embed-client-dev 4.0.78__py3-none-any.whl

embed_client/security_cli.py

@@ -0,0 +1,200 @@
+#!/usr/bin/env python3
+"""Security CLI Application for Text Vectorization.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+import argparse
+import asyncio
+import sys
+
+from embed_client.security_cli_core import (
+    SecurityCLI,
+    create_config_from_security_mode,
+)
+
+# Re-export for backward compatibility
+__all__ = ["SecurityCLI", "create_config_from_security_mode", "main"]
+
+
+async def main() -> int:
+    """Main CLI function for security-aware vectorization."""
+    parser = argparse.ArgumentParser(
+        description="Security CLI Application for Text Vectorization",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Security Modes:
+  http              - Plain HTTP without authentication
+  http_token        - HTTP with API Key authentication
+  http_token_roles  - HTTP with API Key and role-based access control
+  https             - HTTPS with server certificate verification
+  https_token       - HTTPS with server certificates + authentication
+  https_token_roles - HTTPS with server certificates + authentication + roles
+  mtls              - Mutual TLS with client and server certificates
+  mtls_roles        - mTLS with role-based access control
+
+Examples:
+  # HTTP without authentication
+  python -m embed_client.security_cli vectorize --mode http "hello world"
+
+  # HTTP with token authentication
+  python -m embed_client.security_cli vectorize --mode http_token --api-key your-key "hello world"
+
+  # HTTPS with server certificates
+  python -m embed_client.security_cli vectorize --mode https \
+    --cert-file server.crt --key-file server.key "hello world"
+
+  # mTLS with client certificates
+  python -m embed_client.security_cli vectorize --mode mtls \
+    --cert-file client.crt --key-file client.key --ca-cert-file ca.crt "hello world"
+
+  # mTLS with roles
+  python -m embed_client.security_cli vectorize --mode mtls_roles \
+    --cert-file client.crt --key-file client.key --ca-cert-file ca.crt "hello world"
+        """,
+    )
+
+    parser.add_argument(
+        "--mode",
+        choices=[
+            "http",
+            "http_token",
+            "http_token_roles",
+            "https",
+            "https_token",
+            "https_token_roles",
+            "mtls",
+            "mtls_roles",
+        ],
+        required=True,
+        help="Security mode to use",
+    )
+
+    parser.add_argument(
+        "--host", default="localhost", help="Server host (default: localhost)"
+    )
+    parser.add_argument(
+        "--port", type=int, default=8001, help="Server port (default: 8001)"
+    )
+
+    parser.add_argument(
+        "--api-key", help="API key for authentication (required for token modes)"
+    )
+
+    parser.add_argument(
+        "--cert-file", help="Certificate file (required for HTTPS/mTLS modes)"
+    )
+    parser.add_argument(
+        "--key-file", help="Private key file (required for HTTPS/mTLS modes)"
+    )
+    parser.add_argument(
+        "--ca-cert-file", help="CA certificate file (required for mTLS modes)"
+    )
+
+    parser.add_argument(
+        "--format",
+        choices=["json", "csv", "vectors"],
+        default="json",
+        help="Output format",
+    )
+    parser.add_argument("--output", "-o", help="Output file (default: stdout)")
+
+    subparsers = parser.add_subparsers(dest="command", help="Available commands")
+
+    vectorize_parser = subparsers.add_parser("vectorize", help="Vectorize text")
+    vectorize_parser.add_argument("texts", nargs="*", help="Texts to vectorize")
+    vectorize_parser.add_argument(
+        "--file", "-f", help="File containing texts (one per line)"
+    )
+
+    subparsers.add_parser("health", help="Check service health")
+
+    help_parser = subparsers.add_parser("help", help="Get help from service")
+    help_parser.add_argument("--command", help="Specific command to get help for")
+
+    subparsers.add_parser("commands", help="Get available commands")
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        return 1
+
+    if "token" in args.mode and not args.api_key:
+        print("❌ API key required for token-based authentication modes")
+        return 1
+
+    if "https" in args.mode or "mtls" in args.mode:
+        if not args.cert_file or not args.key_file:
+            print("❌ Certificate and key files required for HTTPS/mTLS modes")
+            return 1
+
+    if "mtls" in args.mode and not args.ca_cert_file:
+        print("❌ CA certificate file required for mTLS modes")
+        return 1
+
+    config = create_config_from_security_mode(
+        args.mode,
+        args.host,
+        args.port,
+        api_key=args.api_key,
+        cert_file=args.cert_file,
+        key_file=args.key_file,
+        ca_cert_file=args.ca_cert_file,
+    )
+
+    cli = SecurityCLI()
+
+    try:
+        print(f"🔌 Connecting using {args.mode} mode...")
