flwr-nightly 1.23.0.dev20251011__tar.gz → 1.23.0.dev20251014__tar.gz

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: flwr-nightly
-Version: 1.23.0.dev20251011
+Version: 1.23.0.dev20251014
 Summary: Flower: A Friendly Federated AI Framework
 License: Apache-2.0
 Keywords: Artificial Intelligence,Federated AI,Federated Analytics,Federated Evaluation,Federated Learning,Flower,Machine Learning

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/common/constant.py

@@ -157,6 +157,7 @@ RUN_ID_NOT_FOUND_MESSAGE = "Run ID not found"
 NO_ACCOUNT_AUTH_MESSAGE = "ControlServicer initialized without account authentication"
 NO_ARTIFACT_PROVIDER_MESSAGE = "ControlServicer initialized without artifact provider"
 PULL_UNFINISHED_RUN_MESSAGE = "Cannot pull artifacts for an unfinished run"
+SUPERNODE_NOT_CREATED_FROM_CLI_MESSAGE = "Invalid SuperNode credentials"
 PUBLIC_KEY_ALREADY_IN_USE_MESSAGE = "Public key already in use"
 PUBLIC_KEY_NOT_VALID = "The provided public key is not valid"
 NODE_NOT_FOUND_MESSAGE = "Node ID not found for account"

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/app.py

@@ -16,22 +16,19 @@
 
 
 import argparse
-import csv
 import importlib.util
 import os
 import subprocess
 import sys
 import threading
 from collections.abc import Sequence
-from logging import DEBUG, INFO, WARN
+from logging import INFO, WARN
 from pathlib import Path
 from time import sleep
 from typing import Callable, Optional, TypeVar, cast
 
 import grpc
 import yaml
-from cryptography.hazmat.primitives.asymmetric import ec
-from cryptography.hazmat.primitives.serialization import load_ssh_public_key
 
 from flwr.common import GRPC_MAX_MESSAGE_LENGTH, EventType, event
 from flwr.common.address import parse_address
@@ -61,6 +58,7 @@ from flwr.common.event_log_plugin import EventLogWriterPlugin
 from flwr.common.exit import ExitCode, flwr_exit, register_signal_handlers
 from flwr.common.grpc import generic_create_grpc_server
 from flwr.common.logger import log
+from flwr.common.version import package_version
 from flwr.proto.fleet_pb2_grpc import (  # pylint: disable=E0611
     add_FleetServicer_to_server,
 )
@@ -69,7 +67,6 @@ from flwr.server.fleet_event_log_interceptor import FleetEventLogInterceptor
 from flwr.supercore.ffs import FfsFactory
 from flwr.supercore.grpc_health import add_args_health, run_health_server_grpc_no_tls
 from flwr.supercore.object_store import ObjectStoreFactory
-from flwr.supercore.primitives.asymmetric import public_key_to_bytes
 from flwr.superlink.artifact_provider import ArtifactProvider
 from flwr.superlink.auth_plugin import (
     ControlAuthnPlugin,
@@ -214,6 +211,27 @@ def run_superlink() -> None:
         log(WARN, "The `--artifact-provider-config` flag is highly experimental.")
         artifact_provider = get_ee_artifact_provider(cfg_path)
 
+    # If supernode authentication is disabled, warn users
+    enable_supernode_auth: bool = args.enable_supernode_auth
+    if not enable_supernode_auth:
+        log(
+            WARN,
+            "SuperNode authentication is disabled. The SuperLink will accept "
+            "connections from any SuperNode.",
+        )
+
+    if args.auth_list_public_keys:
+        url_v = f"https://flower.ai/docs/framework/v{package_version}/en/"
+        page = "how-to-authenticate-supernodes.html"
+        flwr_exit(
+            ExitCode.SUPERLINK_INVALID_ARGS,
+            "The `--auth-list-public-keys` "
+            "argument is no longer supported. To enable SuperNode authentication,  "
+            "use the `--enable-supernode-auth` flag and use the Flower CLI to register "
+            "SuperNodes by supplying their public keys. Please refer"
+            f" to the Flower documentation for more information: {url_v}{page}",
+        )
+
     # Initialize StateFactory
     state_factory = LinkStateFactory(args.database)
 
