digitalkin 1.0.0.dev20__tar.gz → 1.0.0.dev21__tar.gz

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.0.dev20
+Version: 1.0.0.dev21
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/pyproject.toml

@@ -37,7 +37,7 @@
         "pydantic-settings>=2.14.1",
         "redis[hiredis]>=7.4.0,<9",
     ]
-    version = "1.0.0.dev20"
+    version = "1.0.0.dev21"
 
     [project.optional-dependencies]
         performance = [ "uvloop>=0.21" ]

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/__version__.py

@@ -5,4 +5,4 @@ from importlib.metadata import PackageNotFoundError, version
 try:
     __version__ = version("digitalkin")
 except PackageNotFoundError:
-    __version__ = "1.0.0.dev20"
+    __version__ = "1.0.0.dev21"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/community/agno/hitl.py

@@ -611,7 +611,7 @@ class AgnoHitlRunner:
         stream: Any,
         send: Callable[[BaseAgentRunEvent], Coroutine[Any, Any, None]],
         thread_id: str,
-        run_output_cls: type,
+        run_output_cls: type[RunOutput],
     ) -> PauseInfo | None:
         """Drain an Agno stream, forward events, persist on pause.
 

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/grpc_servers/exceptions.py

@@ -19,6 +19,10 @@ class SecurityError(ServerError):
     """Error related to security configuration."""
 
 
+class PermissionDeniedError(ServerError):
+    """Remote service rejected the call with gRPC PERMISSION_DENIED."""
+
+
 class ServerStateError(ServerError):
     """Error related to server state (e.g., already started, not started)."""
 

digitalkin-1.0.0.dev21/src/digitalkin/grpc_servers/interceptors/permission.py

@@ -0,0 +1,103 @@
+"""Client-side permission middleware for gRPC service-data access.
+
+A single cross-cutting interceptor: any unary call a backend rejects with
+``PERMISSION_DENIED`` surfaces as :class:`PermissionDeniedError`, so callers
+never handle permission per service. Attached on every channel, it covers all
+data services and module-to-module calls uniformly.
+
+The interceptor *returns* a terminal denied call rather than raising: raising a
+non-``AioRpcError`` from an aio interceptor leaks into the intercepted call's
+``__del__`` (grpc only swallows ``AioRpcError``/``CancelledError`` there), so we
+mirror grpc's own ``UnaryUnaryCallResponse`` pattern and raise from ``__await__``.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+import grpc
+import grpc.aio
+
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
+from digitalkin.logger import logger
+
+if TYPE_CHECKING:
+    from collections.abc import Awaitable, Callable
+
+
+class _DeniedUnaryUnaryCall(grpc.aio.UnaryUnaryCall):
+    """A finished unary call that raises ``PermissionDeniedError`` when awaited."""
+
+    def __init__(self, method: str, details: str) -> None:
+        self._message = f"[{method}] {details or 'permission denied'}"
+        self._details = details
+
+    def cancel(self) -> bool:  # noqa: PLR6301
+        return False
+
+    def cancelled(self) -> bool:  # noqa: PLR6301
+        return False
+
+    def done(self) -> bool:  # noqa: PLR6301
+        return True
+
+    def add_done_callback(self, unused_callback: Any) -> None:
+        """No-op: the call is already finished.
+
+        Args:
+            unused_callback: Ignored; present to satisfy the call interface.
+        """
+
+    def time_remaining(self) -> float | None:  # noqa: PLR6301
+        return None
+
+    async def initial_metadata(self) -> grpc.aio.Metadata:  # noqa: PLR6301
+        return grpc.aio.Metadata()
+
+    async def trailing_metadata(self) -> grpc.aio.Metadata:  # noqa: PLR6301
+        return grpc.aio.Metadata()
+
+    async def code(self) -> grpc.StatusCode:  # noqa: PLR6301
+        return grpc.StatusCode.PERMISSION_DENIED
+
+    async def details(self) -> str:
+        return self._details
+
+    async def debug_error_string(self) -> None:  # noqa: PLR6301
+        return None
+
+    async def wait_for_connection(self) -> None:
+        """No-op: the call already resolved to a permission denial."""
+
+    def __await__(self) -> Any:
+        raise PermissionDeniedError(self._message)
+        yield  # unreachable; marks this method a generator so it is awaitable
+
+
+class PermissionClientInterceptor(grpc.aio.UnaryUnaryClientInterceptor):
+    """Map a ``PERMISSION_DENIED`` unary reply to ``PermissionDeniedError``."""
+
+    async def intercept_unary_unary(  # noqa: PLR6301
+        self,
+        continuation: Callable[[grpc.aio.ClientCallDetails, Any], Awaitable[Any]],
+        client_call_details: grpc.aio.ClientCallDetails,
+        request: Any,
+    ) -> Any:
+        """Return a denied call on PERMISSION_DENIED, else pass the real call through.
+
+        Args:
+            continuation: Downstream call continuation.
+            client_call_details: Original call details.
+            request: Request message.
+
+        Returns:
+            The downstream call, or a terminal call raising PermissionDeniedError on await.
+        """
+        call = await continuation(client_call_details, request)
+        if await call.code() == grpc.StatusCode.PERMISSION_DENIED:
+            method = client_call_details.method
+            method_name = method.decode() if isinstance(method, bytes) else method
+            details = await call.details()
+            logger.warning("permission denied on %s: %s", method_name, details or "")
+            return _DeniedUnaryUnaryCall(method_name, details)
+        return call

