fred-core 3.4.0__tar.gz → 3.4.2__tar.gz

{fred_core-3.4.0 → fred_core-3.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-core
-Version: 3.4.0
+Version: 3.4.2
 Summary: Core shared utilities for Fred backends (config, storage, security, and runtime helpers).
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0
@@ -12,7 +12,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: fastapi==0.116.1
+Requires-Dist: fastapi==0.139.0
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: prometheus-client>=0.20.5
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: psycopg[binary]>=3.1.0
@@ -28,6 +29,7 @@ Requires-Dist: langchain-google-genai>=4.2.1
 Requires-Dist: langchain-ollama>=1.0.1
 Requires-Dist: langchain-mistralai>=1.1.2
 Requires-Dist: langchain-google-vertexai>=3.2.2
+Requires-Dist: langchain-anthropic>=0.3.0
 Requires-Dist: langchain-openai>=1.1.14
 Requires-Dist: azure-identity>=1.25.0
 Requires-Dist: authzed>=1.22.1

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/__init__.py

@@ -61,15 +61,7 @@ from fred_core.model.models import ModelProvider
 from fred_core.security.authorization import (
     NO_AUTHZ_CHECK_USER,
     TODO_PASS_REAL_USER,
-    Action,
-    AuthorizationError,
-    Resource,
-    authorize_or_raise,
-    is_authorized,
-    require_admin,
-    require_task_access,
 )
-from fred_core.security.authorization_decorator import authorize
 from fred_core.security.backend_to_backend_auth import (
     M2MAuthConfig,
     M2MBearerAuth,
@@ -80,6 +72,11 @@ from fred_core.security.keycloak.keycloack_admin_client import (
     KeycloackDisabled,
     create_keycloak_admin,
 )
+from fred_core.security.models import (
+    Action,
+    AuthorizationError,
+    Resource,
+)
 from fred_core.security.oidc import (
     decode_jwt,
     get_current_user,
@@ -91,10 +88,10 @@ from fred_core.security.oidc import (
     split_realm_url,
 )
 from fred_core.security.outbound import BearerAuth, ClientCredentialsProvider
-from fred_core.security.rbac import RBACProvider
 from fred_core.security.rebac.openfga_engine import OpenFgaRebacEngine
 from fred_core.security.rebac.rebac_engine import (
     ORGANIZATION_ID,
+    SERVICE_AGENT_ALLOWED_TEAM_PERMISSIONS,
     AgentPermission,
     DocumentPermission,
     OrganizationPermission,
@@ -115,6 +112,7 @@ from fred_core.security.structure import (
     RebacConfiguration,
     SecurityConfiguration,
     UserSecurity,
+    is_service_agent,
 )
 from fred_core.session import SessionSchema
 from fred_core.session.stores import BaseSessionStore, PostgresSessionStore
@@ -164,15 +162,11 @@ __all__ = [
     "GcsFilesystem",
     "FilesystemResourceInfoResult",
     "FilesystemResourceInfo",
-    "RBACProvider",
-    "require_admin",
-    "require_task_access",
+    "is_service_agent",
+    "SERVICE_AGENT_ALLOWED_TEAM_PERMISSIONS",
     "Action",
     "Resource",
     "AuthorizationError",
-    "is_authorized",
-    "authorize_or_raise",
-    "authorize",
     "oauth2_scheme",
     "ClientCredentialsProvider",
     "BearerAuth",

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/common/__init__.py

@@ -38,7 +38,7 @@ from .structures import (
     StoreConfig,
     TemporalSchedulerConfig,
 )
-from .team_id import TeamId, personal_team_id
+from .team_id import TeamId, is_personal_team_id, personal_team_id
 from .utils import raise_internal_error
 
 __all__ = [
@@ -58,6 +58,7 @@ __all__ = [
     "PostgresTableConfig",
     "StoreConfig",
     "TeamId",
+    "is_personal_team_id",
     "personal_team_id",
     "TemporalSchedulerConfig",
     "ThreadSafeLRUCache",

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/common/fastapi_handlers.py

@@ -22,11 +22,12 @@ from fred_core.security.models import AuthorizationError, Resource
 logger = logging.getLogger(__name__)
 
