fastworkflow 2.17.7__tar.gz → 2.17.8__tar.gz

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fastworkflow
-Version: 2.17.7
+Version: 2.17.8
 Summary: A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX
 License: Apache-2.0
 Keywords: fastworkflow,ai,workflow,llm,openai

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/fastworkflow/run_fastapi_mcp/README.md

@@ -82,6 +82,32 @@ uvicorn services.run_fastapi.main:app --workflow_path /path/to/workflow --expect
 - Tokens without valid signatures are rejected
 - Recommended for production deployments in untrusted environments
 
+### Token Access in Workflow Context
+
+JWT tokens are automatically passed to workflows via the `workflow_context` parameter as `http_bearer_token`. This allows workflows to access the bearer token for making authenticated API calls or forwarding authentication.
+
+**Important notes:**
+- The token is **only available to authenticated endpoints** (those using `get_session_and_ensure_runtime` dependency)
+- The token is stored in the workflow context dictionary under the key `http_bearer_token`
+- Token is **automatically updated** on every authenticated request, ensuring workflows always have the current valid token
+- Token expiration is **automatically verified** by `verify_token()` in both secure mode (`--expect_encrypted_jwt` flag) and trusted network mode
+- In secure mode: Full cryptographic signature verification + expiration checking
+- In trusted network mode: Expiration checking is performed (signature verification disabled)
+- Tokens should be treated as sensitive data and handled securely in workflows
+- The `/initialize` endpoint is unauthenticated and does NOT provide a token to the workflow context; tokens are only available after calling `/initialize` and using the returned token in subsequent requests
+
+**Example usage in workflow:**
+
+```python
+# In workflow code
+workflow_context = self._context  # Gets the workflow_context
+bearer_token = workflow_context.get('http_bearer_token')
+
+# Use token for API calls
+headers = {"Authorization": f"Bearer {bearer_token}"}
+response = requests.get("https://api.example.com/data", headers=headers)
+```
+
 ## API Endpoints (REST)
 
 ### `POST /initialize`

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/fastworkflow/run_fastapi_mcp/__main__.py

@@ -126,7 +126,8 @@ async def get_session_and_ensure_runtime(
         workflow_path=ARGS.workflow_path,
         context=json.loads(ARGS.context) if ARGS.context else None,
         startup_command=ARGS.startup_command,
-        startup_action=fastworkflow.Action(**json.loads(ARGS.startup_action)) if ARGS.startup_action else None
+        startup_action=fastworkflow.Action(**json.loads(ARGS.startup_action)) if ARGS.startup_action else None,
+        http_bearer_token=session.http_bearer_token
     )
     
     return session

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/fastworkflow/run_fastapi_mcp/jwt_manager.py

@@ -269,6 +269,14 @@ def verify_token(token: str, expected_type: str = "access") -> dict:
             logger.warning(f"Token decoding failed: {e}")
             raise JWTError(f"Failed to decode token: {e}") from e
         
+        # Manually check expiration even in unverified mode
+        if exp_timestamp := payload.get("exp"):
+            import time
+            current_time = int(time.time())
+            if exp_timestamp < current_time:
+                logger.warning(f"Token expired: exp={exp_timestamp}, now={current_time}")
+                raise JWTError("Token has expired")
+        
         # Validate token type for consistency (outside try-except to allow JWTError to propagate)
         if payload.get("type") != expected_type:
             raise JWTError(f"Invalid token type: expected {expected_type}, got {payload.get('type')}")

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/fastworkflow/run_fastapi_mcp/utils.py

@@ -42,6 +42,7 @@ class SessionData(BaseModel):
     issued_at: int  # Unix timestamp
     expires_at: int  # Unix timestamp
     jti: str  # JWT ID (unique token identifier)
+    http_bearer_token: Optional[str] = None  # The actual JWT token string for workflow context access
 
 
 class InvokeRequest(BaseModel):
@@ -174,13 +175,14 @@ def get_session_from_jwt(
     try:
         payload = verify_token(token, expected_type="access")
 
-        # Extract session data from payload
+        # Extract session data from payload, including the token for workflow context
         return SessionData(
             user_id=payload["sub"],
             token_type=payload["type"],
             issued_at=payload["iat"],
             expires_at=payload["exp"],
-            jti=payload["jti"]
+            jti=payload["jti"],
+            http_bearer_token=token  # Store the actual token for workflow access
         )
 
     except JWTError as e:
@@ -204,7 +206,8 @@ async def ensure_user_runtime_exists(
     context: Optional[dict] = None,
     startup_command: Optional[str] = None,
     startup_action: Optional['fastworkflow.Action'] = None,
-    stream_format: str = "ndjson"
+    stream_format: str = "ndjson",
+    http_bearer_token: Optional[str] = None
 ) -> None:
     """
     Ensure a user runtime exists in the session manager. If not, create it.
@@ -220,6 +223,7 @@ async def ensure_user_runtime_exists(
         startup_command: Optional startup command
         startup_action: Optional startup action
         stream_format: Stream format preference ("ndjson" or "sse", default "ndjson")
+        http_bearer_token: Optional JWT token to update in workflow context
         
     Raises:
         HTTPException: If session creation fails
@@ -228,8 +232,30 @@ async def ensure_user_runtime_exists(
     existing_runtime = await session_manager.get_session(user_id)
     if existing_runtime:
         logger.debug(f"Session for user_id {user_id} already exists, skipping creation")
+        
+        # Update the workflow's context with the current token if provided
+        if http_bearer_token and existing_runtime.chat_session:
+            active_workflow = existing_runtime.chat_session.get_active_workflow()
+            if active_workflow and active_workflow.context:
+                # Update the workflow's context with the current token
+                # Note: We mutate the dictionary in-place (no setter call), which means:
+                # 1. The change is immediate and visible to workflow code
+                # 2. The workflow is NOT marked dirty (won't persist to disk)
+                # 3. This is intentional for JWT tokens - we don't want to persist sensitive tokens
+                active_workflow.context['http_bearer_token'] = http_bearer_token
+                logger.debug(f"Updated http_bearer_token in workflow context for user_id {user_id}")
+        
         return
     
+    # Prepare workflow context, ensuring http_bearer_token is available
+    if http_bearer_token:
+        if context:
+            # Add or replace http_bearer_token in the context
+            context['http_bearer_token'] = http_bearer_token
+        else:
+            # Initialize context with http_bearer_token
+            context = {'http_bearer_token': http_bearer_token}
+    
     logger.info(f"Creating new session for user_id: {user_id}")
     
     # Resolve conversation store base folder from SPEEDDICT_FOLDERNAME/user_conversations

{fastworkflow-2.17.7 → fastworkflow-2.17.8}/pyproject.toml

@@ -9,7 +9,7 @@ repository = "https://github.com/radiantlogicinc/fastworkflow"
 
 [tool.poetry]
 name = "fastworkflow"
-version = "2.17.7"
+version = "2.17.8"
 description = "A framework for rapidly building large-scale, deterministic, interactive workflows with a fault-tolerant, conversational UX"
 authors = ["Dhar Rawal <drawal@radiantlogic.com>"]
 license = "Apache-2.0"