+        if not await cli.connect(config):
+            return 1
+
+        if args.command == "vectorize":
+            texts = list(args.texts)
+            if args.file:
+                # Use async file reading to avoid blocking the event loop
+                loop = asyncio.get_event_loop()
+
+                def read_file_sync(file_path: str) -> list[str]:
+                    """Read file synchronously in executor."""
+                    with open(file_path, "r", encoding="utf-8") as f:
+                        return [line.strip() for line in f if line.strip()]
+
+                file_texts = await loop.run_in_executor(None, read_file_sync, args.file)
+                texts.extend(file_texts)
+
+            if not texts:
+                print("❌ No texts provided")
+                return 1
+
+            print(f"🔤 Vectorizing {len(texts)} texts using {args.mode} mode...")
+            await cli.vectorize_texts(texts, args.format)
+
+        elif args.command == "health":
+            print(f"🏥 Checking service health using {args.mode} mode...")
+            await cli.health_check()
+
+        elif args.command == "help":
+            print(f"❓ Getting help using {args.mode} mode...")
+            await cli.get_help(args.command)
+
+        elif args.command == "commands":
+            print(f"📋 Getting commands using {args.mode} mode...")
+            await cli.get_commands()
+
+        return 0
+
+    except KeyboardInterrupt:
+        print("\n🛑 Interrupted by user")
+        return 1
+    except Exception as exc:  # noqa: BLE001
+        print(f"❌ Error: {exc}")
+        return 1
+    finally:
+        await cli.disconnect()
+
+
+if __name__ == "__main__":  # pragma: no cover - CLI entry point
+    sys.exit(asyncio.run(main()))

embed_client/security_cli_core.py

@@ -0,0 +1,227 @@
+"""
+Core components for Security CLI (client + config helpers).
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, List, Optional
+
+from embed_client.embedding_client import EmbeddingClient
+from embed_client.response_parsers import extract_embeddings
+
+
+class SecurityCLI:
+    """CLI application supporting all 8 security modes."""
+
+    def __init__(self) -> None:
+        self.client: Optional[EmbeddingClient] = None
+
+    async def connect(self, config: Dict[str, Any]) -> bool:
+        """Connect to embedding service using provided configuration."""
+        try:
+            from embed_client.embedding_client import embedding_client_from_config_dict
+
+            self.client = embedding_client_from_config_dict(config)
+            await self.client.__aenter__()
+            return True
+        except Exception as exc:  # noqa: BLE001
+            print(f"❌ Failed to connect: {exc}")
+            return False
+
+    async def disconnect(self) -> None:
+        """Disconnect from embedding service."""
+        if self.client:
+            await self.client.__aexit__(None, None, None)
+
+    async def health_check(self) -> bool:
+        """Check service health."""
+        if not self.client:
+            print("❌ Client is not connected")
+            return False
+        try:
+            result = await self.client.health()
+            print(f"✅ Service health: {result.get('status', 'unknown')}")
+            return True
+        except Exception as exc:  # noqa: BLE001
+            print(f"❌ Health check failed: {exc}")
+            return False
+
+    async def vectorize_texts(
+        self,
+        texts: List[str],
+        output_format: str = "json",
+    ) -> Optional[List[List[float]]]:
+        """Vectorize texts and print them in the requested format."""
+        if not self.client:
+            print("❌ Client is not connected")
+            return None
+        try:
+            params: Dict[str, Any] = {"texts": texts}
+            result = await self.client.cmd("embed", params=params)
+
+            embeddings = extract_embeddings(result)
+
+            if output_format == "json":
+                print(json.dumps(embeddings, indent=2))
+            elif output_format == "csv":
+                self._print_csv(embeddings)
+            elif output_format == "vectors":
+                self._print_vectors(embeddings)
+
+            return embeddings
+        except Exception as exc:  # noqa: BLE001
+            print(f"❌ Vectorization failed: {exc}")
+            return None
+
+    async def get_help(self, command: Optional[str] = None) -> None:
+        """Get help information from the service."""
+        if not self.client:
+            print("❌ Client is not connected")
+            return
+        try:
+            if command:
+                result = await self.client.cmd("help", params={"command": command})
+            else:
+                result = await self.client.cmd("help")
+            print(json.dumps(result, indent=2))
+        except Exception as exc:  # noqa: BLE001
+            print(f"❌ Help request failed: {exc}")
+
+    async def get_commands(self) -> None:
+        """Get available commands from the service."""
