cmdbox 0.6.0.4__tar.gz → 0.6.1.1__tar.gz

{cmdbox-0.6.0.4/cmdbox.egg-info → cmdbox-0.6.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cmdbox
-Version: 0.6.0.4
+Version: 0.6.1.1
 Summary: cmdbox: It is a command line application with a plugin mechanism.
 Home-page: https://github.com/hamacom2004jp/cmdbox
 Download-URL: https://github.com/hamacom2004jp/cmdbox
@@ -351,25 +351,25 @@ audit:
 users:                         # A list of users, each of which is a map that contains the following fields.
 - uid: 1                       # An ID that identifies a user. No two users can have the same ID.
   name: admin                  # A name that identifies the user. No two users can have the same name.
-  password: XXXXXXXXXXXXXXXX   # The user's password. The value is hashed with the hash function specified in the next hash field.
+  password: XXXXX              # The user's password. The value is hashed with the hash function specified in the next hash field.
   hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2, or saml.
   groups: [admin]              # A list of groups to which the user belongs, as specified in the groups field.
   email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 or saml field.
 - uid: 101
   name: user01
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: md5
   groups: [user]
   email: user01@aaa.bbb.jp
 - uid: 102
   name: user02
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: sha1
   groups: [readonly]
   email: user02@aaa.bbb.jp
 - uid: 103
   name: user03
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: sha256
   groups: [editor]
   email: user03@aaa.bbb.jp
@@ -424,6 +424,7 @@ pathrule:                      # List of RESTAPI rules, rules that determine whe
   - groups: [user]
     paths: [/signin, /assets, /bbforce_cmd, /copyright, /dosignin, /dosignout, /password/change,
             /gui/user_data/load, /gui/user_data/save, /gui/user_data/delete,
+            /agent, /mcpsv,
             /exec_cmd, /exec_pipe, /filer, /result, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
     rule: allow
   - groups: [readonly]
@@ -451,6 +452,30 @@ password:                       # Password settings.
     enabled: true               # Specify whether or not to enable account lockout.
     threshold: 5                # Specify the number of failed login attempts before the account is locked.
     reset: 30                   # Specify the number of minutes after which the failed login count will be reset.
+apikey:
+  gen_cert:                         # Specify whether to generate a certificate for API key.
+    enabled: true                   # Specify whether to enable certificate generation for API key.
+    privatekey: idp_private.pem     # Specify the destination file for the generated private key.
+    certificate: idp_cert.pem       # Specify the destination file for the generated certificate.
+    publickey: idp_public.pem       # Specify the destination file for the generated public key.
+  gen_jwt:                          # Specify whether to generate JWT for API key.
+    enabled: true                   # Specify whether to enable JWT generation for API key.
+    privatekey: idp_private.pem     # Specify the private key file for JWT generation.
+    privatekey_passphrase:          # Specify the passphrase for the private key file.
+                                    # If the private key is encrypted, specify the passphrase here.
+    algorithm: RS256                # Specify the algorithm used to generate the JWT. The value can be RS256, PS256, or ES256.
+    claims:                         # Specify the claims to be included in the JWT.
+      iss: identity_provider        # Specify the issuer of the JWT. This is usually the name of the identity provider.
+      sub: app_user                 # Specify the subject of the JWT. This is usually the name of the application.
+      aud: app_organization         # Specify the audience of the JWT. This is usually the name of the organization that will use the application.
+      exp: 31536000                 # Specify the expiration time of the JWT in seconds. The default is 31536000 seconds (1 year).
+  verify_jwt:                       # Specify whether to verify JWT for API key.
+    enabled: true                   # Specify whether to enable JWT verification for API key.
+    certificate: idp_cert.pem       # Specify the certificate file for JWT verification.
+    publickey: idp_public.pem       # Specify the public key file for JWT verification. Not required if certificate exists.
+    issuer: identity_provider       # Specify the issuer of the JWT. This is usually the name of the identity provider. (If not specified, no verification)
+    audience: app_organization      # Specify the audience of the JWT. This is usually the name of the organization that will use the application. (If not specified, no verification)
+    algorithm: RS256                # Specify the algorithm used to verify the JWT. The value can be RS256, PS256, or ES256.
 oauth2:                             # OAuth2 settings.
   providers:                        # This is a per-provider setting for OAuth2.
     google:                         # Google's OAuth2 configuration.
@@ -512,7 +537,6 @@ saml:                               # SAML settings.
         certFingerprint: ''
         certFingerprintAlgorithm: sha1
 