@@ -309,22 +327,8 @@ def run_superlink() -> None:
             fleet_thread.start()
             bckg_threads.append(fleet_thread)
         elif args.fleet_api_type == TRANSPORT_TYPE_GRPC_RERE:
-            node_public_keys = _try_load_public_keys_node_authentication(args)
-            auto_auth = True
-            if node_public_keys is not None:
-                auto_auth = False
-                state = state_factory.state()
-                state.clear_supernode_auth_keys()
-                state.store_node_public_keys(node_public_keys)
-                log(
-                    INFO,
-                    "Node authentication enabled with %d known public keys",
-                    len(node_public_keys),
-                )
-            else:
-                log(DEBUG, "Automatic node authentication enabled")
 
-            interceptors = [NodeAuthServerInterceptor(state_factory, auto_auth)]
+            interceptors = [NodeAuthServerInterceptor(state_factory)]
             if getattr(args, "enable_event_log", None):
                 fleet_log_plugin = _try_obtain_fleet_event_log_writer_plugin()
                 if fleet_log_plugin is not None:
@@ -336,6 +340,7 @@ def run_superlink() -> None:
                 state_factory=state_factory,
                 ffs_factory=ffs_factory,
                 objectstore_factory=objectstore_factory,
+                enable_supernode_auth=enable_supernode_auth,
                 certificates=certificates,
                 interceptors=interceptors,
             )
@@ -346,6 +351,7 @@ def run_superlink() -> None:
                 state_factory=state_factory,
                 ffs_factory=ffs_factory,
                 objectstore_factory=objectstore_factory,
+                enable_supernode_auth=enable_supernode_auth,
                 certificates=certificates,
             )
             grpc_servers.append(fleet_server)
@@ -403,48 +409,6 @@ def _format_address(address: str) -> tuple[str, str, int]:
     return (f"[{host}]:{port}" if is_v6 else f"{host}:{port}", host, port)
 
 
-def _try_load_public_keys_node_authentication(
-    args: argparse.Namespace,
-) -> Optional[set[bytes]]:
-    """Return a set of node public keys."""
-    if args.auth_superlink_private_key or args.auth_superlink_public_key:
-        log(
-            WARN,
-            "The `--auth-superlink-private-key` and `--auth-superlink-public-key` "
-            "arguments are deprecated and will be removed in a future release. Node "
-            "authentication no longer requires these arguments.",
-        )
-
-    if not args.auth_list_public_keys:
-        return None
-
-    node_keys_file_path = Path(args.auth_list_public_keys)
-    if not node_keys_file_path.exists():
-        sys.exit(
-            "The provided path to the known public keys CSV file does not exist: "
-            f"{node_keys_file_path}. "
-            "Please provide the CSV file path containing known public keys "
-            "to '--auth-list-public-keys'."
-        )
-
-    node_public_keys: set[bytes] = set()
-
-    with open(node_keys_file_path, newline="", encoding="utf-8") as csvfile:
-        reader = csv.reader(csvfile)
-        for row in reader:
-            for element in row:
-                public_key = load_ssh_public_key(element.encode())
-                if isinstance(public_key, ec.EllipticCurvePublicKey):
-                    node_public_keys.add(public_key_to_bytes(public_key))
-                else:
-                    sys.exit(
-                        "Error: Unable to parse the public keys in the CSV "
-                        "file. Please ensure that the CSV file path points to a valid "
-                        "known SSH public keys files and try again."
-                    )
-    return node_public_keys
-
-
 def _load_control_auth_plugins(
     config_path: Optional[str], verify_tls_cert: bool
 ) -> tuple[ControlAuthnPlugin, ControlAuthzPlugin]:
@@ -538,6 +502,7 @@ def _run_fleet_api_grpc_rere(  # pylint: disable=R0913, R0917
     state_factory: LinkStateFactory,
     ffs_factory: FfsFactory,
     objectstore_factory: ObjectStoreFactory,
+    enable_supernode_auth: bool,
     certificates: Optional[tuple[bytes, bytes, bytes]],
     interceptors: Optional[Sequence[grpc.ServerInterceptor]] = None,
 ) -> grpc.Server:
@@ -547,6 +512,7 @@ def _run_fleet_api_grpc_rere(  # pylint: disable=R0913, R0917
         state_factory=state_factory,
         ffs_factory=ffs_factory,
         objectstore_factory=objectstore_factory,
+        enable_supernode_auth=enable_supernode_auth,
     )
     fleet_add_servicer_to_server_fn = add_FleetServicer_to_server
     fleet_grpc_server = generic_create_grpc_server(
@@ -565,11 +531,13 @@ def _run_fleet_api_grpc_rere(  # pylint: disable=R0913, R0917
     return fleet_grpc_server
 
