embed-client-dev 4.0.78__py3-none-any.whl

embed_client/__init__.py

@@ -0,0 +1,36 @@
+"""
+embed-client: client for the Embedding Service API with authentication,
+SSL/TLS, and mTLS configuration.
+
+Canonical runtime client is :class:`EmbeddingClient` (direct JSON-RPC via
+``mcp_proxy_adapter.client.jsonrpc_client.JsonRpcClient``).
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from embed_client._version import __version__
+
+from embed_client.auth import ClientAuthManager
+from embed_client.config import ClientConfig
+from embed_client.config_generator import ClientConfigGenerator
+from embed_client.config_validator import ConfigValidator
+from embed_client.embedding_client import EmbeddingClient
+from embed_client.embedding_client_helpers import (
+    list_commands_via_client,
+    wait_for_job_poll,
+)
+from embed_client.ssl_manager import ClientSSLManager
+from embed_client.client_factory import ClientFactory
+
+__all__ = [
+    "EmbeddingClient",
+    "wait_for_job_poll",
+    "list_commands_via_client",
+    "ClientConfig",
+    "ClientAuthManager",
+    "ClientSSLManager",
+    "ClientFactory",
+    "ClientConfigGenerator",
+    "ConfigValidator",
+]

embed_client/__main__.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+"""
+Main entry point for embed-client CLI.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+import asyncio
+import sys
+
+from embed_client.cli import main
+
+if __name__ == "__main__":
+    sys.exit(asyncio.run(main()))

embed_client/_version.py

@@ -0,0 +1,3 @@
+"""Authoritative release version for the bundled server and client."""
+
+__version__ = "4.0.78"