-
 ```
 
 - See the documentation for references to each file.

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/README.md

@@ -327,25 +327,25 @@ audit:
 users:                         # A list of users, each of which is a map that contains the following fields.
 - uid: 1                       # An ID that identifies a user. No two users can have the same ID.
   name: admin                  # A name that identifies the user. No two users can have the same name.
-  password: XXXXXXXXXXXXXXXX   # The user's password. The value is hashed with the hash function specified in the next hash field.
+  password: XXXXX              # The user's password. The value is hashed with the hash function specified in the next hash field.
   hash: plain                  # The hash function used to hash the password, which can be plain, md5, sha1, or sha256, or oauth2, or saml.
   groups: [admin]              # A list of groups to which the user belongs, as specified in the groups field.
   email: admin@aaa.bbb.jp      # The email address of the user, used when authenticating using the provider specified in the oauth2 or saml field.
 - uid: 101
   name: user01
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: md5
   groups: [user]
   email: user01@aaa.bbb.jp
 - uid: 102
   name: user02
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: sha1
   groups: [readonly]
   email: user02@aaa.bbb.jp
 - uid: 103
   name: user03
-  password: XXXXXXXXXXXXXXXX
+  password: XXXXX
   hash: sha256
   groups: [editor]
   email: user03@aaa.bbb.jp
@@ -400,6 +400,7 @@ pathrule:                      # List of RESTAPI rules, rules that determine whe
   - groups: [user]
     paths: [/signin, /assets, /bbforce_cmd, /copyright, /dosignin, /dosignout, /password/change,
             /gui/user_data/load, /gui/user_data/save, /gui/user_data/delete,
+            /agent, /mcpsv,
             /exec_cmd, /exec_pipe, /filer, /result, /gui, /get_server_opt, /usesignout, /versions_cmdbox, /versions_used]
     rule: allow
   - groups: [readonly]
@@ -427,6 +428,30 @@ password:                       # Password settings.
     enabled: true               # Specify whether or not to enable account lockout.
     threshold: 5                # Specify the number of failed login attempts before the account is locked.
     reset: 30                   # Specify the number of minutes after which the failed login count will be reset.
+apikey:
+  gen_cert:                         # Specify whether to generate a certificate for API key.
+    enabled: true                   # Specify whether to enable certificate generation for API key.
+    privatekey: idp_private.pem     # Specify the destination file for the generated private key.
+    certificate: idp_cert.pem       # Specify the destination file for the generated certificate.
+    publickey: idp_public.pem       # Specify the destination file for the generated public key.
+  gen_jwt:                          # Specify whether to generate JWT for API key.
+    enabled: true                   # Specify whether to enable JWT generation for API key.
+    privatekey: idp_private.pem     # Specify the private key file for JWT generation.
+    privatekey_passphrase:          # Specify the passphrase for the private key file.
+                                    # If the private key is encrypted, specify the passphrase here.
+    algorithm: RS256                # Specify the algorithm used to generate the JWT. The value can be RS256, PS256, or ES256.
+    claims:                         # Specify the claims to be included in the JWT.
+      iss: identity_provider        # Specify the issuer of the JWT. This is usually the name of the identity provider.
+      sub: app_user                 # Specify the subject of the JWT. This is usually the name of the application.
+      aud: app_organization         # Specify the audience of the JWT. This is usually the name of the organization that will use the application.
+      exp: 31536000                 # Specify the expiration time of the JWT in seconds. The default is 31536000 seconds (1 year).
+  verify_jwt:                       # Specify whether to verify JWT for API key.
+    enabled: true                   # Specify whether to enable JWT verification for API key.
+    certificate: idp_cert.pem       # Specify the certificate file for JWT verification.
+    publickey: idp_public.pem       # Specify the public key file for JWT verification. Not required if certificate exists.
+    issuer: identity_provider       # Specify the issuer of the JWT. This is usually the name of the identity provider. (If not specified, no verification)
+    audience: app_organization      # Specify the audience of the JWT. This is usually the name of the organization that will use the application. (If not specified, no verification)
+    algorithm: RS256                # Specify the algorithm used to verify the JWT. The value can be RS256, PS256, or ES256.
 oauth2:                             # OAuth2 settings.
   providers:                        # This is a per-provider setting for OAuth2.
     google:                         # Google's OAuth2 configuration.
@@ -488,7 +513,6 @@ saml:                               # SAML settings.
         certFingerprint: ''
         certFingerprintAlgorithm: sha1
 
-
 ```
 
 - See the documentation for references to each file.