 
+# pylint: disable=R0913, R0917
 def _run_fleet_api_grpc_adapter(
     address: str,
     state_factory: LinkStateFactory,
     ffs_factory: FfsFactory,
     objectstore_factory: ObjectStoreFactory,
+    enable_supernode_auth: bool,
     certificates: Optional[tuple[bytes, bytes, bytes]],
 ) -> grpc.Server:
     """Run Fleet API (GrpcAdapter)."""
@@ -578,6 +546,7 @@ def _run_fleet_api_grpc_adapter(
         state_factory=state_factory,
         ffs_factory=ffs_factory,
         objectstore_factory=objectstore_factory,
+        enable_supernode_auth=enable_supernode_auth,
     )
     fleet_add_servicer_to_server_fn = add_GrpcAdapterServicer_to_server
     fleet_grpc_server = generic_create_grpc_server(
@@ -722,18 +691,12 @@ def _add_args_common(parser: argparse.ArgumentParser) -> None:
     parser.add_argument(
         "--auth-list-public-keys",
         type=str,
-        help="A CSV file (as a path str) containing a list of known public "
-        "keys to enable authentication.",
-    )
-    parser.add_argument(
-        "--auth-superlink-private-key",
-        type=str,
         help="This argument is deprecated and will be removed in a future release.",
     )
     parser.add_argument(
-        "--auth-superlink-public-key",
-        type=str,
-        help="This argument is deprecated and will be removed in a future release.",
+        "--enable-supernode-auth",
+        action="store_true",
+        help="Enable supernode authentication.",
     )
 
 

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/superlink/fleet/grpc_rere/fleet_servicer.py

@@ -15,11 +15,12 @@
 """Fleet API gRPC request-response servicer."""
 
 
-from logging import DEBUG, INFO
+from logging import DEBUG, ERROR, INFO
 
 import grpc
 from google.protobuf.json_format import MessageToDict
 
+from flwr.common.constant import SUPERNODE_NOT_CREATED_FROM_CLI_MESSAGE
 from flwr.common.inflatable import UnexpectedObjectContentError
 from flwr.common.logger import log
 from flwr.common.typing import InvalidRunStatusException
@@ -47,6 +48,7 @@ from flwr.proto.message_pb2 import (  # pylint: disable=E0611
     PushObjectRequest,
     PushObjectResponse,
 )
+from flwr.proto.node_pb2 import Node  # pylint: disable=E0611
 from flwr.proto.run_pb2 import GetRunRequest, GetRunResponse  # pylint: disable=E0611
 from flwr.server.superlink.fleet.message_handler import message_handler
 from flwr.server.superlink.linkstate import LinkStateFactory
@@ -63,10 +65,12 @@ class FleetServicer(fleet_pb2_grpc.FleetServicer):
         state_factory: LinkStateFactory,
         ffs_factory: FfsFactory,
         objectstore_factory: ObjectStoreFactory,
+        enable_supernode_auth: bool,
     ) -> None:
         self.state_factory = state_factory
         self.ffs_factory = ffs_factory
         self.objectstore_factory = objectstore_factory
+        self.enable_supernode_auth = enable_supernode_auth
 
