codecortex 0.3.0__tar.gz → 0.5.0__tar.gz

{codecortex-0.3.0/src/codecortex.egg-info → codecortex-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.3.0
+Version: 0.5.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,10 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
+| `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
+| `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
+| `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
 
@@ -273,6 +278,25 @@ if result["result"] is not None:
 
 The response is always JSON-safe. Check `result["result"] is not None` before use. Never catch an exception from the gateway — it never raises.
 
+## Operations & deployment
+
+Running codeintel as a shared service? It ships with what ops teams expect:
+
+| Endpoint | Auth | Purpose |
+|---|---|---|
+| `GET /healthz` | none | Liveness — always `200` (for load balancers / `livenessProbe`) |
+| `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
+| `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
+
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
+
+```bash
+docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
+  -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
+```
+
 ## Development
 
 ```bash

{codecortex-0.3.0 → codecortex-0.5.0}/README.md

@@ -156,6 +156,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -180,6 +181,10 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
+| `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
+| `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
+| `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
 
@@ -240,6 +245,25 @@ if result["result"] is not None:
 
 The response is always JSON-safe. Check `result["result"] is not None` before use. Never catch an exception from the gateway — it never raises.
 
+## Operations & deployment
+
+Running codeintel as a shared service? It ships with what ops teams expect:
+
+| Endpoint | Auth | Purpose |
+|---|---|---|
+| `GET /healthz` | none | Liveness — always `200` (for load balancers / `livenessProbe`) |
+| `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
+| `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
+
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
+
+```bash
+docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
+  -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
+```
+
 ## Development
 
 ```bash

{codecortex-0.3.0 → codecortex-0.5.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.3.0
+Version: 0.5.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,10 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
+| `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
+| `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
+| `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
 
@@ -273,6 +278,25 @@ if result["result"] is not None:
 
 The response is always JSON-safe. Check `result["result"] is not None` before use. Never catch an exception from the gateway — it never raises.
 