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/app.py

@@ -9,9 +9,9 @@ import time
 import sys
 
 
-def main(args_list:list=None):
+def main(args_list:list=None, webcall:bool=False):
     app = CmdBoxApp.getInstance(appcls=CmdBoxApp, ver=version)
-    return app.main(args_list)[0]
+    return app.main(args_list, webcall=webcall)[0]
 
 class CmdBoxApp:
     _instance = None

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/auth/azure_signin.py

@@ -13,6 +13,8 @@ class AzureSignin(Signin):
             #url='https://graph.microsoft.com/v1.0/me/transitiveMemberOf?$Top=999',
             headers={'Authorization': f'Bearer {data}'}
         )
+        if not user_info_resp.ok and user_info_resp.text:
+            raise requests.exceptions.HTTPError(user_info_resp.text, response=user_info_resp)
         user_info_resp.raise_for_status()
         user_info_json = user_info_resp.json()
         if isinstance(user_info_json, dict):
@@ -27,12 +29,14 @@ class AzureSignin(Signin):
                 'code': req.query_params['code'],
                 'scope': " ".join(conf['scope']),
                 'client_id': conf['client_id'],
-                #'client_secret': conf['client_secret'],
+                'client_secret': conf['client_secret'],
                 'redirect_uri': conf['redirect_uri'],
                 'grant_type': 'authorization_code'}
         query = '&'.join([f'{k}={urllib.parse.quote(v)}' for k, v in data.items()])
         # アクセストークン取得
         token_resp = requests.post(url=f'https://login.microsoftonline.com/{conf["tenant_id"]}/oauth2/v2.0/token', headers=headers, data=query)
+        if not token_resp.ok and token_resp.text:
+            raise requests.exceptions.HTTPError(token_resp.text, response=token_resp)
         token_resp.raise_for_status()
         token_json = token_resp.json()
         return token_json['access_token']

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/auth/signin.py

@@ -1,11 +1,16 @@
 from cmdbox.app import common, options
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.backends import default_backend
 from fastapi import Request, Response, HTTPException, WebSocket
 from fastapi.responses import RedirectResponse
 from pathlib import Path
 from typing import Dict, Any, Tuple, List, Union
+import argparse
 import copy
 import contextvars
 import logging
+import jwt
 import string
 
 
@@ -87,7 +92,7 @@ class Signin(object):
         if self.signin_file_data is None:
             return None
         if 'signin' in req.session:
-            self.signin_file_data = Signin.load_signin_file(self.signin_file, self.signin_file_data) # サインインファイルの更新をチェック
+            self.signin_file_data = Signin.load_signin_file(self.signin_file, self.signin_file_data, self=self) # サインインファイルの更新をチェック
         return Signin._check_signin(req, res, self.signin_file_data, self.logger)
     
     @classmethod
@@ -157,17 +162,37 @@ class Signin(object):
         if not auth.startswith('Bearer '):
             #self.logger.warning(f"Bearer not found. headers={req.headers}")
             return RedirectResponse(url=f'/signin{req.url.path}?error=apikeyfail')
-        bearer, apikey = auth.split(' ')
-        apikey = common.hash_password(apikey.strip(), 'sha1')
+        bearer, apikey = auth.split(' ').strip()
         if logger.level == logging.DEBUG:
-            logger.debug(f"hashed apikey: {apikey}")
+            logger.debug(f"received apikey: {apikey}")
         find_user = None
+        jwt_enabled = signin_file_data['apikey']['verify_jwt']['enabled']
         for user in signin_file_data['users']:
             if 'apikeys' not in user:
                 continue
             for ak, key in user['apikeys'].items():
                 if apikey == key:
-                    find_user = user
+                    if jwt_enabled:
+                        publickey = None
+                        if hasattr(cls, 'verify_jwt_certificate') and cls.verify_jwt_certificate is not None:
+                            publickey = cls.verify_jwt_certificate.public_key()
+                        if hasattr(cls, 'verify_jwt_publickey') and cls.verify_jwt_publickey is not None:
+                            publickey = cls.verify_jwt_publickey
+                        algorithm = signin_file_data['apikey']['verify_jwt']['algorithm']
+                        issuer = signin_file_data['apikey']['verify_jwt']['issuer']
+                        audience = signin_file_data['apikey']['verify_jwt']['audience']
+                        claims = jwt.decode(apikey, publickey, algorithms=[algorithm],
+                                            issuer=issuer, audience=audience,
+                                            options={'verify_iss': issuer is not None,
+                                                     'verify_aud': audience is not None},)
+                        find_user = dict(**claims, **user)
+                        find_user['uid'] = find_user['uid'] if 'uid' in find_user else -1
+                        find_user['name'] = find_user['name'] if 'name' in find_user else None
+                        find_user['groups'] = find_user['groups'] if 'groups' in find_user else None
+                        find_user['email'] = find_user['email'] if 'email' in find_user else None
+                        find_user['apikey_name'] = find_user['apikey_name'] if 'apikey_name' in find_user else None
+                    else:
+                        find_user = user
         if find_user is None:
             logger.warning(f"No matching user found for apikey.")
             return RedirectResponse(url=f'/signin{req.url.path}?error=apikeyfail')
@@ -196,7 +221,22 @@ class Signin(object):
         return RedirectResponse(url=f'/signin{req.url.path}?error=unauthorizedsite')
 
