fred-core 3.2.0__tar.gz → 3.4.1__tar.gz

{fred_core-3.2.0 → fred_core-3.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-core
-Version: 3.2.0
+Version: 3.4.1
 Summary: Core shared utilities for Fred backends (config, storage, security, and runtime helpers).
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0
@@ -12,7 +12,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: fastapi==0.116.1
+Requires-Dist: fastapi==0.139.0
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: prometheus-client>=0.20.5
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: psycopg[binary]>=3.1.0
@@ -28,6 +29,7 @@ Requires-Dist: langchain-google-genai>=4.2.1
 Requires-Dist: langchain-ollama>=1.0.1
 Requires-Dist: langchain-mistralai>=1.1.2
 Requires-Dist: langchain-google-vertexai>=3.2.2
+Requires-Dist: langchain-anthropic>=0.3.0
 Requires-Dist: langchain-openai>=1.1.14
 Requires-Dist: azure-identity>=1.25.0
 Requires-Dist: authzed>=1.22.1

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/__init__.py

@@ -61,15 +61,7 @@ from fred_core.model.models import ModelProvider
 from fred_core.security.authorization import (
     NO_AUTHZ_CHECK_USER,
     TODO_PASS_REAL_USER,
-    Action,
-    AuthorizationError,
-    Resource,
-    authorize_or_raise,
-    is_authorized,
-    require_admin,
-    require_task_access,
 )
-from fred_core.security.authorization_decorator import authorize
 from fred_core.security.backend_to_backend_auth import (
     M2MAuthConfig,
     M2MBearerAuth,
@@ -80,6 +72,11 @@ from fred_core.security.keycloak.keycloack_admin_client import (
     KeycloackDisabled,
     create_keycloak_admin,
 )
+from fred_core.security.models import (
+    Action,
+    AuthorizationError,
+    Resource,
+)
 from fred_core.security.oidc import (
     decode_jwt,
     get_current_user,
@@ -91,10 +88,11 @@ from fred_core.security.oidc import (
     split_realm_url,
 )
 from fred_core.security.outbound import BearerAuth, ClientCredentialsProvider
-from fred_core.security.rbac import RBACProvider
+from fred_core.security.permission_catalog import list_display_permissions
 from fred_core.security.rebac.openfga_engine import OpenFgaRebacEngine
 from fred_core.security.rebac.rebac_engine import (
     ORGANIZATION_ID,
+    SERVICE_AGENT_ALLOWED_TEAM_PERMISSIONS,
     AgentPermission,
     DocumentPermission,
     OrganizationPermission,
@@ -115,6 +113,7 @@ from fred_core.security.structure import (
     RebacConfiguration,
     SecurityConfiguration,
     UserSecurity,
+    is_service_agent,
 )
 from fred_core.session import SessionSchema
 from fred_core.session.stores import BaseSessionStore, PostgresSessionStore
@@ -164,15 +163,12 @@ __all__ = [
     "GcsFilesystem",
     "FilesystemResourceInfoResult",
     "FilesystemResourceInfo",
-    "RBACProvider",
-    "require_admin",
-    "require_task_access",
+    "is_service_agent",
+    "SERVICE_AGENT_ALLOWED_TEAM_PERMISSIONS",
+    "list_display_permissions",
     "Action",
     "Resource",
     "AuthorizationError",
-    "is_authorized",
-    "authorize_or_raise",
-    "authorize",
     "oauth2_scheme",
     "ClientCredentialsProvider",
     "BearerAuth",

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/common/config_loader.py

@@ -14,15 +14,49 @@
 
 from __future__ import annotations
 
+import sys
 from typing import Callable, TypeVar
 
 import yaml
+from pydantic import ValidationError
 
 from .config_files import ConfigFiles
 
 TConfig = TypeVar("TConfig")
 