     def CreateNode(
         self, request: CreateNodeRequest, context: grpc.ServicerContext
@@ -79,10 +83,28 @@ class FleetServicer(fleet_pb2_grpc.FleetServicer):
         )
         log(DEBUG, "[Fleet.CreateNode] Request: %s", MessageToDict(request))
         try:
-            response = message_handler.create_node(
-                request=request,
-                state=self.state_factory.state(),
-            )
+
+            state = self.state_factory.state()
+
+            # Check if public key is already in use
+            if node_id := state.get_node_id_by_public_key(request.public_key):
+                # Prepare response with existing node_id
+                response = CreateNodeResponse(node=Node(node_id=node_id))
+            else:
+                if self.enable_supernode_auth:
+                    # When SuperNode authentication is enabled,
+                    # only SuperNodes created from the CLI are allowed to
+                    # stablish a connection with the Fleet API
+                    log(ERROR, SUPERNODE_NOT_CREATED_FROM_CLI_MESSAGE)
+                    raise ValueError(SUPERNODE_NOT_CREATED_FROM_CLI_MESSAGE)
+
+                # When SuperNode authentication is disabled, auto-auth
+                # allows creating a new node
+                response = message_handler.create_node(
+                    request=request,
+                    state=state,
+                )
+
         except ValueError as e:
             # Public key already in use
             context.abort(grpc.StatusCode.FAILED_PRECONDITION, str(e))
@@ -96,6 +118,18 @@ class FleetServicer(fleet_pb2_grpc.FleetServicer):
         """."""
         log(INFO, "[Fleet.DeleteNode] Delete node_id=%s", request.node.node_id)
         log(DEBUG, "[Fleet.DeleteNode] Request: %s", MessageToDict(request))
+        # This shall be refactored when renaming `Fleet.Create/DeleteNode`
+        # to `Fleet.Activate/DeactivateNode`
+        if self.enable_supernode_auth:
+            # SuperNodes can only be deleted from the CLI
+            # We simply acknowledge the heartbeat with interval 0
+            # to mark the node as offline
+            state = self.state_factory.state()
+            state.acknowledge_node_heartbeat(
+                node_id=request.node.node_id, heartbeat_interval=0
+            )
+            return DeleteNodeResponse()
+
         return message_handler.delete_node(
             request=request,
             state=self.state_factory.state(),

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/superlink/fleet/grpc_rere/node_auth_server_interceptor.py

@@ -54,15 +54,10 @@ class NodeAuthServerInterceptor(grpc.ServerInterceptor):  # type: ignore
     ----------
     state_factory : LinkStateFactory
         A factory for creating new instances of LinkState.
-    auto_auth : bool (default: False)
-        If True, nodes are authenticated without requiring their public keys to be
-        pre-stored in the LinkState. If False, only nodes with pre-stored public keys
-        can be authenticated.
     """
 
-    def __init__(self, state_factory: LinkStateFactory, auto_auth: bool = False):
+    def __init__(self, state_factory: LinkStateFactory):
         self.state_factory = state_factory
-        self.auto_auth = auto_auth
 
     def intercept_service(  # pylint: disable=too-many-return-statements
         self,
@@ -79,7 +74,6 @@ class NodeAuthServerInterceptor(grpc.ServerInterceptor):  # type: ignore
         if not handler_call_details.method.startswith("/flwr.proto.Fleet/"):
             return continuation(handler_call_details)
 
-        state = self.state_factory.state()
         metadata_dict = dict(handler_call_details.invocation_metadata)
 
         # Retrieve info from the metadata
@@ -90,11 +84,6 @@ class NodeAuthServerInterceptor(grpc.ServerInterceptor):  # type: ignore
         except KeyError:
             return _unary_unary_rpc_terminator("Missing authentication metadata")
 