     @classmethod
-    def load_signin_file(cls, signin_file:Path, signin_file_data:Dict[str, Any]=None) -> Dict[str, Any]:
+    def load_pem_private_key(cls, data:bytes, passphrase:str=None):
+        return serialization.load_pem_private_key(
+            data,
+            password=passphrase.encode('utf-8') if passphrase else None,
+            backend=default_backend())
+
+    @classmethod
+    def load_pem_public_key(cls, data:bytes):
+        return serialization.load_pem_public_key(data, backend=default_backend())
+
+    @classmethod
+    def load_pem_x509_certificate(cls, data:bytes):
+        return x509.load_pem_x509_certificate(data, backend=default_backend())
+
+    @classmethod
+    def load_signin_file(cls, signin_file:Path, signin_file_data:Dict[str, Any]=None, self=None) -> Dict[str, Any]:
         """
         サインインファイルを読み込む
 
@@ -390,6 +430,90 @@ class Signin(object):
                 raise HTTPException(status_code=500, detail=f'signin_file format error. "reset" not found in "password.lockout". ({signin_file})')
             if type(yml['password']['lockout']['reset']) is not int:
                 raise HTTPException(status_code=500, detail=f'signin_file format error. "reset" not int type in "password.lockout". ({signin_file})')
+        # apikeyのフォーマットチェック
+        if 'apikey' not in yml:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "apikey" not found. ({signin_file})')
+        if 'gen_cert' not in yml['apikey']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "gen_cert" not found in "apikey". ({signin_file})')
+        if 'enabled' not in yml['apikey']['gen_cert']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not found in "apikey.gen_cert". ({signin_file})')
+        if type(yml['apikey']['gen_cert']['enabled']) is not bool:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not bool type in "apikey.gen_cert". ({signin_file})')
+        if yml['apikey']['gen_cert']['enabled']:
+            if 'privatekey' not in yml['apikey']['gen_cert']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "privatekey" not found in "apikey.gen_cert". ({signin_file})')
+            if 'certificate' not in yml['apikey']['gen_cert']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "certificate" not found in "apikey.gen_cert". ({signin_file})')
+            if 'publickey' not in yml['apikey']['gen_cert']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "publickey" not found in "apikey.gen_cert". ({signin_file})')
+            if not Path(yml['apikey']['gen_cert']['certificate']).is_file():
+                from cmdbox.app.features.cli.cmdbox_web_gencert import WebGencert
+                gencert = WebGencert(self.appcls, self.ver)
+                opt = dict(webhost=self.ver.__appid__, overwrite=True,
+                           output_cert=yml['apikey']['gen_cert']['certificate'], output_cert_format='PEM',
+                           output_pkey=yml['apikey']['gen_cert']['publickey'], output_pkey_format='PEM',
+                           output_key=yml['apikey']['gen_cert']['privatekey'], output_key_format='PEM',)
+                args = argparse.Namespace(**opt)
+                status, res, _ = gencert.apprun(self.logger, args, 0, [])
+                if status != 0:
+                    raise HTTPException(status_code=500, detail=f'signin_file format error. "gen_cert" generate error in "apikey.gen_cert". ({signin_file}) {res}')
+        if 'gen_jwt' not in yml['apikey']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "gen_jwt" not found in "apikey". ({signin_file})')
+        if 'enabled' not in yml['apikey']['gen_jwt']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not found in "apikey.gen_jwt". ({signin_file})')
+        if type(yml['apikey']['gen_jwt']['enabled']) is not bool:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not bool type in "apikey.gen_jwt". ({signin_file})')
+        if yml['apikey']['gen_jwt']['enabled']:
+            if 'privatekey' not in yml['apikey']['gen_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "privatekey" not found in "apikey.gen_jwt". ({signin_file})')
+            if 'privatekey_passphrase' not in yml['apikey']['gen_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "privatekey_passphrase" not found in "apikey.gen_jwt". ({signin_file})')
+            if not Path(yml['apikey']['gen_jwt']['privatekey']).is_file():
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "privatekey" file not found in "apikey.gen_jwt". ({signin_file})')
+            with open(yml['apikey']['gen_jwt']['privatekey'], 'rb') as f:
+                cls.gen_jwt_privatekey = cls.load_pem_private_key(f.read(), yml['apikey']['gen_jwt'].get('privatekey_passphrase', None))
+            if 'algorithm' not in yml['apikey']['gen_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "algorithm" not found in "apikey.gen_jwt". ({signin_file})')
+            cls.gen_jwt_algorithm = yml['apikey']['gen_jwt']['algorithm']
+            if 'claims' not in yml['apikey']['gen_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "claims" not found in "apikey.gen_jwt". ({signin_file})')
+            cls.gen_jwt_claims = yml['apikey']['gen_jwt']['claims'].copy()
+            if type(yml['apikey']['gen_jwt']['claims']) is not dict:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "claims" not dict type in "apikey.gen_jwt". ({signin_file})')
+        if 'verify_jwt' not in yml['apikey']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "verify_jwt" not found in "apikey". ({signin_file})')
+        if 'enabled' not in yml['apikey']['verify_jwt']:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not found in "apikey.verify_jwt". ({signin_file})')
+        if type(yml['apikey']['verify_jwt']['enabled']) is not bool:
+            raise HTTPException(status_code=500, detail=f'signin_file format error. "enabled" not bool type in "apikey.verify_jwt". ({signin_file})')
+        if yml['apikey']['verify_jwt']['enabled']:
+            if 'certificate' not in yml['apikey']['verify_jwt']:
+                if 'publickey' not in yml['apikey']['verify_jwt']:
+                    raise HTTPException(status_code=500, detail=f'signin_file format error. "certificate" or "publickey" not found in "apikey.verify_jwt". ({signin_file})')
+                if not Path(yml['apikey']['verify_jwt']['publickey']).is_file():
+                    raise HTTPException(status_code=500, detail=f'signin_file format error. "publickey" file not found in "apikey.verify_jwt". ({signin_file})')
+                with open(yml['apikey']['verify_jwt']['publickey'], 'rb') as f:
+                    cls.verify_jwt_publickey_str = f.read()
+                    cls.verify_jwt_publickey = cls.load_pem_public_key(cls.verify_jwt_publickey_str)
+                    cls.verify_jwt_publickey_str = cls.verify_jwt_publickey_str.decode('utf-8')
+            else:
+                if not Path(yml['apikey']['verify_jwt']['certificate']).is_file():
+                    raise HTTPException(status_code=500, detail=f'signin_file format error. "certificate" file not found in "apikey.verify_jwt". ({signin_file})')
+                with open(yml['apikey']['verify_jwt']['certificate'], 'rb') as f:
+                    cls.verify_jwt_certificate = cls.load_pem_x509_certificate(f.read())
+                    cls.verify_jwt_publickey = cls.verify_jwt_certificate.public_key()
+                    cls.verify_jwt_publickey_str = cls.verify_jwt_publickey.public_bytes(
+                        encoding=serialization.Encoding.PEM,
+                        format=serialization.PublicFormat.SubjectPublicKeyInfo).decode('utf-8')
+            if 'issuer' not in yml['apikey']['verify_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "issuer" not found in "apikey.verify_jwt". ({signin_file})')
+            cls.verify_jwt_issuer = yml['apikey']['verify_jwt']['issuer']
+            if 'audience' not in yml['apikey']['verify_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "audience" not found in "apikey.verify_jwt". ({signin_file})')
+            cls.verify_jwt_audience = yml['apikey']['verify_jwt']['audience']
+            if 'algorithm' not in yml['apikey']['verify_jwt']:
+                raise HTTPException(status_code=500, detail=f'signin_file format error. "algorithm" not found in "apikey.verify_jwt". ({signin_file})')
+            cls.verify_jwt_algorithm = yml['apikey']['verify_jwt']['algorithm']
         # oauth2のフォーマットチェック
         if 'oauth2' not in yml:
             raise HTTPException(status_code=500, detail=f'signin_file format error. "oauth2" not found. ({signin_file})')
@@ -485,7 +609,7 @@ class Signin(object):
             group_names (List[str]): グループ名リスト
             master_groups (List[Dict[str, Any]], optional): 親グループ名. Defaults to None.
         """
-        copy_signin_data = copy.deepcopy(signin_file_data)
+        copy_signin_data = copy.deepcopy(dict(groups=signin_file_data['groups']))
         master_groups = copy_signin_data['groups'] if master_groups is None else master_groups
         gns = []
         for gn in group_names.copy():
@@ -788,16 +912,12 @@ async def create_request_scope(req:Request=None, res:Response=None, websocket:We
     これは、FastAPIのDependsで使用されることを意図しています。
     次のように使用します。
 