+        if not self.client:
+            print("❌ Client is not connected")
+            return
+        try:
+            result = await self.client.list_commands()
+            print(json.dumps(result, indent=2))
+        except Exception as exc:  # noqa: BLE001
+            print(f"❌ Commands request failed: {exc}")
+
+    def _print_csv(self, embeddings: List[List[float]]) -> None:
+        """Print embeddings in CSV format."""
+        for index, embedding in enumerate(embeddings):
+            print(f"text_{index}," + ",".join(map(str, embedding)))
+
+    def _print_vectors(self, embeddings: List[List[float]]) -> None:
+        """Print embeddings as vectors."""
+        for index, embedding in enumerate(embeddings):
+            print(f"Text {index}: [{', '.join(map(str, embedding))}]")
+
+
+def create_config_from_security_mode(
+    security_mode: str,
+    host: str,
+    port: int,
+    **kwargs: Any,
+) -> Dict[str, Any]:
+    """Create configuration dictionary based on security mode."""
+
+    config: Dict[str, Any] = {
+        "server": {"host": host, "port": port},
+        "auth": {"method": "none"},
+        "ssl": {"enabled": False},
+        "security": {"enabled": False},
+    }
+
+    if security_mode == "http":
+        config["server"]["host"] = f"http://{host.split('://')[-1]}"
+
+    elif security_mode == "http_token":
+        config["server"]["host"] = f"http://{host.split('://')[-1]}"
+        config["auth"]["method"] = "api_key"
+        config["security"] = {
+            "enabled": True,
+            "tokens": {"user": kwargs.get("api_key", "admin-secret-key")},
+        }
+
+    elif security_mode == "http_token_roles":
+        config["server"]["host"] = f"http://{host.split('://')[-1]}"
+        config["auth"]["method"] = "api_key"
+        config["security"] = {
+            "enabled": True,
+            "tokens": {"user": kwargs.get("api_key", "admin-secret-key")},
+            "roles": {
+                "admin": ["read", "write", "delete", "admin"],
+                "user": ["read", "write"],
+                "readonly": ["read"],
+            },
+        }
+
+    elif security_mode == "https":
+        config["server"]["host"] = f"https://{host.split('://')[-1]}"
+        config["ssl"] = {
+            "enabled": True,
+            "verify": False,
+            "cert_file": kwargs.get("cert_file"),
+            "key_file": kwargs.get("key_file"),
+            "ca_cert_file": kwargs.get("ca_cert_file"),
+        }
+
+    elif security_mode == "https_token":
+        config["server"]["host"] = f"https://{host.split('://')[-1]}"
+        config["auth"]["method"] = "api_key"
+        config["ssl"] = {
+            "enabled": True,
+            "cert_file": kwargs.get("cert_file"),
+            "key_file": kwargs.get("key_file"),
+        }
+        config["security"] = {
+            "enabled": True,
+            "tokens": {"user": kwargs.get("api_key", "admin-secret-key")},
+        }
+
+    elif security_mode == "https_token_roles":
+        config["server"]["host"] = f"https://{host.split('://')[-1]}"
+        config["auth"]["method"] = "api_key"
+        config["ssl"] = {
+            "enabled": True,
+            "cert_file": kwargs.get("cert_file"),
+            "key_file": kwargs.get("key_file"),
+        }
+        config["security"] = {
+            "enabled": True,
+            "tokens": {"user": kwargs.get("api_key", "admin-secret-key")},
+            "roles": {
+                "admin": ["read", "write", "delete", "admin"],
+                "user": ["read", "write"],
+                "readonly": ["read"],
+            },
+        }
+
+    elif security_mode == "mtls":
+        config["server"]["host"] = f"https://{host.split('://')[-1]}"
+        config["auth"]["method"] = "certificate"
+        config["ssl"] = {
+            "enabled": True,
+            "cert_file": kwargs.get("cert_file"),
+            "key_file": kwargs.get("key_file"),
+            "ca_cert_file": kwargs.get("ca_cert_file"),
+        }
+
+    elif security_mode == "mtls_roles":
+        config["server"]["host"] = f"https://{host.split('://')[-1]}"
+        config["auth"]["method"] = "certificate"
+        config["ssl"] = {
+            "enabled": True,
+            "cert_file": kwargs.get("cert_file"),
+            "key_file": kwargs.get("key_file"),
+            "ca_cert_file": kwargs.get("ca_cert_file"),
+        }
+        config["security"] = {
+            "enabled": True,
+            "roles": {
+                "admin": ["read", "write", "delete", "admin"],
+                "user": ["read", "write"],
+                "readonly": ["read"],
+            },
+        }
+
+    return config
+
+
+__all__ = ["SecurityCLI", "create_config_from_security_mode"]

embed_client/ssl_examples.py

@@ -0,0 +1,278 @@
+"""
+SSL/TLS examples for embed-client.