 
+def _render_config_error_banner(config_file: str, error: Exception) -> None:
+    """Print a loud, unmissable configuration-error banner to stderr.
+
+    A misconfigured service must not start silently and fail later with an
+    opaque error inside a request handler. We surface the root cause in red at
+    startup. Colours are emitted only on a TTY so log files stay clean.
+    """
+    use_colour = sys.stderr.isatty()
+    red = "\033[1;31m" if use_colour else ""
+    reset = "\033[0m" if use_colour else ""
+    bar = "=" * 78
+
+    if isinstance(error, ValidationError):
+        details = "\n".join(
+            f"  - {' -> '.join(str(p) for p in err['loc']) or '(root)'}: {err['msg']}"
+            for err in error.errors()
+        )
+    else:
+        details = f"  - {error}"
+
+    print(
+        f"\n{red}{bar}\n"
+        f"  CONFIGURATION ERROR — refusing to start\n"
+        f"  file: {config_file}\n"
+        f"{bar}{reset}\n"
+        f"{details}\n"
+        f"{red}{bar}{reset}\n",
+        file=sys.stderr,
+        flush=True,
+    )
+
+
 def parse_yaml_mapping_file(config_file: str) -> dict:
     """Load a YAML file and ensure it is a non-empty mapping."""
     with open(config_file, encoding="utf-8") as file:
@@ -42,7 +76,13 @@ def load_configuration_with_config_files(
     """Load env + config path using ConfigFiles and parse via callback."""
     config_files.load_environment(dotenv_path)
     config_file = config_files.resolve_config_file_path()
-    configuration = parser(config_file)
+    try:
+        configuration = parser(config_file)
+    except (ValidationError, ValueError) as exc:
+        # Render the root cause in red and stop, rather than letting an opaque
+        # traceback (or a deferred runtime 401) bury what is wrong.
+        _render_config_error_banner(config_file, exc)
+        raise SystemExit(1) from exc
     config_files.mark_config_loaded(config_file)
     return configuration
 

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/common/structures.py

@@ -16,7 +16,7 @@ import os
 from enum import Enum
 from typing import Annotated, Any, Dict, Literal, Optional, Union
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
 
 
 class OwnerFilter(str, Enum):
@@ -81,6 +81,25 @@ class OpenSearchStoreConfig(BaseModel):
     secure: bool = Field(default=False, description="Use TLS (https)")
     verify_certs: bool = Field(default=False, description="Verify TLS certs")
 
+    @model_validator(mode="after")
+    def _require_password(self) -> "OpenSearchStoreConfig":
+        """Fail fast at config load if OpenSearch is configured without credentials.
+
+        Reaching this validator means a ``storage.opensearch`` block is present in
+        the active configuration, so the service genuinely depends on OpenSearch.
+        A missing password only surfaces later as an opaque HTTP 401 deep inside a
+        request handler — we convert it into an actionable startup failure instead.
+        """
+        if not self.password:
+            raise ValueError(
+                f"OpenSearch is configured (host={self.host!r}, username="
+                f"{self.username!r}) but no password was provided. "
+                "Set the OPENSEARCH_PASSWORD environment variable (in your .env) "
+                "to the OpenSearch password for this user, or remove the "
+                "storage.opensearch block if OpenSearch is not used."
+            )
+        return self
+
 
 class OpenSearchIndexConfig(BaseModel):
     type: Literal["opensearch"]

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/documents/__init__.py

@@ -38,6 +38,7 @@ from fred_core.documents.document_structures import (
     Tagging,
 )
 from fred_core.documents.postgres_document_store import PostgresDocumentMetadataStore
+from fred_core.documents.tag_models import TagRow
 
 __all__ = [
     # Pydantic models / enums
@@ -64,4 +65,5 @@ __all__ = [
     "DocumentMetadataDeserializationError",
     "DocumentMetadataRow",
     "PostgresDocumentMetadataStore",
+    "TagRow",
 ]

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/documents/document_store.py

@@ -24,8 +24,6 @@ from fred_core.documents.document_structures import DocumentMetadata
 class DocumentMetadataDeserializationError(Exception):
     """Raised when document metadata cannot be parsed correctly due to invalid fields or enum mismatches."""
 