embed_client/adapter_config_factory.py

@@ -0,0 +1,213 @@
+"""
+Adapter Configuration Factory
+
+This module provides translation from ClientConfig to mcp_proxy_adapter JsonRpcClient parameters.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from typing import TYPE_CHECKING, Any, Dict, Optional
+from urllib.parse import urlparse
+import os
+
+if TYPE_CHECKING:
+    from embed_client.config import ClientConfig
+
+
+class AdapterConfigFactory:
+    """
+    Factory for converting ClientConfig/config_dict to adapter JsonRpcClient parameters.
+
+    Translates embed-client configuration format to mcp_proxy_adapter JsonRpcClient
+    initialization parameters, handling all security modes and authentication methods.
+    """
+
+    @staticmethod
+    def from_config_dict(config_dict: Dict[str, Any]) -> Dict[str, Any]:
+        """
+        Convert config_dict to adapter parameters.
+
+        Args:
+            config_dict: Configuration dictionary with server, auth, ssl sections
+
+        Returns:
+            Dictionary with adapter parameters: protocol, host, port, token_header,
+            token, cert, key, ca, check_hostname, timeout
+        """
+        server_config = config_dict.get("server", {})
+        auth_config = config_dict.get("auth", {})
+        ssl_config = config_dict.get("ssl", {})
+        client_config = config_dict.get("client", {})
+
+        # Extract base URL and parse it
+        base_url = server_config.get("base_url") or server_config.get(
+            "host", "http://localhost"
+        )
+        port = server_config.get("port", 8001)
+
+        # A bare host/IP (as the config generator writes it) has no scheme;
+        # give urlparse a netloc so the host is kept instead of dropped.
+        if "://" not in base_url:
+            base_url = f"http://{base_url}"
+        parsed = urlparse(base_url)
+        protocol = parsed.scheme or "http"
+        host = parsed.hostname or "localhost"
+
+        # If port is in URL, use it; otherwise use config port
+        if parsed.port:
+            port = parsed.port
+        elif ":" in base_url and not base_url.startswith("http"):
+            # Handle edge case where port might be in hostname
+            pass
+
+        # Determine protocol for adapter (http, https, mtls)
+        adapter_protocol = "http"
+        if protocol == "https" or ssl_config.get("enabled", False):
+            if ssl_config.get("cert_file") and ssl_config.get("key_file"):
+                adapter_protocol = "mtls"
+            else:
+                adapter_protocol = "https"
+
+        # Extract authentication parameters
+        token_header: Optional[str] = None
+        token: Optional[str] = None
+        auth_method = auth_config.get("method", "none")
+
+        if auth_method == "api_key":
+            api_keys = auth_config.get("api_keys", {})
+            if api_keys:
+                # Use first available API key
+                token = list(api_keys.values())[0]
+                token_header = auth_config.get("api_key_header", "X-API-Key")
+        elif auth_method == "jwt":
+            # JWT tokens are created dynamically, but we can set header
+            token_header = "Authorization"
+            # Token will be generated by auth manager
+            jwt_config = auth_config.get("jwt", {})
+            if jwt_config.get("username") and jwt_config.get("password"):
+                # Store credentials for later token generation
+                token = None  # Will be generated on demand
+        elif auth_method == "basic":
+            token_header = "Authorization"
+            # Basic auth will be handled via adapter's token mechanism
+            basic_config = auth_config.get("basic", {})
+            if basic_config.get("username") and basic_config.get("password"):
+                token = None  # Will be generated on demand
+
+        # Extract SSL/TLS parameters
+        cert: Optional[str] = None