+
+This module provides examples of how to use the SSL/TLS manager
+with different security modes and configurations.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from typing import Dict, Any
+from embed_client.ssl_manager import create_ssl_manager
+
+
+def get_http_config() -> Dict[str, Any]:
+    """
+    Get example configuration for HTTP (no SSL).
+
+    Returns:
+        Configuration dictionary for HTTP
+    """
+    return {"ssl": {"enabled": False}}
+
+
+def get_https_config() -> Dict[str, Any]:
+    """
+    Get example configuration for HTTPS.
+
+    Returns:
+        Configuration dictionary for HTTPS
+    """
+    return {
+        "ssl": {
+            "enabled": True,
+            "verify_mode": "CERT_REQUIRED",
+            "check_hostname": True,
+            "check_expiry": True,
+        }
+    }
+
+
+def get_https_with_ca_config() -> Dict[str, Any]:
+    """
+    Get example configuration for HTTPS with custom CA.
+
+    Returns:
+        Configuration dictionary for HTTPS with CA
+    """
+    return {
+        "ssl": {
+            "enabled": True,
+            "verify_mode": "CERT_REQUIRED",
+            "check_hostname": True,
+            "check_expiry": True,
+            "ca_cert_file": "certs/ca.crt",
+        }
+    }
+
+
+def get_mtls_config() -> Dict[str, Any]:
+    """
+    Get example configuration for mTLS (mutual TLS).
+
+    Returns:
+        Configuration dictionary for mTLS
+    """
+    return {
+        "ssl": {
+            "enabled": True,
+            "verify_mode": "CERT_REQUIRED",
+            "check_hostname": True,
+            "check_expiry": True,
+            "cert_file": "certs/client.crt",
+            "key_file": "keys/client.key",
+            "ca_cert_file": "certs/ca.crt",
+        }
+    }
+
+
+def get_mtls_no_verify_config() -> Dict[str, Any]:
+    """
+    Get example configuration for mTLS without verification.
+
+    Returns:
+        Configuration dictionary for mTLS without verification
+    """
+    return {
+        "ssl": {
+            "enabled": True,
+            "verify_mode": "CERT_NONE",
+            "check_hostname": False,
+            "check_expiry": False,
+            "cert_file": "certs/client.crt",
+            "key_file": "keys/client.key",
+        }
+    }
+
+
+def demo_http_ssl():
+    """Demonstrate HTTP SSL configuration (disabled)."""
+    print("=== HTTP SSL Configuration Demo ===")
+
+    config = get_http_config()
+    ssl_manager = create_ssl_manager(config)
+
+    print(f"SSL enabled: {ssl_manager.is_ssl_enabled()}")
+    print(f"mTLS enabled: {ssl_manager.is_mtls_enabled()}")
+
+    # Note: SSL context and connector are created automatically by adapter
+    print("Note: SSL/TLS is handled automatically by mcp_proxy_adapter JsonRpcClient")
+
+    # Validate configuration
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Validation errors: {errors}")
+
+
+def demo_https_ssl():
+    """Demonstrate HTTPS SSL configuration."""
+    print("\n=== HTTPS SSL Configuration Demo ===")
+
+    config = get_https_config()
+    ssl_manager = create_ssl_manager(config)
+
+    print(f"SSL enabled: {ssl_manager.is_ssl_enabled()}")
+    print(f"mTLS enabled: {ssl_manager.is_mtls_enabled()}")
+
+    # Note: SSL context and connector are created automatically by adapter
+    print("Note: SSL/TLS is handled automatically by mcp_proxy_adapter JsonRpcClient")
+
+    # Get supported protocols
+    protocols = ssl_manager.get_supported_protocols()
+    print(f"Supported protocols: {protocols}")
+
+    # Validate configuration
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Validation errors: {errors}")
+
+
+def demo_https_with_ca_ssl():
+    """Demonstrate HTTPS SSL configuration with custom CA."""