-    Example:
-
-        ::
+    from cmdbox.app.auth import signin
+    from fastapi import Depends, Request, Response
 
-        from cmdbox.app.auth import signin
-        from fastapi import Depends, Request, Response
-
-        @app.get("/some-endpoint")
-        async def some_endpoint(req: Request, res: Response, scope=Depends(signin.create_request_scope)):
-            # 何らかの処理
+    @app.get("/some-endpoint")
+    async def some_endpoint(req: Request, res: Response, scope=Depends(signin.create_request_scope)):
+        pass
 
     Args:
         req (Request): リクエスト
@@ -818,18 +938,14 @@ def get_request_scope() -> Dict[str, Any]:
     """
     FastAPIのDepends用に、ContextVarからリクエストスコープを取得します。
 
-    Example:
-
-        ::
-
-        from cmdbox.app.auth import signin
-        from fastapi import Request, Response
-        scope = signin.get_request_scope()
-        scope['req']  # Requestオブジェクト
-        scope['res']  # Responseオブジェクト
-        scope['session']  # sessionを表す辞書
-        scope['websocket']  # WebSocket接続
-        scope['logger']  # loggerオブジェクト
+    from cmdbox.app.auth import signin
+    from fastapi import Request, Response
+    scope = signin.get_request_scope()
+    scope['req']  # Requestオブジェクト
+    scope['res']  # Responseオブジェクト
+    scope['session']  # sessionを表す辞書
+    scope['websocket']  # WebSocket接続
+    scope['logger']  # loggerオブジェクト
 
     Returns:
         Dict[str, Any]: リクエストとレスポンスとWebSocket接続

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/common.py

@@ -93,7 +93,33 @@ def save_yml(yml_path:Path, data:dict) -> None:
     with open(yml_path, 'w') as f:
         yaml.dump(data, f, default_flow_style=False, sort_keys=False)
 
-def reset_logger(name:str, stderr:bool=False, fmt:str='[%(asctime)s] %(levelname)s - %(message)s', datefmt:str='%Y-%m-%d %H:%M:%S') -> None:
+class CommonValue:
+    _map = dict()
+
+def set_common_value(key:str, value:Any) -> None:
+    """
+    共通の値を設定します。
+
+    Args:
+        key (str): キー
+        value (Any): 値
+    """
+    CommonValue._map[key] = value
+
+def get_common_value(key:str, default:Any=None) -> Any:
+    """
+    共通の値を取得します。
+
+    Args:
+        key (str): キー
+        default (Any, optional): デフォルト値. Defaults to None.
+
+    Returns:
+        Any: 取得した値。存在しない場合はdefault値を返します。
+    """
+    return CommonValue._map.get(key, default)
+
+def reset_logger(name:str, stderr:bool=False, fmt:str='[%(asctime)s] %(levelname)s - %(message)s', datefmt:str='%Y-%m-%d %H:%M:%S', level:int=logging.INFO) -> None:
     """
     指定されたロガーのハンドラをクリアし、新しいハンドラを追加します。
     Args:
@@ -101,13 +127,21 @@ def reset_logger(name:str, stderr:bool=False, fmt:str='[%(asctime)s] %(levelname
         stderr (bool, optional): 標準エラー出力を使用するかどうか. Defaults to False.
         fmt (str, optional): ログフォーマット. Defaults to '[%(asctime)s] %(levelname)s - %(message)s'.
         datefmt (str, optional): 日時フォーマット. Defaults to '%Y-%m-%d %H:%M:%S'.
+        level (int, optional): ログレベル. Defaults to logging.INFO.
     """
     logger = logging.getLogger(name)
     logger.handlers.clear()
     logger.propagate = False
-    logger.addHandler(create_log_handler(stderr, fmt, datefmt))
+    logger.setLevel(level)
+    logger.addHandler(create_log_handler(stderr, fmt, datefmt, level))
+    if get_common_value('webcall', False):
+        # webcallの場合はStreamHandlerを削除
+        for handler in logger.handlers:
+            hc = handler.__class__
+            if issubclass(hc, logging.StreamHandler) and not issubclass(hc, logging.FileHandler):
+                logger.removeHandler(handler)
 