+        key: Optional[str] = None
+        ca: Optional[str] = None
+        check_hostname = ssl_config.get("check_hostname", True)
+
+        if adapter_protocol in ("https", "mtls"):
+            cert = ssl_config.get("cert_file")
+            key = ssl_config.get("key_file")
+            ca = ssl_config.get("ca_cert_file")
+
+            # If mTLS, ensure cert and key are set
+            if adapter_protocol == "mtls" and not (cert and key):
+                # Fallback to auth certificate config
+                cert = auth_config.get("certificate", {}).get("cert_file")
+                key = auth_config.get("certificate", {}).get("key_file")
+
+        # Extract timeout
+        timeout = client_config.get("timeout", 30.0)
+
+        return {
+            "protocol": adapter_protocol,
+            "host": host,
+            "port": port,
+            "token_header": token_header,
+            "token": token,
+            "cert": cert,
+            "key": key,
+            "ca": ca,
+            "check_hostname": check_hostname,
+            "timeout": timeout,
+            # Store original config for auth manager integration
+            "_original_config": config_dict,
+        }
+
+    @staticmethod
+    def from_client_config(config: "ClientConfig") -> Dict[str, Any]:
+        """
+        Convert ClientConfig object to adapter parameters.
+
+        Args:
+            config: ClientConfig instance
+
+        Returns:
+            Dictionary with adapter parameters
+        """
+        return AdapterConfigFactory.from_config_dict(config.get_all())
+
+    @staticmethod
+    def from_legacy_params(
+        base_url: str,
+        port: Optional[int] = None,
+        auth_method: Optional[str] = None,
+        ssl_enabled: Optional[bool] = None,
+        **kwargs,
+    ) -> Dict[str, Any]:
+        """
+        Convert legacy factory parameters to adapter parameters.
+
+        Args:
+            base_url: Server base URL
+            port: Server port
+            auth_method: Authentication method
+            ssl_enabled: Whether SSL is enabled
+            **kwargs: Additional parameters (cert_file, key_file, api_key, etc.)
+
+        Returns:
+            Dictionary with adapter parameters
+        """
+        parsed = urlparse(base_url)
+        protocol = parsed.scheme or "http"
+        host = parsed.hostname or "localhost"
+        actual_port = port or parsed.port or (443 if protocol == "https" else 80)
+
+        # Determine protocol
+        adapter_protocol = "http"
+        if ssl_enabled or protocol == "https":
+            if kwargs.get("cert_file") and kwargs.get("key_file"):
+                adapter_protocol = "mtls"
+            else:
+                adapter_protocol = "https"
+
+        # Extract auth
+        token_header: Optional[str] = None
+        token: Optional[str] = None
+
+        if auth_method == "api_key":
+            token = kwargs.get("api_key") or os.environ.get("EMBED_CLIENT_API_KEY")
+            token_header = kwargs.get("api_key_header", "X-API-Key")
+        elif auth_method == "jwt":
+            token_header = "Authorization"
+            # JWT will be generated on demand
+        elif auth_method == "basic":
+            token_header = "Authorization"
+            # Basic auth will be generated on demand
+
+        # Extract SSL
+        cert = kwargs.get("cert_file")
+        key = kwargs.get("key_file")
+        ca = kwargs.get("ca_cert_file")
+        check_hostname = kwargs.get("check_hostname", True)
+
+        timeout = kwargs.get("timeout", 30.0)
+
+        return {
+            "protocol": adapter_protocol,
+            "host": host,
+            "port": actual_port,
+            "token_header": token_header,
+            "token": token,
+            "cert": cert,
+            "key": key,
+            "ca": ca,
+            "check_hostname": check_hostname,
+            "timeout": timeout,
+        }