 _TEAM_PERMISSION_MESSAGES: dict[str, str] = {
-    "can_update_resources": "You are not allowed to manage resources in this team. Ask a team owner or manager.",
-    "can_update_agents": "You are not allowed to manage agents in this team. Ask a team owner or manager.",
+    "can_update_resources": "You are not allowed to manage resources in this team. Ask a team admin or editor.",
+    "can_update_agents": "You are not allowed to manage agents in this team. Ask a team admin or editor.",
     "can_administer_members": "You are not allowed to manage members in this team.",
-    "can_administer_managers": "You are not allowed to manage managers in this team.",
-    "can_administer_owners": "You are not allowed to manage owners in this team.",
+    "can_administer_editors": "You are not allowed to manage editors in this team.",
+    "can_administer_analysts": "You are not allowed to manage analysts in this team.",
+    "can_administer_admins": "You are not allowed to manage admins in this team.",
     "can_read_members": "You are not allowed to view team members.",
     "can_update_info": "You are not allowed to update this team.",
 }

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/common/structures.py

@@ -40,6 +40,11 @@ class TemporalSchedulerConfig(BaseModel):
     task_queue: str = "default"
     workflow_id_prefix: str = "task"
     connect_timeout_seconds: Optional[int] = 5
+    rpc_timeout_seconds: Optional[int] = Field(
+        default=10,
+        description="Deadline applied to individual Temporal RPC calls (start_workflow, describe) "
+        "so a stuck Temporal frontend cannot hang the caller indefinitely.",
+    )
     ingestion_workflow_parallelism: int = Field(
         default=3,
         ge=1,

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/documents/document_store.py

@@ -24,8 +24,6 @@ from fred_core.documents.document_structures import DocumentMetadata
 class DocumentMetadataDeserializationError(Exception):
     """Raised when document metadata cannot be parsed correctly due to invalid fields or enum mismatches."""
 
-    pass
-
 
 class BaseDocumentMetadataStore:
     """
@@ -37,7 +35,6 @@ class BaseDocumentMetadataStore:
     @abstractmethod
     async def count_all(self, session: AsyncSession | None = None) -> int:
         """Return the total number of document metadata records in the store."""
-        pass
 
     @abstractmethod
     async def get_all_metadata(
@@ -50,7 +47,6 @@ class BaseDocumentMetadataStore:
         - Keys are metadata field names (e.g., "source_tag", "tags")
         - Values are filter values (exact match). Lists are interpreted as 'terms'.
         """
-        pass
 
     @abstractmethod
     async def get_metadata_by_uid(
@@ -61,7 +57,6 @@ class BaseDocumentMetadataStore:
 
         :raises DocumentMetadataDeserializationError: if stored data is malformed.
         """
-        pass
 
     async def get_metadata_by_uids(
         self, document_uids: list[str], session: AsyncSession | None = None
@@ -88,7 +83,6 @@ class BaseDocumentMetadataStore:
         self, tag_id: str, session: AsyncSession | None = None
     ) -> List[DocumentMetadata]:
         """Return all metadata entries that are tagged with a specific tag ID."""
-        pass
 
     async def browse_metadata_in_tag(
         self,
@@ -107,7 +101,6 @@ class BaseDocumentMetadataStore:
         self, source_tag: str, session: AsyncSession | None = None
     ) -> List[DocumentMetadata]:
         """Return all metadata entries originating from a specific pull source."""
-        pass
 
     @abstractmethod
     async def save_metadata(
@@ -121,7 +114,6 @@ class BaseDocumentMetadataStore:
 
         :raises ValueError: if 'document_uid' is missing.
         """
-        pass
 
     @abstractmethod
     async def delete_metadata(
@@ -132,9 +124,7 @@ class BaseDocumentMetadataStore:
 
         :raises ValueError: if 'document_uid' is missing.
         """
-        pass
 
     @abstractmethod
     async def clear(self, session: AsyncSession | None = None) -> None:
         """Delete all metadata records from the store. Destructive — dev/test only."""
-        pass

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/filesystem/gcs_filesystem.py

@@ -17,14 +17,13 @@ import re
 import time
 from typing import List, Optional, Set
 
-from google.cloud import storage
-from google.cloud.exceptions import NotFound
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,
     FilesystemResourceInfoResult,
 )
+from google.cloud import storage
+from google.cloud.exceptions import NotFound
 
 logger = logging.getLogger(__name__)
 

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/filesystem/local_filesystem.py

@@ -20,7 +20,6 @@ from pathlib import Path
 from typing import List
 
 import aiofiles
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/filesystem/minio_filesystem.py

@@ -18,14 +18,13 @@ from io import BytesIO
 from typing import List, Set
 from urllib.parse import urlparse
 