-    pass
-
 
 class BaseDocumentMetadataStore:
     """
@@ -37,7 +35,6 @@ class BaseDocumentMetadataStore:
     @abstractmethod
     async def count_all(self, session: AsyncSession | None = None) -> int:
         """Return the total number of document metadata records in the store."""
-        pass
 
     @abstractmethod
     async def get_all_metadata(
@@ -50,7 +47,6 @@ class BaseDocumentMetadataStore:
         - Keys are metadata field names (e.g., "source_tag", "tags")
         - Values are filter values (exact match). Lists are interpreted as 'terms'.
         """
-        pass
 
     @abstractmethod
     async def get_metadata_by_uid(
@@ -61,7 +57,6 @@ class BaseDocumentMetadataStore:
 
         :raises DocumentMetadataDeserializationError: if stored data is malformed.
         """
-        pass
 
     async def get_metadata_by_uids(
         self, document_uids: list[str], session: AsyncSession | None = None
@@ -88,7 +83,6 @@ class BaseDocumentMetadataStore:
         self, tag_id: str, session: AsyncSession | None = None
     ) -> List[DocumentMetadata]:
         """Return all metadata entries that are tagged with a specific tag ID."""
-        pass
 
     async def browse_metadata_in_tag(
         self,
@@ -107,7 +101,6 @@ class BaseDocumentMetadataStore:
         self, source_tag: str, session: AsyncSession | None = None
     ) -> List[DocumentMetadata]:
         """Return all metadata entries originating from a specific pull source."""
-        pass
 
     @abstractmethod
     async def save_metadata(
@@ -121,7 +114,6 @@ class BaseDocumentMetadataStore:
 
         :raises ValueError: if 'document_uid' is missing.
         """
-        pass
 
     @abstractmethod
     async def delete_metadata(
@@ -132,9 +124,7 @@ class BaseDocumentMetadataStore:
 
         :raises ValueError: if 'document_uid' is missing.
         """
-        pass
 
     @abstractmethod
     async def clear(self, session: AsyncSession | None = None) -> None:
         """Delete all metadata records from the store. Destructive — dev/test only."""
-        pass

fred_core-3.4.1/fred_core/documents/tag_models.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from fred_core.models.base import Base, JsonColumn, TimestampColumn
+
+
+class TagRow(Base):
+    """ORM model for the ``tag`` table — shared between knowledge-flow and the importer."""
+
+    __tablename__ = "tag"
+
+    tag_id: Mapped[str] = mapped_column(String, primary_key=True)
+    created_at: Mapped[datetime | None] = mapped_column(TimestampColumn, nullable=True)
+    updated_at: Mapped[datetime | None] = mapped_column(
+        TimestampColumn, index=True, nullable=True
+    )
+    owner_id: Mapped[str | None] = mapped_column(String, index=True, nullable=True)
+    name: Mapped[str | None] = mapped_column(String, index=True, nullable=True)
+    path: Mapped[str | None] = mapped_column(String, index=True, nullable=True)
+    description: Mapped[str | None] = mapped_column(String, nullable=True)
+    type: Mapped[str | None] = mapped_column(String, index=True, nullable=True)
+    doc: Mapped[dict | None] = mapped_column(JsonColumn, nullable=True)

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/filesystem/gcs_filesystem.py

@@ -17,14 +17,13 @@ import re
 import time
 from typing import List, Optional, Set
 
-from google.cloud import storage
-from google.cloud.exceptions import NotFound
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,
     FilesystemResourceInfoResult,
 )
+from google.cloud import storage
+from google.cloud.exceptions import NotFound
 
 logger = logging.getLogger(__name__)
 

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/filesystem/local_filesystem.py

@@ -20,7 +20,6 @@ from pathlib import Path
 from typing import List
 
 import aiofiles
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/filesystem/minio_filesystem.py

@@ -18,14 +18,13 @@ from io import BytesIO
 from typing import List, Set
 from urllib.parse import urlparse
 
-from minio import Minio
-from minio.deleteobjects import DeleteObject
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,
     FilesystemResourceInfoResult,
 )
+from minio import Minio
+from minio.deleteobjects import DeleteObject
 
 logger = logging.getLogger(__name__)
 

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/history/base_history_store.py

@@ -148,6 +148,22 @@ class BaseHistoryStore(ABC):
         """
         raise NotImplementedError
 