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/grpc_servers/utils/grpc_client_wrapper.py

@@ -16,6 +16,7 @@ import grpc.aio
 
 from digitalkin.core.resilience.bulkhead import Bulkhead
 from digitalkin.grpc_servers.exceptions import CircuitOpenError, ServerError
+from digitalkin.grpc_servers.interceptors.permission import PermissionClientInterceptor
 from digitalkin.grpc_servers.interceptors.request_ids import RequestIdClientInterceptor
 from digitalkin.grpc_servers.utils.circuit_breaker import CircuitBreaker
 from digitalkin.logger import logger
@@ -103,7 +104,7 @@ class GrpcClientWrapper:
 
         credentials = self._build_channel_credentials(config)
         grpc_compression = config.compression.to_grpc()
-        interceptors = [RequestIdClientInterceptor()]
+        interceptors = [RequestIdClientInterceptor(), PermissionClientInterceptor()]
         if credentials is not None:
             channel = grpc.aio.secure_channel(
                 config.address,

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/grpc_servers/utils/grpc_error_handler.py

@@ -4,7 +4,7 @@ from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from typing import Any
 
-from digitalkin.grpc_servers.exceptions import ServerError
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError, ServerError
 from digitalkin.logger import logger
 
 
@@ -28,6 +28,7 @@ class GrpcErrorHandlerMixin:
             Context for the operation.
 
         Raises:
+            PermissionDeniedError: Re-raised as-is so the authz status is never masked.
             ServerError: For gRPC-related errors.
             service_error_class: For service-specific errors if provided.
         """
@@ -36,6 +37,8 @@ class GrpcErrorHandlerMixin:
 
         try:
             yield
+        except PermissionDeniedError:
+            raise
         except service_error_class as e:
             # Re-raise service-specific errors as-is
             msg = f"{service_error_class.__name__} in {operation}: {e}"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/modules/_base_module.py

@@ -7,6 +7,7 @@ from abc import ABC, abstractmethod
 from collections.abc import Callable, Coroutine
 from typing import Any, ClassVar, Generic
 