-from minio import Minio
-from minio.deleteobjects import DeleteObject
-
 from fred_core.filesystem.structures import (
     BaseFilesystem,
     FilesystemResourceInfo,
     FilesystemResourceInfoResult,
 )
+from minio import Minio
+from minio.deleteobjects import DeleteObject
 
 logger = logging.getLogger(__name__)
 

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/kpi/kpi_phase_metric.py

@@ -17,7 +17,7 @@ from contextlib import asynccontextmanager
 from fred_core.kpi.base_kpi_writer import BaseKPIWriter
 from fred_core.kpi.kpi_writer_structures import Dims, KPIActor
 
-PHASE_METRIC_ACTOR = KPIActor(type="system", user_id=None, groups=None)
+PHASE_METRIC_ACTOR = KPIActor(type="system", user_id=None)
 
 
 def record_phase_metric(

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/kpi/kpi_writer.py

@@ -123,7 +123,7 @@ def to_kpi_actor(user: KeycloakUser) -> KPIActor:
     - Fred’s KPI model is actor-centric (human/agent/system). We always attribute
       costs and usage to an actor to support per-user chargeback and audits.
     """
-    return KPIActor(type="human", user_id=user.uid, groups=user.groups)
+    return KPIActor(type="human", user_id=user.uid)
 
 
 # -------------------------
@@ -196,8 +196,6 @@ class KPIWriter(BaseKPIWriter):
         _dims["actor_type"] = actor.type
         if actor.user_id:
             _dims["user_id"] = actor.user_id
-        if "groups" not in _dims and actor.groups:
-            _dims["groups"] = ",".join(sorted(actor.groups))
         merged_dims = _merge_dims(self.defaults, _dims)
 
         event = KPIEvent(

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/kpi/kpi_writer_structures.py

@@ -149,7 +149,6 @@ class KPIActor(BaseModel):
 
     type: Literal["human", "system"]
     user_id: Optional[str] = None
-    groups: Optional[list[str]] = None
 
     @field_validator("user_id")
     @classmethod

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/kpi/opensearch_kpi_store.py

@@ -64,6 +64,10 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "env": {"type": "keyword"},
                     "cluster": {"type": "keyword"},
                     "user_id": {"type": "keyword"},
+                    # Conversation id carried by every session-scoped KPI row
+                    # (react/graph phase, tool). Explicit keyword so the RGPD
+                    # erasure `update_by_query` can `term`-match it (CTRLP-12 A3).
+                    "session_id": {"type": "keyword"},
                     "exchange_id": {"type": "keyword"},
                     "agent_id": {"type": "keyword"},
                     "agent_step": {"type": "keyword"},
@@ -99,7 +103,6 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "system_prompt_chars": {"type": "keyword"},
                     "template_id": {"type": "keyword"},
                     "source_runtime_id": {"type": "keyword"},
-                    "groups": {"type": "keyword"},
                 }
             },
             "cost": {
@@ -116,6 +119,8 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "bytes_out": {"type": "long"},
                     "chunks": {"type": "integer"},
                     "vectors": {"type": "integer"},
+                    "input_tokens": {"type": "long"},
+                    "output_tokens": {"type": "long"},
                 }
             },
             "labels": {"type": "keyword"},
@@ -170,6 +175,11 @@ class OpenSearchKPIStore(BaseKPIStore):
                 logger.info("[OPENSEARCH][KPI] created index '%s'", self.index)
             else:
                 logger.info("[OPENSEARCH][KPI] index '%s' already exists.", self.index)
+                # CTRLP-12: session_id was added to KPI_INDEX_MAPPING for RGPD
+                # conversation erasure. Existing indices predate it, so add it
+                # additively (put_mapping) before validation — otherwise startup
+                # fails with "Missing nested field: 'dims.session_id'".
+                self._ensure_dim_mapping("session_id", {"type": "keyword"})
                 self._ensure_dim_mapping("service", {"type": "keyword"})
                 self._ensure_dim_mapping("team_id", {"type": "keyword"})
                 self._ensure_dim_mapping("agent_instance_id", {"type": "keyword"})
@@ -181,7 +191,11 @@ class OpenSearchKPIStore(BaseKPIStore):
                 self._ensure_dim_mapping("system_prompt_chars", {"type": "keyword"})
                 self._ensure_dim_mapping("template_id", {"type": "keyword"})
                 self._ensure_dim_mapping("source_runtime_id", {"type": "keyword"})
-                self._ensure_dim_mapping("groups", {"type": "keyword"})
+                # OBSERV-02: quantities.input_tokens/output_tokens were written by
+                # agent.turn_completed since Phase 7 but never mapped, so they were
+                # unaggregatable. Added additively for existing indices.
+                self._ensure_quantities_mapping("input_tokens", {"type": "long"})
+                self._ensure_quantities_mapping("output_tokens", {"type": "long"})
                 # Validate existing mapping matches expected mapping
                 validate_index_mapping(self.client, self.index, KPI_INDEX_MAPPING)
         except OpenSearchException as e:
@@ -209,6 +223,27 @@ class OpenSearchKPIStore(BaseKPIStore):
                 "[OPENSEARCH][KPI] failed to add dims.%s mapping: %s", name, e
             )
 