+    async def session_exists(
+        self,
+        session_id: str,
+    ) -> bool:
+        """
+        Return True iff any history row exists for ``session_id`` (any owner).
+
+        Why this exists:
+        - paired with :meth:`session_belongs_to_user`, this lets a caller enforce a
+          private-per-owner policy: a session that EXISTS but does not belong to the
+          authenticated user must be refused (RUNTIME-07 rev. 2, finding F-C). It
+          distinguishes a brand-new session (allow — the caller becomes owner) from
+          another user's session (deny).
+        """
+        raise NotImplementedError
+
 
 class NoOpHistoryStore(BaseHistoryStore):
     """
@@ -199,3 +215,9 @@ class NoOpHistoryStore(BaseHistoryStore):
         user_id: str,
     ) -> bool:
         return False
+
+    async def session_exists(
+        self,
+        session_id: str,
+    ) -> bool:
+        return False

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/history/postgres_history_store.py

@@ -368,6 +368,21 @@ class PostgresHistoryStore(BaseHistoryStore):
             )
             return (result.scalar() or 0) > 0
 
+    async def session_exists(
+        self,
+        session_id: str,
+        session: AsyncSession | None = None,
+    ) -> bool:
+        """Return True iff any history row exists for ``session_id`` (any owner)."""
+        await self._ensure_tables()
+        async with use_session(self._sessions, session) as s:
+            result = await s.execute(
+                select(func.count()).where(
+                    SessionHistoryRow.session_id == session_id,
+                )
+            )
+            return (result.scalar() or 0) > 0
+
     # ------------------------------------------------------------------
     # Rank helper
     # ------------------------------------------------------------------

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/kpi/opensearch_kpi_store.py

@@ -64,6 +64,10 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "env": {"type": "keyword"},
                     "cluster": {"type": "keyword"},
                     "user_id": {"type": "keyword"},
+                    # Conversation id carried by every session-scoped KPI row
+                    # (react/graph phase, tool). Explicit keyword so the RGPD
+                    # erasure `update_by_query` can `term`-match it (CTRLP-12 A3).
+                    "session_id": {"type": "keyword"},
                     "exchange_id": {"type": "keyword"},
                     "agent_id": {"type": "keyword"},
                     "agent_step": {"type": "keyword"},
@@ -170,6 +174,11 @@ class OpenSearchKPIStore(BaseKPIStore):
                 logger.info("[OPENSEARCH][KPI] created index '%s'", self.index)
             else:
                 logger.info("[OPENSEARCH][KPI] index '%s' already exists.", self.index)
+                # CTRLP-12: session_id was added to KPI_INDEX_MAPPING for RGPD
+                # conversation erasure. Existing indices predate it, so add it
+                # additively (put_mapping) before validation — otherwise startup
+                # fails with "Missing nested field: 'dims.session_id'".
+                self._ensure_dim_mapping("session_id", {"type": "keyword"})
                 self._ensure_dim_mapping("service", {"type": "keyword"})
                 self._ensure_dim_mapping("team_id", {"type": "keyword"})
                 self._ensure_dim_mapping("agent_instance_id", {"type": "keyword"})
@@ -234,6 +243,57 @@ class OpenSearchKPIStore(BaseKPIStore):
             logger.error("[OPENSEARCH][KPI] bulk_index failed: %s", e)
             raise
 