-        if not self.auto_auth:
-            # Abort the RPC call if the node public key is not found
-            if node_pk_bytes not in state.get_node_public_keys():
-                return _unary_unary_rpc_terminator("Public key not recognized")
-
         # Verify the signature
         node_pk = bytes_to_public_key(node_pk_bytes)
         if not verify_signature(node_pk, timestamp_iso.encode("ascii"), signature):

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/superlink/linkstate/in_memory_linkstate.py

@@ -21,7 +21,7 @@ from bisect import bisect_right
 from collections import defaultdict
 from collections.abc import Sequence
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import datetime, timezone
 from logging import ERROR, WARNING
 from typing import Optional
 
@@ -74,7 +74,7 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
 
         # Map node_id to NodeInfo
         self.nodes: dict[int, NodeInfo] = {}
-        self.registered_node_public_keys: set[bytes] = set()
+        self.node_public_key_to_node_id: dict[bytes, int] = {}
         self.owner_to_node_ids: dict[str, set[int]] = {}  # Quick lookup
 
         # Map run_id to RunRecord
@@ -346,7 +346,7 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
             if node_id in self.nodes:
                 log(ERROR, "Unexpected node registration failure.")
                 return 0
-            if public_key in self.registered_node_public_keys:
+            if public_key in self.node_public_key_to_node_id:
                 raise ValueError("Public key already in use")
 
             # The node is not activated upon creation
@@ -362,7 +362,7 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
                 heartbeat_interval=heartbeat_interval,
                 public_key=public_key,
             )
-            self.registered_node_public_keys.add(public_key)
+            self.node_public_key_to_node_id[public_key] = node_id
             self.owner_to_node_ids.setdefault(owner_aid, set()).add(node_id)
             return node_id
 
@@ -428,7 +428,7 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
                     if node.online_until <= current_ts:
                         node.status = NodeStatus.OFFLINE
                         node.last_deactivated_at = datetime.fromtimestamp(
-                            node.online_until
+                            node.online_until, tz=timezone.utc
                         ).isoformat()
 
     def get_node_public_key(self, node_id: int) -> bytes:
@@ -440,6 +440,11 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
                 raise ValueError(f"Node ID {node_id} not found")
             return node.public_key
 
+    def get_node_id_by_public_key(self, public_key: bytes) -> Optional[int]:
+        """Get `node_id` for the specified `public_key`."""
+        with self.lock:
+            return self.node_public_key_to_node_id.get(public_key)
+
     # pylint: disable=too-many-arguments,too-many-positional-arguments
     def create_run(
         self,
@@ -486,26 +491,6 @@ class InMemoryLinkState(LinkState):  # pylint: disable=R0902,R0904
         log(ERROR, "Unexpected run creation failure.")
         return 0
 
-    def clear_supernode_auth_keys(self) -> None:
-        """Clear stored `node_public_keys` in the link state if any."""
-        with self.lock:
-            self.node_public_keys.clear()
-
-    def store_node_public_keys(self, public_keys: set[bytes]) -> None:
-        """Store a set of `node_public_keys` in the link state."""
-        with self.lock:
-            self.node_public_keys.update(public_keys)
-
-    def store_node_public_key(self, public_key: bytes) -> None:
-        """Store a `node_public_key` in the link state."""
-        with self.lock:
-            self.node_public_keys.add(public_key)
-
-    def get_node_public_keys(self) -> set[bytes]:
-        """Retrieve all currently stored `node_public_keys` as a set."""
-        with self.lock:
-            return self.node_public_keys.copy()
-
     def get_run_ids(self, flwr_aid: Optional[str]) -> set[int]:
         """Retrieve all run IDs if `flwr_aid` is not specified.
 