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
 from digitalkin.grpc_servers.utils.utility_schema_extender import UtilitySchemaExtender
 from digitalkin.logger import logger
 from digitalkin.models.module.module import ModuleCodeModel, ModuleStatus
@@ -548,6 +549,10 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
             self._status = ModuleStatus.CANCELLED
             logger.info("Module %s cancelled", self.name, extra=self.context.session.current_ids())
             raise
+        except PermissionDeniedError as e:
+            self._status = ModuleStatus.FAILED
+            logger.warning("Permission denied in module %s: %s", self.name, e, extra=self.context.session.current_ids())
+            await self._notify_permission_denied(self.context.callbacks.send_message, e)
         except Exception as e:
             self._status = ModuleStatus.FAILED
             logger.exception("Error inside module %s", self.name, extra=self.context.session.current_ids())
@@ -564,6 +569,28 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
         else:
             self._status = ModuleStatus.STOPPING
 
+    async def _notify_permission_denied(
+        self,
+        callback: Callable[..., Coroutine[Any, Any, None]],
+        e: PermissionDeniedError,
+    ) -> None:
+        """Send a PermissionDenied notification to the user via the callback.
+
+        Args:
+            callback: The output callback installed on the module context.
+            e: The permission-denied error raised by a service call.
+        """
+        try:
+            await callback(
+                ModuleCodeModel(
+                    code="PermissionDenied",
+                    short_description="Permission denied",
+                    message=str(e),
+                )
+            )
+        except Exception:
+            logger.exception("Failed to send permission-denied callback", extra=self.context.session.current_ids())
+
     async def prepare(
         self,
         setup_data: SetupModelT,
@@ -623,6 +650,14 @@ class BaseModule(  # Module SDK base class requires many public methods # noqa:
         try:
             await self.prepare(setup_data, callback)
             timer.mark("prepare")
+        except PermissionDeniedError as e:
+            self._status = ModuleStatus.FAILED
+            logger.warning("Permission denied initializing module: %s", e, extra=self.context.session.current_ids())
+            await self._notify_permission_denied(callback, e)
+            if done_callback is not None:
+                await done_callback(None)
+            await self.stop()
+            return
         except Exception as e:
             self._status = ModuleStatus.FAILED
             short_description = "Error initializing module"

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/services/setup/grpc_setup.py

@@ -12,7 +12,7 @@ from agentic_mesh_protocol.setup.v1 import (
 from google.protobuf.struct_pb2 import Struct
 from pydantic import ValidationError
 
-from digitalkin.grpc_servers.exceptions import ServerError
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError, ServerError
 from digitalkin.grpc_servers.utils.grpc_client_wrapper import GrpcClientWrapper
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.models import ClientConfig
@@ -59,12 +59,15 @@ class GrpcSetup(SetupStrategy, GrpcClientWrapper):
             Allow error handling in context.
 
         Raises:
+            PermissionDeniedError: Service rejected the call with PERMISSION_DENIED.
             ValueError: Pydantic model validation failed - input data is malformed.
             ServerError: gRPC communication failed - remote service returned error or is unreachable.
             SetupServiceError: Unexpected error during setup operation - includes connection/timeout issues.
         """
         try:
             yield
+        except PermissionDeniedError:
+            raise
         except ValidationError as e:
             msg = f"Validation failed for {operation}: {e}"
             logger.error(

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin/services/storage/grpc_storage.py

@@ -4,7 +4,7 @@ from agentic_mesh_protocol.storage.v1 import data_pb2, storage_service_pb2_grpc
 from google.protobuf.struct_pb2 import Struct
 from pydantic import BaseModel
 
-from digitalkin.grpc_servers.exceptions import CircuitOpenError
+from digitalkin.grpc_servers.exceptions import CircuitOpenError, PermissionDeniedError
 from digitalkin.grpc_servers.utils.grpc_client_wrapper import GrpcClientWrapper
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.models import ClientConfig
@@ -84,6 +84,7 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
             StorageRecord: The corresponding record
 
         Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
             StorageServiceError: If there is an error while storing the record
         """
         logger.debug("debug:_store collection=%s id=%s", record.collection, record.record_id)
@@ -99,6 +100,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
             )
             resp = await self.exec_grpc_query("StoreRecord", req)
             return self._build_record_from_proto(resp.stored_data)
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage StoreRecord permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC StoreRecord skipped (circuit open) for %s:%s", record.collection, record.record_id)
@@ -111,6 +116,9 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
 
         Returns:
             StorageData: The record
+
+        Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
         """
         logger.debug("debug:_read context=%s collection=%s id=%s", context, collection, record_id)
         try:
@@ -121,6 +129,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
             )
             resp = await self.exec_grpc_query("ReadRecord", req)
             return self._build_record_from_proto(resp.stored_data)
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage ReadRecord permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC ReadRecord skipped (circuit open) for %s:%s", collection, record_id)
@@ -139,6 +151,9 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
 
         Returns:
             StorageRecord: The updated record, or None on failure.
+
+        Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
         """
         logger.debug("debug:_update context=%s collection=%s id=%s", context, collection, record_id)
         try:
@@ -152,6 +167,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
             )
             resp = await self.exec_grpc_query("UpdateRecord", req)
             return self._build_record_from_proto(resp.stored_data)
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage UpdateRecord permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC UpdateRecord skipped (circuit open) for %s:%s", collection, record_id)
@@ -164,6 +183,9 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
 
         Returns:
             bool: True if the record was deleted, False otherwise.
+
+        Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
         """
         logger.debug("debug:_remove context=%s collection=%s id=%s", context, collection, record_id)
         try:
@@ -173,6 +195,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
                 record_id=record_id,
             )
             await self.exec_grpc_query("RemoveRecord", req)
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage RemoveRecord permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC RemoveRecord skipped (circuit open) for %s:%s", collection, record_id)
@@ -186,6 +212,9 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
 
         Returns:
             list[StorageRecord]: The records found, or an empty list on failure.
+
+        Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
         """
         logger.debug("debug:_list context=%s collection=%s", context, collection)
         try:
@@ -195,6 +224,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
             )
             resp = await self.exec_grpc_query("ListRecords", req)
             return [self._build_record_from_proto(r) for r in resp.records]
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage ListRecords permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC ListRecords skipped (circuit open) for %s", collection)
@@ -207,6 +240,9 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
 
         Returns:
             bool: True if the collection was removed, False otherwise.
+
+        Raises:
+            PermissionDeniedError: If the service rejects the call with PERMISSION_DENIED.
         """
         try:
             req = data_pb2.RemoveCollectionRequest(
@@ -214,6 +250,10 @@ class GrpcStorage(StorageStrategy, GrpcClientWrapper):
                 collection=collection,
             )
             await self.exec_grpc_query("RemoveCollection", req)
+        except PermissionDeniedError:
+            # TODO(validate): remove after prod validation
+            logger.warning("[VALIDATE PD1] storage RemoveCollection permission denied")
+            raise
         except Exception as e:
             if self._is_circuit_open(e):
                 logger.debug("gRPC RemoveCollection skipped (circuit open) for %s", collection)

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.0.dev20
+Version: 1.0.0.dev21
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International

{digitalkin-1.0.0.dev20 → digitalkin-1.0.0.dev21}/src/digitalkin.egg-info/SOURCES.txt

@@ -95,6 +95,7 @@ src/digitalkin/grpc_servers/module_servicer.py
 src/digitalkin/grpc_servers/stream_registry.py
 src/digitalkin/grpc_servers/stream_session.py
 src/digitalkin/grpc_servers/interceptors/__init__.py
+src/digitalkin/grpc_servers/interceptors/permission.py
 src/digitalkin/grpc_servers/interceptors/request_ids.py
 src/digitalkin/grpc_servers/utils/__init__.py
 src/digitalkin/grpc_servers/utils/circuit_breaker.py