+    # -- erasure (RGPD) --------------------------------------------------------
+    def anonymise_for_session(self, session_id: str) -> int:
+        """Anonymise — not delete — every KPI row of one conversation (CTRLP-12 A3).
+
+        RGPD default per RFC §3.3: KPI events are an analytics *aggregate*, not
+        conversation content, so erasure severs the link to a person rather than
+        dropping the rows. An OpenSearch `update_by_query` (the same primitive the
+        vector store uses for `delete_by_query`) nulls the direct identifiers on
+        the session's rows: `dims.session_id`, `dims.user_id`, `dims.exchange_id`
+        and — for any generic session-scoped analytics row — `dims.scope_id`.
+        Aggregate counts are untouched — the rows survive, now anonymous. Returns
+        the number of rows anonymised.
+
+        A session's rows are matched by `dims.session_id == session_id`, the dim
+        every session-scoped KPI row actually carries (react/graph `phase_latency`
+        and `tool_*` all set `dims.session_id`; see the runtime KPI emitters). A
+        pure aggregate with no `session_id` (e.g. `llm.call_latency_ms` emitted
+        under a system actor) carries no personal identifier and is correctly out
+        of per-conversation scope. Idempotent: once `session_id` is nulled the row
+        no longer matches, so a second erase updates zero.
+        """
+        body: Dict[str, Any] = {
+            "query": {"bool": {"filter": [{"term": {"dims.session_id": session_id}}]}},
+            "script": {
+                "lang": "painless",
+                "source": (
+                    "if (ctx._source.dims != null) "
+                    "{ for (f in params.fields) { ctx._source.dims.remove(f); } }"
+                ),
+                "params": {
+                    "fields": ["session_id", "scope_id", "user_id", "exchange_id"]
+                },
+            },
+        }
+        try:
+            resp = self.client.update_by_query(
+                index=self.index,
+                body=body,
+                params={"conflicts": "proceed", "refresh": "true"},
+            )
+            updated = int(resp.get("updated", 0))
+            logger.info(
+                "[OPENSEARCH][KPI] anonymised %s row(s) for session_id=%s",
+                updated,
+                session_id,
+            )
+            return updated
+        except OpenSearchException as e:
+            logger.error("[OPENSEARCH][KPI] anonymise_for_session failed: %s", e)
+            raise
+
     # -- reads -----------------------------------------------------------------
     def query(self, q: KPIQuery) -> KPIQueryResult:
         logger.info(

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/logs/log_setup.py

@@ -81,7 +81,7 @@ class StoreEmitHandler(logging.Handler):
                 payload = json.loads(raw)
             except Exception:
                 print("Log record is not JSON: %s", raw)
-                pass  # formatter should be JSON, but we tolerate plain text
+                # formatter should be JSON, but we tolerate plain text
 
             if payload:
                 mapped_level = LEVEL_MAP.get(payload.get("level"), record.levelname)

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/model/factory.py

@@ -13,6 +13,9 @@ from collections.abc import AsyncGenerator, Generator
 from typing import Any, Dict, Iterable, Optional, Protocol, Sequence, Type, cast
 
 import httpx
+from fred_core.common import ModelConfiguration
+from fred_core.model.http_clients import get_shared_stack, strip_transport_settings
+from fred_core.model.models import ModelProvider
 from langchain_core.embeddings import Embeddings as LCEmbeddings
 from langchain_core.language_models.chat_models import BaseChatModel
 from langchain_core.output_parsers import PydanticOutputParser
@@ -26,10 +29,6 @@ from langchain_openai import (
 )
 from pydantic import BaseModel
 
-from fred_core.common import ModelConfiguration
-from fred_core.model.http_clients import get_shared_stack, strip_transport_settings
-from fred_core.model.models import ModelProvider
-
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
@@ -572,6 +571,61 @@ def get_model(cfg: Optional[ModelConfiguration]) -> BaseChatModel:
             **settings,
         )
 