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/superlink/linkstate/linkstate.py

@@ -149,6 +149,21 @@ class LinkState(CoreState):  # pylint: disable=R0904
         an empty `Set` MUST be returned.
         """
 
+    @abc.abstractmethod
+    def get_node_id_by_public_key(self, public_key: bytes) -> Optional[int]:
+        """Get `node_id` for the specified `public_key`.
+
+        Parameters
+        ----------
+        public_key : bytes
+            The public key of the node whose information is to be retrieved.
+
+        Returns
+        -------
+        Optional[int]
+            The `node_id` associated with the specified `public_key`.
+        """
+
     @abc.abstractmethod
     def get_node_info(
         self,
@@ -298,22 +313,6 @@ class LinkState(CoreState):  # pylint: disable=R0904
             The federation options for the run if it exists; None otherwise.
         """
 
-    @abc.abstractmethod
-    def clear_supernode_auth_keys(self) -> None:
-        """Clear stored `node_public_keys` in the link state if any."""
-
-    @abc.abstractmethod
-    def store_node_public_keys(self, public_keys: set[bytes]) -> None:
-        """Store a set of `node_public_keys` in the link state."""
-
-    @abc.abstractmethod
-    def store_node_public_key(self, public_key: bytes) -> None:
-        """Store a `node_public_key` in the link state."""
-
-    @abc.abstractmethod
-    def get_node_public_keys(self) -> set[bytes]:
-        """Retrieve all currently stored `node_public_keys` as a set."""
-
     @abc.abstractmethod
     def acknowledge_node_heartbeat(
         self, node_id: int, heartbeat_interval: float

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/py/flwr/server/superlink/linkstate/sqlite_linkstate.py

@@ -784,6 +784,19 @@ class SqliteLinkState(LinkState):  # pylint: disable=R0904
         # Return the public key
         return cast(bytes, rows[0]["public_key"])
 
+    def get_node_id_by_public_key(self, public_key: bytes) -> Optional[int]:
+        """Get `node_id` for the specified `public_key`."""
+        query = "SELECT node_id FROM node WHERE public_key = ? AND status != ?;"
+        rows = self.query(query, (public_key, NodeStatus.DELETED))
+
+        # If no result is found, return None
+        if not rows:
+            return None
+
+        # Convert sint64 node_id to uint64
+        node_id = convert_sint64_to_uint64(rows[0]["node_id"])
+        return node_id
+
     # pylint: disable=too-many-arguments,too-many-positional-arguments
     def create_run(
         self,
@@ -835,28 +848,6 @@ class SqliteLinkState(LinkState):  # pylint: disable=R0904
         log(ERROR, "Unexpected run creation failure.")
         return 0
 
-    def clear_supernode_auth_keys(self) -> None:
-        """Clear stored `node_public_keys` in the link state if any."""
-        self.query("DELETE FROM public_key;")
-
-    def store_node_public_keys(self, public_keys: set[bytes]) -> None:
-        """Store a set of `node_public_keys` in the link state."""
-        query = "INSERT INTO public_key (public_key) VALUES (?)"
-        data = [(key,) for key in public_keys]
-        self.query(query, data)
-
-    def store_node_public_key(self, public_key: bytes) -> None:
-        """Store a `node_public_key` in the link state."""
-        query = "INSERT INTO public_key (public_key) VALUES (:public_key)"
-        self.query(query, {"public_key": public_key})
-
-    def get_node_public_keys(self) -> set[bytes]:
-        """Retrieve all currently stored `node_public_keys` as a set."""
-        query = "SELECT public_key FROM public_key"
-        rows = self.query(query)
-        result: set[bytes] = {row["public_key"] for row in rows}
-        return result
-
     def get_run_ids(self, flwr_aid: Optional[str]) -> set[int]:
         """Retrieve all run IDs if `flwr_aid` is not specified.
 

{flwr_nightly-1.23.0.dev20251011 → flwr_nightly-1.23.0.dev20251014}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "flwr-nightly"
-version = "1.23.0.dev20251011"
+version = "1.23.0.dev20251014"
 description = "Flower: A Friendly Federated AI Framework"
 license = "Apache-2.0"
 authors = ["The Flower Authors <hello@flower.ai>"]