embed_client/adapter_config_normalizer.py

@@ -0,0 +1,135 @@
+"""
+Normalize embed-client config to adapter config format for validation.
+
+Converts client config (server.host, server.port, protocol, ssl, auth)
+to the format expected by mcp_proxy_adapter.core.validation.config_validator,
+and maps validation results back to embed-client section/key names.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+# Section/key mapping: adapter -> embed-client (for user-facing messages)
+_ADAPTER_TO_CLIENT_KEY: Dict[str, str] = {
+    "server.ssl.cert": "ssl.cert_file",
+    "server.ssl.key": "ssl.key_file",
+    "server.ssl.ca": "ssl.ca_cert_file",
+    "server.ssl.crl": "ssl.crl_file",
+}
+
+
+def client_to_adapter_format(
+    config_data: Dict[str, Any],
+    config_path: Optional[str] = None,
+) -> Dict[str, Any]:
+    """
+    Convert embed-client config to adapter ConfigValidator input format.
+
+    Adapter expects: server.host, server.port, server.protocol, server.debug,
+    server.log_level, server.ssl.{cert,key,ca}, auth, optional ssl, etc.
+    """
+    server = config_data.get("server", {})
+    protocol = config_data.get("protocol", server.get("protocol", "http"))
+    ssl_config = config_data.get("ssl", {})
+    auth_config = config_data.get("auth", {})
+
+    # Cert paths: embed-client uses ssl.cert_file / auth.certificate (keep as-is; adapter uses cwd for abspath)
+    cert_file = ssl_config.get("cert_file") or (
+        auth_config.get("certificate") or {}
+    ).get("cert_file")
+    key_file = ssl_config.get("key_file") or (auth_config.get("certificate") or {}).get(
+        "key_file"
+    )
+    ca_cert_file = ssl_config.get("ca_cert_file") or (
+        auth_config.get("certificate") or {}
+    ).get("ca_cert_file")
+    crl_file = ssl_config.get("crl_file")
+
+    server_ssl: Optional[Dict[str, Any]] = None
+    if protocol in ("https", "mtls") and (cert_file or key_file or ca_cert_file):
+        server_ssl = {
+            "cert": cert_file,
+            "key": key_file,
+            "ca": ca_cert_file,
+            "crl": crl_file,
+        }
+
+    adapter_server: Dict[str, Any] = {
+        "host": server.get("host", "localhost"),
+        "port": server.get("port", 8001),
+        "protocol": protocol,
+        "debug": False,
+        "log_level": "INFO",
+        "log_dir": server.get("log_dir", "./logs"),
+    }
+    if server_ssl:
+        adapter_server["ssl"] = server_ssl
+
+    # Adapter auth: use_token, tokens, roles (for validation consistency)
+    security = config_data.get("security", {})
+    adapter_auth = {
+        "use_token": auth_config.get("method") == "api_key",
+        "use_roles": bool(security.get("roles")),
+        "tokens": {},
+        "roles": (
+            security.get("roles") if isinstance(security.get("roles"), dict) else {}
+        ),
+    }
+    api_key = auth_config.get("api_key") or {}
+    if api_key.get("key"):
+        adapter_auth["tokens"] = {api_key["key"]: ["read", "write"]}
+    if security.get("tokens") and isinstance(security["tokens"], dict):
+        adapter_auth["tokens"] = {
+            (v if isinstance(v, str) else str(v)): ["read", "write"]
+            for v in security["tokens"].values()
+        }
+
+    normalized: Dict[str, Any] = {
+        "server": adapter_server,
+        "auth": adapter_auth,
+    }
+    if ssl_config:
+        normalized["ssl"] = {
+            "enabled": ssl_config.get("enabled", protocol in ("https", "mtls")),
+            "cert_file": cert_file,
+            "key_file": key_file,
+            "ca_cert_file": ca_cert_file,
+            "crl_file": crl_file,
+        }
+    # Minimal sections to avoid "unknown section" warnings
+    normalized["client"] = {"enabled": False}
+    normalized["registration"] = {"enabled": False}
+    return normalized
+
+
+def map_adapter_errors_to_client(
+    adapter_errors: List[Any],
+) -> List[str]:
+    """
+    Map adapter ValidationResult list to embed-client error strings.
+
+    Translates section/key (e.g. server.ssl.cert) to client names (ssl.cert_file).
+    """
+    from mcp_proxy_adapter.core.validation.validation_result import ValidationResult  # type: ignore[import-untyped]
+
+    result: List[str] = []
+    for r in adapter_errors:
+        if not isinstance(r, ValidationResult):
+            result.append(str(r))
+            continue
+        if getattr(r, "level", "error") != "error":
+            continue
+        msg = getattr(r, "message", str(r))
+        section = getattr(r, "section", None)
+        key = getattr(r, "key", None)
+        if section and key:
+            full_key = f"{section}.{key}" if key else section
+            client_key = _ADAPTER_TO_CLIENT_KEY.get(full_key, full_key)
+            result.append(f"{client_key}: {msg}")
+        else:
+            result.append(msg)
+    return result