+    # --- Provider: Anthropic (native + Synapse Gateway) ---
+    if provider == ModelProvider.ANTHROPIC.value:
+        if not cfg.name:
+            raise ValueError(
+                "Anthropic chat requires 'name' (e.g., claude-sonnet-4-5)."
+            )
+        # Accept both ANTHROPIC_API_KEY (standard) and ANTHROPIC_AUTH_TOKEN (legacy/Thales env)
+        api_key = os.getenv("ANTHROPIC_API_KEY") or os.getenv("ANTHROPIC_AUTH_TOKEN")
+        if not api_key:
+            raise ValueError(
+                "Missing required environment variable: ANTHROPIC_API_KEY (or ANTHROPIC_AUTH_TOKEN)"
+            )
+        base_url = settings.pop("base_url", None)
+
+        # --- Proxy bypass patch (WSL / corporate proxy environments) ---
+        # WSL sets lowercase no_proxy in the shell before the process starts; python-dotenv
+        # does not override already-set env vars by default, so our .env value is ignored.
+        # httpx prefers lowercase no_proxy over NO_PROXY, so we must patch it here at the
+        # Python level before the Anthropic SDK constructs its internal httpx client.
+        _effective_base = base_url or os.getenv("ANTHROPIC_BASE_URL") or ""
+        if _effective_base:
+            try:
+                from urllib.parse import urlparse as _urlparse
+
+                _host = _urlparse(_effective_base).hostname or ""
+                if _host:
+                    _no_proxy = os.environ.get("no_proxy", "")
+                    _parts = {h.strip() for h in _no_proxy.split(",") if h.strip()}
+                    if _host not in _parts:
+                        _parts.add(_host)
+                        os.environ["no_proxy"] = ",".join(sorted(_parts))
+                        logger.info(
+                            "[MODEL][ANTHROPIC] Patched no_proxy: added %s for direct connection",
+                            _host,
+                        )
+            except Exception:  # nosec B110 — best-effort proxy patch; must not block model construction
+                pass
+
+        _info_provider(cfg, settings)
+        logger.info(
+            "[MODEL][ANTHROPIC] Constructing ChatAnthropic model=%s base_url=%s",
+            cfg.name,
+            base_url or "(default, from ANTHROPIC_BASE_URL env)",
+        )
+        try:
+            from langchain_anthropic import ChatAnthropic
+        except ImportError as e:
+            raise ImportError(
+                "Provider 'anthropic' requires package 'langchain-anthropic'."
+            ) from e
+        ctor_kwargs: Dict[str, Any] = {"model": cfg.name, "anthropic_api_key": api_key}
+        if base_url:
+            ctor_kwargs["base_url"] = base_url
+        return ChatAnthropic(**ctor_kwargs, **settings)
+
     raise ValueError(f"Unsupported chat provider: {provider}")
 
 
@@ -777,6 +831,7 @@ def get_structured_chain(schema: Type[BaseModel], model_config: ModelConfigurati
         ModelProvider.AZURE_APIM.value,
         ModelProvider.VERTEX_AI.value,
         ModelProvider.VERTEX_AI_MODEL_GARDEN.value,
+        ModelProvider.ANTHROPIC.value,
     }:
         try:
             structured = model.with_structured_output(schema, method="function_calling")

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/model/http_clients.py

@@ -14,7 +14,6 @@ from dataclasses import dataclass
 from typing import Any, Dict, Optional, Tuple
 
 import httpx
-
 from fred_core.common import ModelConfiguration
 
 logger = logging.getLogger(__name__)

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/model/models.py

@@ -18,6 +18,7 @@ from enum import Enum
 class ModelProvider(Enum):
     """Enumeration of model providers available in the system."""
 
+    ANTHROPIC = "anthropic"
     AZURE_APIM = "azure-apim"
     AZURE_OPENAI = "azure-openai"
     OLLAMA = "ollama"

fred_core-3.4.1/fred_core/security/authorization.py

@@ -0,0 +1,43 @@
+# Copyright Thales 2025
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Residual authorization helpers after the RBAC→ReBAC migration (AUTHZ-01).
+
+Role-based authorization (RBACProvider / @authorize / authorize_or_raise /
+is_authorized / require_admin) has been removed — all endpoint authorization is now
+ReBAC (OpenFGA). Task access authorization (list / stream / cancel) lives in its own
+canonical owner, ``fred_core.tasks.authz`` (CTRLP-12), and is ReBAC-based; this module
+only retains the internal service-principal users below.
+"""
+
+from fred_core.security.structure import KeycloakUser
+
+# Fake user to use when a function requires a user but we don't have one yet
+# but should have one when authorization is added to the service.
+# This is a temporary workaround and should be replaced with a real user.
+TODO_PASS_REAL_USER = KeycloakUser(
+    uid="internal-admin-todo",
+    username="internal admin - todo",
+    email="internal-admin-todo@localhost",
+    roles=["admin"],
+)
+
+# Internal admin user to use for system operations that must always succeed
+# and should not be subject to authorization checks.
+NO_AUTHZ_CHECK_USER = KeycloakUser(
+    uid="internal-admin",
+    username="internal admin",
+    email="internal-admin@localhost",
+    roles=["admin"],
+)

{fred_core-3.2.0 → fred_core-3.4.1}/fred_core/security/keycloak/keycloack_admin_client.py

@@ -29,8 +29,6 @@ class KeycloackDisabled:
     to let know the caller it must handle this case.
     """
 
-    ...
-
 
 def create_keycloak_admin(
     m2m_security: M2MSecurity,