+    def _ensure_quantities_mapping(self, name: str, mapping: Dict[str, Any]) -> None:
+        try:
+            current_mapping_resp = self.client.indices.get_mapping(index=self.index)
+            current_mapping = current_mapping_resp.get(self.index, {}).get(
+                "mappings", {}
+            )
+            quantities_props = (
+                current_mapping.get("properties", {})
+                .get("quantities", {})
+                .get("properties", {})
+            )
+            if name in quantities_props:
+                return
+            body = {"properties": {"quantities": {"properties": {name: mapping}}}}
+            self.client.indices.put_mapping(index=self.index, body=body)
+            logger.info("[OPENSEARCH][KPI] added quantities.%s mapping", name)
+        except OpenSearchException as e:
+            logger.warning(
+                "[OPENSEARCH][KPI] failed to add quantities.%s mapping: %s", name, e
+            )
+
     # -- writes ----------------------------------------------------------------
     def index_event(self, event: KPIEvent) -> None:
         try:
@@ -234,6 +269,57 @@ class OpenSearchKPIStore(BaseKPIStore):
             logger.error("[OPENSEARCH][KPI] bulk_index failed: %s", e)
             raise
 
+    # -- erasure (RGPD) --------------------------------------------------------
+    def anonymise_for_session(self, session_id: str) -> int:
+        """Anonymise — not delete — every KPI row of one conversation (CTRLP-12 A3).
+
+        RGPD default per RFC §3.3: KPI events are an analytics *aggregate*, not
+        conversation content, so erasure severs the link to a person rather than
+        dropping the rows. An OpenSearch `update_by_query` (the same primitive the
+        vector store uses for `delete_by_query`) nulls the direct identifiers on
+        the session's rows: `dims.session_id`, `dims.user_id`, `dims.exchange_id`
+        and — for any generic session-scoped analytics row — `dims.scope_id`.
+        Aggregate counts are untouched — the rows survive, now anonymous. Returns
+        the number of rows anonymised.
+
+        A session's rows are matched by `dims.session_id == session_id`, the dim
+        every session-scoped KPI row actually carries (react/graph `phase_latency`
+        and `tool_*` all set `dims.session_id`; see the runtime KPI emitters). A
+        pure aggregate with no `session_id` (e.g. `llm.call_latency_ms` emitted
+        under a system actor) carries no personal identifier and is correctly out
+        of per-conversation scope. Idempotent: once `session_id` is nulled the row
+        no longer matches, so a second erase updates zero.
+        """
+        body: Dict[str, Any] = {
+            "query": {"bool": {"filter": [{"term": {"dims.session_id": session_id}}]}},
+            "script": {
+                "lang": "painless",
+                "source": (
+                    "if (ctx._source.dims != null) "
+                    "{ for (f in params.fields) { ctx._source.dims.remove(f); } }"
+                ),
+                "params": {
+                    "fields": ["session_id", "scope_id", "user_id", "exchange_id"]
+                },
+            },
+        }
+        try:
+            resp = self.client.update_by_query(
+                index=self.index,
+                body=body,
+                params={"conflicts": "proceed", "refresh": "true"},
+            )
+            updated = int(resp.get("updated", 0))
+            logger.info(
+                "[OPENSEARCH][KPI] anonymised %s row(s) for session_id=%s",
+                updated,
+                session_id,
+            )
+            return updated
+        except OpenSearchException as e:
+            logger.error("[OPENSEARCH][KPI] anonymise_for_session failed: %s", e)
+            raise
+
     # -- reads -----------------------------------------------------------------
     def query(self, q: KPIQuery) -> KPIQueryResult:
         logger.info(