embed_client/adapter_generator_bridge.py

@@ -0,0 +1,166 @@
+"""
+Bridge to mcp_proxy_adapter config generator.
+
+Uses adapter SimpleConfigGenerator as base: generates adapter config then
+converts to embed-client client config format (server.host/port, protocol,
+ssl.cert_file/key_file/ca_cert_file, auth, client.timeout).
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+import json
+import tempfile
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+try:
+    from mcp_proxy_adapter.core.config.simple_config_generator import (  # type: ignore[import-untyped]
+        SimpleConfigGenerator,
+    )
+
+    _ADAPTER_AVAILABLE = True
+except ImportError:
+    _ADAPTER_AVAILABLE = False
+    SimpleConfigGenerator = None  # type: ignore[misc, assignment]
+
+
+def adapter_output_to_client_config(adapter_dict: Dict[str, Any]) -> Dict[str, Any]:
+    """
+    Convert adapter generator output to embed-client config format.
+
+    Adapter has: server.{host, port, protocol, ssl.{cert, key, ca, crl}},
+    auth.{use_token, tokens, roles}. We output: server.{host, port},
+    protocol, ssl.{enabled, cert_file, key_file, ca_cert_file, crl_file},
+    auth.{method, api_key, certificate}, client.timeout, security.
+    """
+    server = adapter_dict.get("server", {})
+    ssl = server.get("ssl") or {}
+    auth = adapter_dict.get("auth", {})
+
+    protocol = server.get("protocol", "http")
+    ssl_enabled = protocol in ("https", "mtls")
+    verify_mode = "CERT_REQUIRED" if protocol == "mtls" else "CERT_NONE"
+
+    # Build embed-client auth: certificate for mTLS, api_key when use_token
+    if protocol == "mtls":
+        auth_method = "certificate"
+    elif auth.get("use_token"):
+        auth_method = "api_key"
+    else:
+        auth_method = "none"
+    tokens = auth.get("tokens") or {}
+    first_token: Optional[str] = None
+    if isinstance(tokens, dict) and tokens:
+        first_token = next(iter(tokens.keys()), None)
+
+    config: Dict[str, Any] = {
+        "server": {
+            "host": server.get("host", "localhost"),
+            "port": server.get("port", 8001),
+        },
+        "client": {"timeout": 30.0},
+        "protocol": protocol,
+        "auth": {
+            "method": auth_method,
+            "api_key": {"key": first_token, "header": "X-API-Key"},
+            "certificate": {
+                "enabled": protocol == "mtls",
+                "cert_file": ssl.get("cert") if protocol == "mtls" else None,
+                "key_file": ssl.get("key") if protocol == "mtls" else None,
+                "ca_cert_file": ssl.get("ca") if protocol == "mtls" else None,
+            },
+        },
+        "ssl": {
+            "enabled": ssl_enabled,
+            "verify": protocol != "http",
+            "verify_mode": verify_mode,
+            "check_hostname": False,
+            "check_expiry": False,
+            "cert_file": ssl.get("cert"),
+            "key_file": ssl.get("key"),
+            "ca_cert_file": ssl.get("ca"),
+            "crl_file": ssl.get("crl"),
+            "client_cert_required": protocol == "mtls",
+        },
+        "security": {"enabled": bool(auth.get("use_token")), "tokens": {}, "roles": {}},
+    }
+    if auth.get("use_token") and isinstance(tokens, dict) and tokens:
+        # embed-client security.tokens: role_name -> token_value
+        config["security"]["tokens"] = (
+            {"user": first_token} if first_token else dict(tokens)
+        )
+    if auth.get("use_roles") and isinstance(auth.get("roles"), dict):
+        config["security"]["roles"] = auth["roles"]
+    return config
+
+
+def generate_client_config_via_adapter(
+    protocol: str,
+    host: str = "localhost",
+    port: int = 8001,
+    cert_file: Optional[str] = None,
+    key_file: Optional[str] = None,
+    ca_cert_file: Optional[str] = None,
+    crl_file: Optional[str] = None,
+    token: Optional[str] = None,
+    use_token: bool = False,
+    use_roles: bool = False,
+    tokens: Optional[Dict[str, Any]] = None,
+    roles: Optional[Dict[str, Any]] = None,
+    output_path: Optional[Path] = None,
+) -> Dict[str, Any]:
+    """
+    Generate embed-client config using adapter SimpleConfigGenerator as base.
+
+    Calls adapter generator, loads output, converts to embed-client format.
+    Returns config dict; if output_path given, also saves JSON.
+    """
+    if not _ADAPTER_AVAILABLE or SimpleConfigGenerator is None:
+        raise RuntimeError(
+            "mcp_proxy_adapter is not available; install it to use adapter-based generator"
+        )
+
+    if protocol == "mtls" and not ca_cert_file:
+        raise ValueError("CA certificate is required for mTLS. Provide ca_cert_file.")
+
+    with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False) as tmp:
+        temp_path = tmp.name
+    try:
+        gen = SimpleConfigGenerator()
+        gen.generate(
+            protocol=protocol,
+            with_proxy=False,
+            out_path=temp_path,
+            server_host=host,
+            server_port=port,
+            server_cert_file=cert_file,
+            server_key_file=key_file,
+            server_ca_cert_file=ca_cert_file,
+            server_crl_file=crl_file,
+        )
+        with open(temp_path, "r", encoding="utf-8") as f:
+            adapter_dict = json.load(f)
+
+        # Optionally set auth from adapter CLI-style (tokens/roles)
+        if use_token and (token or tokens):
+            adapter_dict.setdefault("auth", {})["use_token"] = True
+            if tokens:
+                adapter_dict["auth"]["tokens"] = tokens
+            elif token:
+                adapter_dict["auth"]["tokens"] = {token: ["read", "write"]}
+        if use_roles and roles:
+            adapter_dict.setdefault("auth", {})["use_roles"] = True
+            adapter_dict["auth"]["roles"] = roles
+
+        client_config = adapter_output_to_client_config(adapter_dict)
+        if output_path:
+            output_path = Path(output_path)
+            output_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(output_path, "w", encoding="utf-8") as f:
+                json.dump(client_config, f, indent=2, ensure_ascii=False)
+        return client_config
+    finally:
+        Path(temp_path).unlink(missing_ok=True)