opt)\n'
+                func_txt += f'    signin_data = signin.Signin.load_signin_file(args.signin_file)\n'
+                func_txt += f'    req = scope["req"] if scope["req"] is not None else scope["websocket"]\n'
+                func_txt += f'    sign = signin.Signin._check_signin(req, scope["res"], signin_data, logger)\n'
+                func_txt += f'    if sign is not None:\n'
+                func_txt += f'        logger.warning("Unable to execute command because authentication information cannot be obtained")\n'
+                func_txt += f'        return dict(warn="Unable to execute command because authentication information cannot be obtained")\n'
+                func_txt += f'    groups = req.session["signin"]["groups"]\n'
+                func_txt += f'    logger.info("Call agent tool `{mode}_{cmd}`:user="+str(req.session["signin"]["name"])+" groups="+str(groups)+" args="+str(args))\n'
+                func_txt += f'    if not signin.Signin._check_cmd(signin_data, groups, "{mode}", "{cmd}", logger):\n'
+                func_txt += f'        logger.warning("You do not have permission to execute this command.")\n'
+                func_txt += f'        return dict(warn="You do not have permission to execute this command.")\n'
+                func_txt += f'    feat = Options.getInstance().get_cmd_attr("{mode}", "{cmd}", "feature")\n'
+                func_txt += f'    try:\n'
+                func_txt += f'        st, ret, _ = feat.apprun(logger, args, time.perf_counter(), [])\n'
+                func_txt += f'        return ret\n'
+                func_txt += f'    except Exception as e:\n'
+                func_txt += f'        logger.error("Error occurs when tool is executed:", exc_info=True)\n'
+                func_txt += f'        raise e\n'
+                func_txt += f'tools.append({fn})\n'
+                if logger.level == logging.DEBUG:
+                    logger.debug(f"generating agent tool: {fn}")
+
+                exec(func_txt,
+                     dict(time=time,List=List, argparse=argparse, common=common, Options=Options, logging=logging, signin=signin,),
+                     dict(tools=tools, mcp=mcp))
+                exec(f"@mcp.tool\n{func_txt}",
+                     dict(time=time,List=List, argparse=argparse, common=common, Options=Options, logging=logging, signin=signin,),
+                     dict(tools=[], mcp=mcp))
+        root_agent = self.create_agent(logger, args, tools)
+        runner = self.create_runner(logger, args, session_service, root_agent)
+        if logger.level == logging.DEBUG:
+            logger.debug(f"init_agent_runner complate.")
+        return runner, mcp

cmdbox/app/options.py

@@ -832,11 +832,13 @@ class Options:
                 if hasattr(arg, 'redis_password'): opt['password'] = arg.redis_password
                 if hasattr(arg, 'svname'): opt['svname'] = arg.svname
                 if hasattr(arg, 'clmsg_id'): opt['clmsg_id'] = arg.clmsg_id
+                if hasattr(arg, 'client_only'): opt['client_only'] = arg.client_only
             elif isinstance(arg, web.Web):
                 opt['host'] = arg.redis_host
                 opt['port'] = arg.redis_port
                 opt['password'] = arg.redis_password
                 opt['svname'] = arg.svname
+                opt['client_only'] = arg.client_only
             elif isinstance(arg, feature.Feature):
                 func_feature = arg
                 opt['clmsg_src'] = func_feature.__class__.__name__

cmdbox/app/web.py

@@ -1,5 +1,4 @@
 from cmdbox.app import common, options
-from cmdbox.app.auth import signin, signin_saml
 from cmdbox.app.commons import module
 from fastapi import FastAPI, Request, Response
 from pathlib import Path
@@ -12,6 +11,7 @@ import copy
 import ctypes
 import datetime
 import gevent
+import jwt
 import logging
 import multiprocessing
 import os
@@ -120,7 +120,8 @@ class Web:
         self.cb_queue = queue.Queue(1000)
         self.options = options.Options.getInstance()
         self.webcap_client = requests.Session()
-        signin_file_data = signin.Signin.load_signin_file(self.signin_file)
+        from cmdbox.app.auth import signin, signin_saml
+        signin_file_data = signin.Signin.load_signin_file(self.signin_file, self=self)
         self.signin = signin.Signin(self.logger, self.signin_file, signin_file_data, self.appcls, self.ver)
         self.signin_saml = signin_saml.SigninSAML(self.logger, self.signin_file, signin_file_data, self.appcls, self.ver)
 