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/logs/log_setup.py

@@ -81,7 +81,7 @@ class StoreEmitHandler(logging.Handler):
                 payload = json.loads(raw)
             except Exception:
                 print("Log record is not JSON: %s", raw)
-                pass  # formatter should be JSON, but we tolerate plain text
+                # formatter should be JSON, but we tolerate plain text
 
             if payload:
                 mapped_level = LEVEL_MAP.get(payload.get("level"), record.levelname)

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/model/factory.py

@@ -13,6 +13,9 @@ from collections.abc import AsyncGenerator, Generator
 from typing import Any, Dict, Iterable, Optional, Protocol, Sequence, Type, cast
 
 import httpx
+from fred_core.common import ModelConfiguration
+from fred_core.model.http_clients import get_shared_stack, strip_transport_settings
+from fred_core.model.models import ModelProvider
 from langchain_core.embeddings import Embeddings as LCEmbeddings
 from langchain_core.language_models.chat_models import BaseChatModel
 from langchain_core.output_parsers import PydanticOutputParser
@@ -26,10 +29,6 @@ from langchain_openai import (
 )
 from pydantic import BaseModel
 
-from fred_core.common import ModelConfiguration
-from fred_core.model.http_clients import get_shared_stack, strip_transport_settings
-from fred_core.model.models import ModelProvider
-
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
@@ -572,6 +571,61 @@ def get_model(cfg: Optional[ModelConfiguration]) -> BaseChatModel:
             **settings,
         )
 
+    # --- Provider: Anthropic (native + Synapse Gateway) ---
+    if provider == ModelProvider.ANTHROPIC.value:
+        if not cfg.name:
+            raise ValueError(
+                "Anthropic chat requires 'name' (e.g., claude-sonnet-4-5)."
+            )
+        # Accept both ANTHROPIC_API_KEY (standard) and ANTHROPIC_AUTH_TOKEN (legacy/Thales env)
+        api_key = os.getenv("ANTHROPIC_API_KEY") or os.getenv("ANTHROPIC_AUTH_TOKEN")
+        if not api_key:
+            raise ValueError(
+                "Missing required environment variable: ANTHROPIC_API_KEY (or ANTHROPIC_AUTH_TOKEN)"
+            )
+        base_url = settings.pop("base_url", None)
+
+        # --- Proxy bypass patch (WSL / corporate proxy environments) ---
+        # WSL sets lowercase no_proxy in the shell before the process starts; python-dotenv
+        # does not override already-set env vars by default, so our .env value is ignored.
+        # httpx prefers lowercase no_proxy over NO_PROXY, so we must patch it here at the
+        # Python level before the Anthropic SDK constructs its internal httpx client.
+        _effective_base = base_url or os.getenv("ANTHROPIC_BASE_URL") or ""
+        if _effective_base:
+            try:
+                from urllib.parse import urlparse as _urlparse
+
+                _host = _urlparse(_effective_base).hostname or ""
+                if _host:
+                    _no_proxy = os.environ.get("no_proxy", "")
+                    _parts = {h.strip() for h in _no_proxy.split(",") if h.strip()}
+                    if _host not in _parts:
+                        _parts.add(_host)
+                        os.environ["no_proxy"] = ",".join(sorted(_parts))
+                        logger.info(
+                            "[MODEL][ANTHROPIC] Patched no_proxy: added %s for direct connection",
+                            _host,
+                        )
+            except Exception:  # nosec B110 — best-effort proxy patch; must not block model construction
+                pass
+
+        _info_provider(cfg, settings)
+        logger.info(
+            "[MODEL][ANTHROPIC] Constructing ChatAnthropic model=%s base_url=%s",
+            cfg.name,
+            base_url or "(default, from ANTHROPIC_BASE_URL env)",
+        )
+        try:
+            from langchain_anthropic import ChatAnthropic
+        except ImportError as e:
+            raise ImportError(
+                "Provider 'anthropic' requires package 'langchain-anthropic'."
+            ) from e
+        ctor_kwargs: Dict[str, Any] = {"model": cfg.name, "anthropic_api_key": api_key}
+        if base_url:
+            ctor_kwargs["base_url"] = base_url
+        return ChatAnthropic(**ctor_kwargs, **settings)
+
     raise ValueError(f"Unsupported chat provider: {provider}")
 