+## Operations & deployment
+
+Running codeintel as a shared service? It ships with what ops teams expect:
+
+| Endpoint | Auth | Purpose |
+|---|---|---|
+| `GET /healthz` | none | Liveness — always `200` (for load balancers / `livenessProbe`) |
+| `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
+| `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
+
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
+
+```bash
+docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
+  -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
+```
+
 ## Development
 
 ```bash

{codecortex-0.3.0 → codecortex-0.5.0}/src/codecortex.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ src/codecortex.egg-info/requires.txt
 src/codecortex.egg-info/top_level.txt
 src/codeintel/__init__.py
 src/codeintel/__main__.py
+src/codeintel/auth.py
 src/codeintel/cache.py
 src/codeintel/config.py
 src/codeintel/doctor.py
@@ -17,7 +18,9 @@ src/codeintel/http_server.py
 src/codeintel/indexer.py
 src/codeintel/injector.py
 src/codeintel/installer.py
+src/codeintel/logconfig.py
 src/codeintel/mapper.py
+src/codeintel/metrics.py
 src/codeintel/onboarding.py
 src/codeintel/policy.py
 src/codeintel/provider.py
@@ -36,6 +39,7 @@ tests/test_cache.py
 tests/test_config.py
 tests/test_doctor.py
 tests/test_e2e.py
+tests/test_enterprise.py
 tests/test_gateway.py
 tests/test_graph_provider.py
 tests/test_graph_real.py
@@ -49,6 +53,7 @@ tests/test_lsp_real.py
 tests/test_mapper.py
 tests/test_never_raise.py
 tests/test_onboarding.py
+tests/test_rbac.py
 tests/test_reindexer.py
 tests/test_reset.py
 tests/test_semantic_provider.py

codecortex-0.5.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{codecortex-0.3.0 → codecortex-0.5.0}/src/codeintel/__main__.py

@@ -90,6 +90,8 @@ def main() -> None:
     reset_parser.add_argument("--yes", "-y", action="store_true", help="Skip the confirmation prompt")
     reset_parser.add_argument("--json", action="store_true", help="Emit the structured JSON report")
 
+    subparsers.add_parser("gen-token", help="Print a secure random bearer token (for serve-http / RBAC auth.toml)")
+
     args = parser.parse_args()
 
     from codeintel import term
@@ -355,6 +357,11 @@ def main() -> None:
 
         sys.exit(0 if any_ok else 1)
 
+    elif args.command == "gen-token":
+        import secrets
+        print(secrets.token_urlsafe(32))
+        sys.exit(0)
+
     else:
         parser.print_help()
         sys.exit(0)

codecortex-0.5.0/src/codeintel/auth.py

@@ -0,0 +1,120 @@
+"""Token→role authentication and RBAC for the HTTP transport.
+
+An optional auth config (``~/.codeintel/auth.toml`` or ``$CODEINTEL_AUTH_CONFIG``) maps bearer
+tokens to roles and roles to the operations they may run. The role is derived **server-side from
+the authenticated token** — a client can never escalate by claiming a role in the request body.
+
+Example ``auth.toml``::
+
+    [roles]
+    admin    = ["*"]                       # ["*"] (or omitted) = every op
+    reader   = ["search", "symbol", "overview", "callers", "callees", "impact", "chain", "context"]
+    searcher = ["search", "context"]
+
+    [tokens]                               # token = role  (store this file mode 0600)
+    "s3cret-admin-value"      = "admin"
+    "sha256:<hex-of-a-token>" = "reader"   # pre-hashed form, so plaintext need not be at rest
+
+SSO: put an OIDC auth proxy (e.g. oauth2-proxy) in front and have it present a per-role bearer
+token to codeintel — codeintel never speaks to the IdP itself (local-first, no per-query network).
+"""
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import pathlib
+import tomllib  # stdlib on Python 3.11+ (the project's minimum)
+from typing import Dict, List, Optional
+
+from codeintel.policy import TieringPolicy
+
+logger = logging.getLogger("codeintel")
+
+_ALL = "*"
+_SHA_PREFIX = "sha256:"
+
+
+class TokenAuth:
+    """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
+    sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
+
+    def __init__(self, token_hash_to_role: Dict[str, str], role_ops: Dict[str, List[str]]) -> None:
+        self._tokens = token_hash_to_role
+        self._role_ops = role_ops
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._tokens)
+
+    def role_for(self, presented_token: str) -> Optional[str]:
+        """The role for a presented token, or None if it isn't a known token."""
+        if not presented_token:
+            return None
+        h = hashlib.sha256(presented_token.encode("utf-8")).hexdigest()
+        return self._tokens.get(h)
+
+    def build_policy(self) -> TieringPolicy:
+        """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
+        TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        rules: Dict[str, List[str]] = {}
+        for role, ops in self._role_ops.items():
+            if _ALL in ops:
+                continue  # unrestricted
+            rules[role] = list(ops)
+        return TieringPolicy(enabled=bool(rules), rules=rules)
+
+
+def _auth_config_path() -> Optional[pathlib.Path]:
+    env = os.environ.get("CODEINTEL_AUTH_CONFIG", "").strip()
+    if env:
+        p = pathlib.Path(env)
+        return p if p.is_file() else None
+    default = pathlib.Path.home() / ".codeintel" / "auth.toml"
+    return default if default.is_file() else None
+
+
+def load_auth() -> TokenAuth:
+    """Load the token→role config if present. Never raises — a missing or malformed file yields an
+    empty (disabled) TokenAuth, and the caller falls back to single-token / no-auth."""
+    path = _auth_config_path()
+    if path is None:
+        return TokenAuth({}, {})
+    try:
+        with path.open("rb") as fh:
+            data = tomllib.load(fh)
+    except Exception as exc:
+        logger.warning("auth: %s could not be parsed (%s) — RBAC is OFF", path, type(exc).__name__)
+        return TokenAuth({}, {})
+
+    raw_roles = data.get("roles") if isinstance(data.get("roles"), dict) else {}
+    role_ops: Dict[str, List[str]] = {}
+    for role, ops in raw_roles.items():
+        if isinstance(ops, list):
+            role_ops[str(role)] = [str(o) for o in ops]
+        else:
+            # Fail CLOSED: a non-list ops value (the missing-brackets typo `reader = "search"`) must
+            # never silently become full access — deny all ops for that role instead.
+            logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
+            role_ops[str(role)] = []
+
+    raw_tokens = data.get("tokens") if isinstance(data.get("tokens"), dict) else {}
+    token_hash_to_role: Dict[str, str] = {}
+    for tok, role in raw_tokens.items():
+        role = str(role)
+        # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
+        if role not in role_ops:
+            role_ops[role] = []
+        tok = str(tok)
+        if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
+            h = tok[len(_SHA_PREFIX):].strip().lower()
+        else:
+            h = hashlib.sha256(tok.encode("utf-8")).hexdigest()
+        if h:
+            token_hash_to_role[h] = role
+
+    if not token_hash_to_role:
+        logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
+
+    return TokenAuth(token_hash_to_role, role_ops)

{codecortex-0.3.0 → codecortex-0.5.0}/src/codeintel/gateway.py

@@ -132,6 +132,14 @@ class Gateway:
             log_swallowed(f"Gateway._dispatch_single[{engine_str}.{op_str}]", exc)
             return safe_null_result(op_str, target_str, engine=engine_str, reason="provider-error")
 
+    def allows(self, role: str, op: str) -> bool:
+        """Whether *role* may run *op* under the current policy (True when no policy is configured).
+        Lets non-query handlers (e.g. doctor) share the same RBAC gate as query()."""
+        try:
+            return self._policy is None or self._policy.is_allowed(role, op)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -142,16 +150,25 @@ class Gateway:
         project_root=None,
     ) -> Result:
         try:
-            try:
-                self._reindexer.maybe_reindex(str(project_root or ""))
-            except Exception:
-                pass
-
             op_str = str(op or "")
             target_str = str(target or "")
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
+            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
+            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
+            if (
+                self._legacy_providers is None
+                and self._policy is not None
+                and not self._policy.is_allowed(role, op_str)
+            ):
+                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+
+            try:
+                self._reindexer.maybe_reindex(str(project_root or ""))
+            except Exception:
+                pass
+
             # Legacy list-based path (backward compat with pre-Phase-2 tests)
             if self._legacy_providers is not None:
                 for p in self._legacy_providers:
@@ -164,10 +181,6 @@ class Gateway:
                 reason = "engine-unavailable" if engine is not None else "no-result"
                 return safe_null_result(op_str, target_str, reason=reason)
 
-            # Policy check — before cache lookup
-            if self._policy is not None and not self._policy.is_allowed(role, op_str):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
-
             # Unknown engine — reject immediately
             if engine_str not in _KNOWN_ENGINES:
                 return safe_null_result(op_str, target_str, reason="unknown-engine")