@@ -247,7 +248,25 @@ class Web:
         for u in copy.deepcopy(signin_data['users']):
             u['password'] = '********'
             if 'apikeys' in u:
-                u['apikeys'] = dict([(ak, '********') for ak in u['apikeys']])
+                for an, ak in u['apikeys'].items():
+                    exp = '-'
+                    try:
+                        cls = self.signin.__class__
+                        publickey = None
+                        if cls.verify_jwt_certificate is not None:
+                            publickey = cls.verify_jwt_certificate.public_key()
+                        if publickey is None and cls.verify_jwt_publickey is not None:
+                            publickey = cls.verify_jwt_publickey
+                        t = jwt.decode(ak, publickey, algorithms=[cls.verify_jwt_algorithm],
+                                       issuer=cls.verify_jwt_issuer, audience=cls.verify_jwt_audience,
+                                       options={'verify_iss': cls.verify_jwt_issuer is not None,
+                                                'verify_aud': cls.verify_jwt_audience is not None})
+                        exp = datetime.datetime.fromtimestamp(t['exp']).strftime('%Y-%m-%d %H:%M:%S')
+                        u['apikeys'][an] = (ak, exp, '-')
+                    except jwt.exceptions.InvalidTokenError as e:
+                        u['apikeys'][an] = (ak, '-', str(e))
+                    except Exception as e:
+                        u['apikeys'][an] = (ak, '-', '-')
             if u['name'] == name:
                 return [u]
             signin_last = self.user_data(None, u['uid'], u['name'], 'signin', 'last_update')
@@ -289,10 +308,19 @@ class Web:
                 if user['apikey_name'] in u['apikeys']:
                     raise ValueError(f"ApiKey name is already exists. ({user})")
                 apikey = common.random_string(64)
-                u['apikeys'][user['apikey_name']] = common.hash_password(apikey, 'sha1')
+                u['apikeys'][user['apikey_name']] = apikey
+                if signin_data['apikey']['gen_jwt']['enabled']:
+                    cls = self.signin.__class__
+                    claims = cls.gen_jwt_claims.copy() if cls.gen_jwt_claims is not None else dict()
+                    claims['exp'] = int(time.time()) + int(claims.get('exp', 3600))
+                    claims['uid'] = u['uid']
+                    claims['name'] = u['name']
+                    claims['groups'] = u['groups']
+                    claims['email'] = u['email']
+                    claims['apikey_name'] = user['apikey_name']
+                    apikey = jwt.encode(claims, cls.gen_jwt_privatekey, algorithm=cls.gen_jwt_algorithm)
+                    u['apikeys'][user['apikey_name']] = apikey
 
-        if self.signin_file is None:
-            raise ValueError(f"signin_file is None.")
         if self.logger.level == logging.DEBUG:
             self.logger.debug(f"apikey_add: {user} -> {self.signin_file}")
         common.save_yml(self.signin_file, signin_data)

cmdbox/autoload.py

@@ -0,0 +1,10 @@
+from pathlib import Path
+import os
+import sys
+
+if __name__ == "__main__":
+    os.chdir(Path(__file__).resolve().parent.parent)
+    sys.path.insert(0, "")
+    from cmdbox.app import app
+    exit_code = app.main(webcall=True)
+    exit(exit_code)