-def create_log_handler(stderr:bool=False, fmt:str='[%(asctime)s] %(levelname)s - %(message)s', datefmt:str='%Y-%m-%d %H:%M:%S') -> logging.Handler:
+def create_log_handler(stderr:bool=False, fmt:str='[%(asctime)s] %(levelname)s - %(message)s', datefmt:str='%Y-%m-%d %H:%M:%S', level:int=logging.INFO) -> logging.Handler:
     """
     ログハンドラを生成します。
 
@@ -123,6 +157,7 @@ def create_log_handler(stderr:bool=False, fmt:str='[%(asctime)s] %(levelname)s -
     #                      tracebacks_word_wrap=False, log_time_format='[%Y-%m-%d %H:%M]')
     handler = loghandler.ColorfulStreamHandler(sys.stdout if not stderr else sys.stderr)
     handler.setFormatter(formatter)
+    handler.setLevel(level)
     return handler
 
 def create_console(stderr:bool=False, file=None) -> Console:
@@ -155,6 +190,7 @@ def default_logger(debug:bool=False, ver=version, webcall:bool=False) -> logging
         logging.Logger: ロガー
     """
     logger = logging.getLogger(ver.__appid__)
+    set_common_value('webcall', webcall)
     if not webcall:
         handler = create_log_handler()
         handler.setLevel(logging.DEBUG if debug else logging.INFO)
@@ -199,6 +235,7 @@ def load_config(mode:str, debug:bool=False, data=HOME_DIR, webcall:bool=False, v
     with open(log_conf_path) as f:
         log_config = yaml.safe_load(f)
     std_key = None
+    set_common_value('webcall', webcall)
     for k, h in log_config['handlers'].items():
         if 'filename' in h:
             h['filename'] = data / h['filename']

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/edge.py

@@ -450,7 +450,7 @@ class Edge(object):
 
             status, res, headers = self.site_request(self.session.post, "/dosignin/gui", data=dict(name=user, password=password), ok_status=[200, 307])
             if status != 0 or headers.get('signin') is None:
-                return 1, dict(warn=f"Signin failed.")
+                return 1, dict(warn=f"Signin failed.", headers=headers)
             status, self.user_info = self.load_user_info()
             self.user_info['auth_type'] = auth_type
             self.user_info['password'] = password

{cmdbox-0.6.0.4 → cmdbox-0.6.1.1}/cmdbox/app/edge_tool.py

@@ -56,7 +56,7 @@ class Tool(object):
         """
         self.session = session
         self.svcert_no_verify = svcert_no_verify
-        self.endpoint = endpoint
+        self.endpoint = endpoint.rstrip('/')
         self.icon_path = icon_path
         self.user = user_info
         self.oauth2 = oauth2