 
@@ -777,6 +831,7 @@ def get_structured_chain(schema: Type[BaseModel], model_config: ModelConfigurati
         ModelProvider.AZURE_APIM.value,
         ModelProvider.VERTEX_AI.value,
         ModelProvider.VERTEX_AI_MODEL_GARDEN.value,
+        ModelProvider.ANTHROPIC.value,
     }:
         try:
             structured = model.with_structured_output(schema, method="function_calling")

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/model/http_clients.py

@@ -14,7 +14,6 @@ from dataclasses import dataclass
 from typing import Any, Dict, Optional, Tuple
 
 import httpx
-
 from fred_core.common import ModelConfiguration
 
 logger = logging.getLogger(__name__)

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/model/models.py

@@ -18,6 +18,7 @@ from enum import Enum
 class ModelProvider(Enum):
     """Enumeration of model providers available in the system."""
 
+    ANTHROPIC = "anthropic"
     AZURE_APIM = "azure-apim"
     AZURE_OPENAI = "azure-openai"
     OLLAMA = "ollama"

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/portable/observability.py

@@ -209,7 +209,6 @@ class MetricsProvider:
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         """Time a block. Yields a mutable dims dict callers can annotate."""
         yield dict(dims) if dims else {}
@@ -238,7 +237,6 @@ class LoggingMetricsProvider(MetricsProvider):
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         import time as _time
 
@@ -258,7 +256,6 @@ class LoggingMetricsProvider(MetricsProvider):
                         "name": name,
                         "dims": d,
                         "duration_ms": round((_time.perf_counter() - start) * 1000, 2),
-                        "groups": groups,
                     }
                 },
             )
@@ -305,7 +302,6 @@ class InMemoryMetricsProvider(MetricsProvider):
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         import time as _time
 

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/scheduler/temporal_client_provider.py

@@ -54,10 +54,27 @@ class TemporalClientProvider:
                 self._config.host,
                 self._config.namespace,
             )
-            # temporalio Client.connect is async
-            self._client = await Client.connect(
+            # temporalio Client.connect is async and exposes no per-call rpc_timeout of
+            # its own — bound it ourselves so an unreachable/slow Temporal frontend
+            # cannot hang every caller of get_client() indefinitely.
+            connect_call = Client.connect(
                 self._config.host,
                 namespace=self._config.namespace,
                 data_converter=pydantic_data_converter,
             )
+            timeout = self._config.connect_timeout_seconds
+            try:
+                self._client = (
+                    await asyncio.wait_for(connect_call, timeout=timeout)
+                    if timeout
+                    else await connect_call
+                )
+            except TimeoutError:
+                logger.error(
+                    "[TEMPORAL] Connect to host=%s namespace=%s timed out after %ss",
+                    self._config.host,
+                    self._config.namespace,
+                    timeout,
+                )
+                raise
             return self._client

fred_core-3.4.2/fred_core/security/authorization.py

@@ -0,0 +1,43 @@
+# Copyright Thales 2025
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Residual authorization helpers after the RBAC→ReBAC migration (AUTHZ-01).
+
+Role-based authorization (RBACProvider / @authorize / authorize_or_raise /
+is_authorized / require_admin) has been removed — all endpoint authorization is now
+ReBAC (OpenFGA). Task access authorization (list / stream / cancel) lives in its own
+canonical owner, ``fred_core.tasks.authz`` (CTRLP-12), and is ReBAC-based; this module
+only retains the internal service-principal users below.
+"""
+
+from fred_core.security.structure import KeycloakUser
+
+# Fake user to use when a function requires a user but we don't have one yet
+# but should have one when authorization is added to the service.
+# This is a temporary workaround and should be replaced with a real user.
+TODO_PASS_REAL_USER = KeycloakUser(
+    uid="internal-admin-todo",
+    username="internal admin - todo",
+    email="internal-admin-todo@localhost",
+    roles=["admin"],
+)
+
+# Internal admin user to use for system operations that must always succeed
+# and should not be subject to authorization checks.
+NO_AUTHZ_CHECK_USER = KeycloakUser(
+    uid="internal-admin",
+    username="internal admin",
+    email="internal-admin@localhost",
+    roles=["admin"],
+)

{fred_core-3.4.0 → fred_core-3.4.2}/fred_core/security/keycloak/keycloack_admin_client.py

@@ -29,8 +29,6 @@ class KeycloackDisabled:
     to let know the caller it must handle this case.
     """
 
-    ...
-
 
 def create_keycloak_admin(
     m2m_security: M2MSecurity,