cmdbox/extensions/user_list.yml

@@ -74,7 +74,7 @@ pathrule:                      # List of RESTAPI rules, rules that determine whe
   - groups: [user]
     paths: [/signin, /assets, /bbforce_cmd, /copyright, /dosignin, /dosignout, /password/change,
             /gui/user_data/load, /gui/user_data/save, /gui/user_data/delete,
-            /agent, /mcp,
+            /agent, /mcpsv,
             /exec_cmd, /exec_pipe, /filer, /result, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
     rule: allow
   - groups: [readonly]
@@ -102,6 +102,30 @@ password:                       # Password settings.
     enabled: true               # Specify whether or not to enable account lockout.
     threshold: 5                # Specify the number of failed login attempts before the account is locked.
     reset: 30                   # Specify the number of minutes after which the failed login count will be reset.
+apikey:
+  gen_cert:                         # Specify whether to generate a certificate for API key.
+    enabled: true                   # Specify whether to enable certificate generation for API key.
+    privatekey: idp_private.pem     # Specify the destination file for the generated private key.
+    certificate: idp_cert.pem       # Specify the destination file for the generated certificate.
+    publickey: idp_public.pem       # Specify the destination file for the generated public key.
+  gen_jwt:                          # Specify whether to generate JWT for API key.
+    enabled: true                   # Specify whether to enable JWT generation for API key.
+    privatekey: idp_private.pem     # Specify the private key file for JWT generation.
+    privatekey_passphrase:          # Specify the passphrase for the private key file.
+                                    # If the private key is encrypted, specify the passphrase here.
+    algorithm: RS256                # Specify the algorithm used to generate the JWT. The value can be RS256, PS256, or ES256.
+    claims:                         # Specify the claims to be included in the JWT.
+      iss: identity_provider        # Specify the issuer of the JWT. This is usually the name of the identity provider.
+      sub: app_user                 # Specify the subject of the JWT. This is usually the name of the application.
+      aud: app_organization         # Specify the audience of the JWT. This is usually the name of the organization that will use the application.
+      exp: 31536000                 # Specify the expiration time of the JWT in seconds. The default is 31536000 seconds (1 year).
+  verify_jwt:                       # Specify whether to verify JWT for API key.
+    enabled: true                   # Specify whether to enable JWT verification for API key.
+    certificate: idp_cert.pem       # Specify the certificate file for JWT verification.
+    publickey: idp_public.pem       # Specify the public key file for JWT verification. Not required if certificate exists.
+    issuer: identity_provider       # Specify the issuer of the JWT. This is usually the name of the identity provider. (If not specified, no verification)
+    audience: app_organization      # Specify the audience of the JWT. This is usually the name of the organization that will use the application. (If not specified, no verification)
+    algorithm: RS256                # Specify the algorithm used to verify the JWT. The value can be RS256, PS256, or ES256.
 oauth2:                             # OAuth2 settings.
   providers:                        # This is a per-provider setting for OAuth2.
     google:                         # Google's OAuth2 configuration.

cmdbox/licenses/{LICENSE.Deprecated.1.2.18(MIT License).txt → LICENSE_PyJWT_2_10_1_MIT_License.txt}

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2017 Laurent LAPORTE
+Copyright (c) 2015-2022 José Padilla
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

cmdbox/licenses/LICENSE_exceptiongroup_1_3_0_MIT_License.txt

@@ -0,0 +1,73 @@
+The MIT License (MIT)
+
+Copyright (c) 2022 Alex Grönholm
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+This project contains code copied from the Python standard library.
+The following is the required license notice for those parts.
+
+PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
+--------------------------------------------
+
+1. This LICENSE AGREEMENT is between the Python Software Foundation
+("PSF"), and the Individual or Organization ("Licensee") accessing and
+otherwise using this software ("Python") in source or binary form and
+its associated documentation.
+
+2. Subject to the terms and conditions of this License Agreement, PSF hereby
+grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,
+analyze, test, perform and/or display publicly, prepare derivative works,
+distribute, and otherwise use Python alone or in any derivative version,
+provided, however, that PSF's License Agreement and PSF's notice of copyright,
+i.e., "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022 Python Software Foundation;
+All Rights Reserved" are retained in Python alone or in any derivative version
+prepared by Licensee.
+
+3. In the event Licensee prepares a derivative work that is based on
+or incorporates Python or any part thereof, and wants to make
+the derivative work available to others as provided herein, then
+Licensee hereby agrees to include in any such work a brief summary of
+the changes made to Python.
+
+4. PSF is making Python available to Licensee on an "AS IS"
+basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
+FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
+A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
+OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+6. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+7. Nothing in this License Agreement shall be deemed to create any
+relationship of agency, partnership, or joint venture between PSF and
+Licensee.  This License Agreement does not grant permission to use PSF
+trademarks or trade name in a trademark sense to endorse or promote
+products or services of Licensee, or any third party.
+
+8. By copying, installing or otherwise using Python, Licensee
+agrees to be bound by the terms and conditions of this License
+Agreement.