cmdbox-0.6.1.1/cmdbox/app/features/cli/agent_base.py

@@ -0,0 +1,87 @@
+from cmdbox.app import common, feature, mcp
+from cmdbox.app.options import Options
+
+
+class AgentBase(feature.ResultEdgeFeature):
+
+    def get_option(self):
+        """
+        この機能のオプションを返します
+
+        Returns:
+            Dict[str, Any]: オプション
+        """
+        return dict(
+            use_redis=self.USE_REDIS_FALSE, nouse_webmode=False, use_agent=True,
+            discription_ja="-",
+            discription_en="-",
+            choice=[
+                dict(opt="agent", type=Options.T_STR, default="no", required=False, multi=False, hide=False, choice=["no", "use"],
+                     discription_ja="エージェントを使用するかどうかを指定します。",
+                     discription_en="Specifies whether the agent is used.",
+                     choice_show=dict(use=["agent_name", "agent_description", "agent_instruction", "agent_session_store", "llmprov",],)),
+                dict(opt="agent_name", type=Options.T_STR, default=self.ver.__appid__, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="エージェント名を指定します。",
+                     discription_en="Specifies the agent name."),
+                dict(opt="agent_description", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="エージェントの説明を指定します。",
+                     discription_en="Specify agent description."),
+                dict(opt="agent_instruction", type=Options.T_TEXT, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="エージェントのシステム指示を指定します。",
+                     discription_en="Specifies the agent's system instructions."),
+                dict(opt="agent_session_store", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=['memory', 'sqlite', 'postgresql'],
+                     discription_ja="エージェントのセッションを保存する方法を指定します。",
+                     discription_en="Specify how the agent's session is to be saved.",
+                     choice_show=dict(postgresql=["agent_pg_host", "agent_pg_port", "agent_pg_user", "agent_pg_password", "agent_pg_dbname"]),),
+                dict(opt="agent_pg_host", type=Options.T_STR, default='localhost', required=False, multi=False, hide=False, choice=None, web="mask",
+                     discription_ja="postgresqlホストを指定する。",
+                     discription_en="Specify the postgresql host."),
+                dict(opt="agent_pg_port", type=Options.T_INT, default=5432, required=False, multi=False, hide=False, choice=None, web="mask",
+                     discription_ja="postgresqlのポートを指定する。",
+                     discription_en="Specify the postgresql port."),
+                dict(opt="agent_pg_user", type=Options.T_STR, default='postgres', required=False, multi=False, hide=False, choice=None, web="mask",
+                     discription_ja="postgresqlのユーザー名を指定する。",
+                     discription_en="Specify the postgresql user name."),
+                dict(opt="agent_pg_password", type=Options.T_STR, default='postgres', required=False, multi=False, hide=False, choice=None, web="mask",
+                     discription_ja="postgresqlのパスワードを指定する。",
+                     discription_en="Specify the postgresql password."),
+                dict(opt="agent_pg_dbname", type=Options.T_STR, default='agent', required=False, multi=False, hide=False, choice=None,
+                     discription_ja="postgresqlデータベース名を指定します。",
+                     discription_en="Specify the postgresql database name."),
+                dict(opt="llmprov", type=Options.T_STR, default=None, required=False, multi=False, hide=False,
+                     choice=["", "azureopenai", "openai", "vertexai", "ollama"],
+                     discription_ja="llmのプロバイダを指定します。",
+                     discription_en="Specify llm provider.",
+                     choice_show=dict(azureopenai=["llmapikey", "llmendpoint", "llmmodel", "llmapiversion"],
+                                      openai=["llmapikey", "llmendpoint", "llmmodel"],
+                                      vertexai=["llmprojectid", "llmsvaccountfile", "llmlocation", "llmmodel", "llmseed", "llmtemperature"],
+                                      ollama=["llmendpoint", "llmmodel", "llmtemperature"],),
+                     ),
+                dict(opt="llmprojectid", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのプロジェクトIDを指定します。",
+                     discription_en="Specify the project ID for llm's provider connection."),
+                dict(opt="llmsvaccountfile", type=Options.T_FILE, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのサービスアカウントファイルを指定します。",
+                     discription_en="Specifies the service account file for llm's provider connection."),
+                dict(opt="llmlocation", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのロケーションを指定します。",
+                     discription_en="Specifies the location for llm provider connections."),
+                dict(opt="llmapikey", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのAPIキーを指定します。",
+                     discription_en="Specify API key for llm provider connection."),
+                dict(opt="llmapiversion", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのAPIバージョンを指定します。",
+                     discription_en="Specifies the API version for llm provider connections."),
+                dict(opt="llmendpoint", type=Options.T_STR, default=None, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのプロバイダ接続のためのエンドポイントを指定します。",
+                     discription_en="Specifies the endpoint for llm provider connections."),
+                dict(opt="llmmodel", type=Options.T_STR, default="text-multilingual-embedding-002", required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmモデルを指定します。",
+                     discription_en="Specifies the llm model."),
+                dict(opt="llmseed", type=Options.T_INT, default=13, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmモデルを使用するときのシード値を指定します。",
+                     discription_en="Specifies the seed value when using llm model."),
+                dict(opt="llmtemperature", type=Options.T_FLOAT, default=0.1, required=False, multi=False, hide=False, choice=None,
+                     discription_ja="llmのモデルを使用するときのtemperatureを指定します。",
+                     discription_en="Specifies the temperature when using llm model."),
+            ])