+    print("\n=== HTTPS with CA SSL Configuration Demo ===")
+
+    config = get_https_with_ca_config()
+    ssl_manager = create_ssl_manager(config)
+
+    print(f"SSL enabled: {ssl_manager.is_ssl_enabled()}")
+    print(f"mTLS enabled: {ssl_manager.is_mtls_enabled()}")
+
+    # Note: SSL context is created automatically by adapter
+    print("Note: SSL/TLS is handled automatically by mcp_proxy_adapter JsonRpcClient")
+
+    # Validate configuration
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Validation errors: {errors}")
+
+
+def demo_mtls_ssl():
+    """Demonstrate mTLS SSL configuration."""
+    print("\n=== mTLS SSL Configuration Demo ===")
+
+    config = get_mtls_config()
+    ssl_manager = create_ssl_manager(config)
+
+    print(f"SSL enabled: {ssl_manager.is_ssl_enabled()}")
+    print(f"mTLS enabled: {ssl_manager.is_mtls_enabled()}")
+
+    # Note: SSL context is created automatically by adapter
+    print("Note: SSL/TLS is handled automatically by mcp_proxy_adapter JsonRpcClient")
+
+    # Validate configuration
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Validation errors: {errors}")
+
+
+def demo_mtls_no_verify_ssl():
+    """Demonstrate mTLS SSL configuration without verification."""
+    print("\n=== mTLS without Verification SSL Configuration Demo ===")
+
+    config = get_mtls_no_verify_config()
+    ssl_manager = create_ssl_manager(config)
+
+    print(f"SSL enabled: {ssl_manager.is_ssl_enabled()}")
+    print(f"mTLS enabled: {ssl_manager.is_mtls_enabled()}")
+
+    # Note: SSL context is created automatically by adapter
+    print("Note: SSL/TLS is handled automatically by mcp_proxy_adapter JsonRpcClient")
+
+    # Validate configuration
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Validation errors: {errors}")
+
+
+def demo_certificate_validation():
+    """Demonstrate certificate validation."""
+    print("\n=== Certificate Validation Demo ===")
+
+    config = {"ssl": {"enabled": True}}
+    ssl_manager = create_ssl_manager(config)  # noqa: F841
+
+    # Note: Certificate validation is handled by mcp_security_framework
+    print("Note: Certificate validation is handled by mcp_security_framework")
+    print("Use validate_ssl_config() for configuration validation")
+
+
+def demo_ssl_context_creation():
+    """Demonstrate SSL context creation using factory functions."""
+    print("\n=== SSL Context Creation Demo ===")
+    print(
+        "Note: SSL context creation is handled automatically by mcp_proxy_adapter JsonRpcClient"
+    )
+    print(
+        "No manual SSL context creation is needed - adapter handles all SSL/TLS operations"
+    )
+
+
+def demo_connector_creation():
+    """Demonstrate connector creation using factory functions."""
+    print("\n=== Connector Creation Demo ===")
+    print(
+        "Note: Connector creation is handled automatically by mcp_proxy_adapter JsonRpcClient"
+    )
+    print(
+        "No manual connector creation is needed - adapter handles all transport operations"
+    )
+
+
+def demo_ssl_configuration_validation():
+    """Demonstrate SSL configuration validation."""
+    print("\n=== SSL Configuration Validation Demo ===")
+
+    # Valid configuration
+    config = get_http_config()
+    ssl_manager = create_ssl_manager(config)
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Valid config errors: {errors}")
+
+    # Invalid configuration (missing files)
+    config = get_mtls_config()
+    ssl_manager = create_ssl_manager(config)
+    errors = ssl_manager.validate_ssl_config()
+    print(f"Invalid config errors: {errors}")
+
+
+def demo_ssl_capabilities():
+    """Demonstrate SSL capabilities detection."""
+    print("\n=== SSL Capabilities Demo ===")
+
+    config = {"ssl": {"enabled": True}}
+    ssl_manager = create_ssl_manager(config)
+
+    protocols = ssl_manager.get_supported_protocols()
+    print(f"Supported protocols: {protocols}")
+
+    ssl_config = ssl_manager.get_ssl_config()
+    print(f"SSL configuration: {ssl_config}")
+
+
+def run_all_demos():
+    """Run all SSL/TLS demos."""
+    print("🔒 SSL/TLS Manager Examples")
+    print("=" * 50)
+
+    demo_http_ssl()
+    demo_https_ssl()
+    demo_https_with_ca_ssl()
+    demo_mtls_ssl()
+    demo_mtls_no_verify_ssl()
+    demo_certificate_validation()
+    demo_ssl_configuration_validation()
+    demo_ssl_capabilities()
+    demo_ssl_context_creation()
+    demo_connector_creation()
+
+    print("\n✅ All SSL/TLS demos completed!")
+
+
+if __name__ == "__main__":
+    run_all_demos()