fred-core 3.4.1__tar.gz → 3.4.2__tar.gz

{fred_core-3.4.1 → fred_core-3.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-core
-Version: 3.4.1
+Version: 3.4.2
 Summary: Core shared utilities for Fred backends (config, storage, security, and runtime helpers).
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/__init__.py

@@ -88,7 +88,6 @@ from fred_core.security.oidc import (
     split_realm_url,
 )
 from fred_core.security.outbound import BearerAuth, ClientCredentialsProvider
-from fred_core.security.permission_catalog import list_display_permissions
 from fred_core.security.rebac.openfga_engine import OpenFgaRebacEngine
 from fred_core.security.rebac.rebac_engine import (
     ORGANIZATION_ID,
@@ -165,7 +164,6 @@ __all__ = [
     "FilesystemResourceInfo",
     "is_service_agent",
     "SERVICE_AGENT_ALLOWED_TEAM_PERMISSIONS",
-    "list_display_permissions",
     "Action",
     "Resource",
     "AuthorizationError",

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/common/__init__.py

@@ -38,7 +38,7 @@ from .structures import (
     StoreConfig,
     TemporalSchedulerConfig,
 )
-from .team_id import TeamId, personal_team_id
+from .team_id import TeamId, is_personal_team_id, personal_team_id
 from .utils import raise_internal_error
 
 __all__ = [
@@ -58,6 +58,7 @@ __all__ = [
     "PostgresTableConfig",
     "StoreConfig",
     "TeamId",
+    "is_personal_team_id",
     "personal_team_id",
     "TemporalSchedulerConfig",
     "ThreadSafeLRUCache",

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/common/fastapi_handlers.py

@@ -22,11 +22,12 @@ from fred_core.security.models import AuthorizationError, Resource
 logger = logging.getLogger(__name__)
 
 _TEAM_PERMISSION_MESSAGES: dict[str, str] = {
-    "can_update_resources": "You are not allowed to manage resources in this team. Ask a team owner or manager.",
-    "can_update_agents": "You are not allowed to manage agents in this team. Ask a team owner or manager.",
+    "can_update_resources": "You are not allowed to manage resources in this team. Ask a team admin or editor.",
+    "can_update_agents": "You are not allowed to manage agents in this team. Ask a team admin or editor.",
     "can_administer_members": "You are not allowed to manage members in this team.",
-    "can_administer_managers": "You are not allowed to manage managers in this team.",
-    "can_administer_owners": "You are not allowed to manage owners in this team.",
+    "can_administer_editors": "You are not allowed to manage editors in this team.",
+    "can_administer_analysts": "You are not allowed to manage analysts in this team.",
+    "can_administer_admins": "You are not allowed to manage admins in this team.",
     "can_read_members": "You are not allowed to view team members.",
     "can_update_info": "You are not allowed to update this team.",
 }

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/common/structures.py

@@ -40,6 +40,11 @@ class TemporalSchedulerConfig(BaseModel):
     task_queue: str = "default"
     workflow_id_prefix: str = "task"
     connect_timeout_seconds: Optional[int] = 5
+    rpc_timeout_seconds: Optional[int] = Field(
+        default=10,
+        description="Deadline applied to individual Temporal RPC calls (start_workflow, describe) "
+        "so a stuck Temporal frontend cannot hang the caller indefinitely.",
+    )
     ingestion_workflow_parallelism: int = Field(
         default=3,
         ge=1,

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/kpi/kpi_phase_metric.py

@@ -17,7 +17,7 @@ from contextlib import asynccontextmanager
 from fred_core.kpi.base_kpi_writer import BaseKPIWriter
 from fred_core.kpi.kpi_writer_structures import Dims, KPIActor
 
-PHASE_METRIC_ACTOR = KPIActor(type="system", user_id=None, groups=None)
+PHASE_METRIC_ACTOR = KPIActor(type="system", user_id=None)
 
 
 def record_phase_metric(

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/kpi/kpi_writer.py

@@ -123,7 +123,7 @@ def to_kpi_actor(user: KeycloakUser) -> KPIActor:
     - Fred’s KPI model is actor-centric (human/agent/system). We always attribute
       costs and usage to an actor to support per-user chargeback and audits.
     """
-    return KPIActor(type="human", user_id=user.uid, groups=user.groups)
+    return KPIActor(type="human", user_id=user.uid)
 
 
 # -------------------------
@@ -196,8 +196,6 @@ class KPIWriter(BaseKPIWriter):
         _dims["actor_type"] = actor.type
         if actor.user_id:
             _dims["user_id"] = actor.user_id
-        if "groups" not in _dims and actor.groups:
-            _dims["groups"] = ",".join(sorted(actor.groups))
         merged_dims = _merge_dims(self.defaults, _dims)
 
         event = KPIEvent(

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/kpi/kpi_writer_structures.py

@@ -149,7 +149,6 @@ class KPIActor(BaseModel):
 
     type: Literal["human", "system"]
     user_id: Optional[str] = None
-    groups: Optional[list[str]] = None
 
     @field_validator("user_id")
     @classmethod

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/kpi/opensearch_kpi_store.py

@@ -103,7 +103,6 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "system_prompt_chars": {"type": "keyword"},
                     "template_id": {"type": "keyword"},
                     "source_runtime_id": {"type": "keyword"},
-                    "groups": {"type": "keyword"},
                 }
             },
             "cost": {
@@ -120,6 +119,8 @@ KPI_INDEX_MAPPING: Dict[str, Any] = {
                     "bytes_out": {"type": "long"},
                     "chunks": {"type": "integer"},
                     "vectors": {"type": "integer"},
+                    "input_tokens": {"type": "long"},
+                    "output_tokens": {"type": "long"},
                 }
             },
             "labels": {"type": "keyword"},
@@ -190,7 +191,11 @@ class OpenSearchKPIStore(BaseKPIStore):
                 self._ensure_dim_mapping("system_prompt_chars", {"type": "keyword"})
                 self._ensure_dim_mapping("template_id", {"type": "keyword"})
                 self._ensure_dim_mapping("source_runtime_id", {"type": "keyword"})
-                self._ensure_dim_mapping("groups", {"type": "keyword"})
+                # OBSERV-02: quantities.input_tokens/output_tokens were written by
+                # agent.turn_completed since Phase 7 but never mapped, so they were
+                # unaggregatable. Added additively for existing indices.
+                self._ensure_quantities_mapping("input_tokens", {"type": "long"})
+                self._ensure_quantities_mapping("output_tokens", {"type": "long"})
                 # Validate existing mapping matches expected mapping
                 validate_index_mapping(self.client, self.index, KPI_INDEX_MAPPING)
         except OpenSearchException as e:
@@ -218,6 +223,27 @@ class OpenSearchKPIStore(BaseKPIStore):
                 "[OPENSEARCH][KPI] failed to add dims.%s mapping: %s", name, e
             )
 
+    def _ensure_quantities_mapping(self, name: str, mapping: Dict[str, Any]) -> None:
+        try:
+            current_mapping_resp = self.client.indices.get_mapping(index=self.index)
+            current_mapping = current_mapping_resp.get(self.index, {}).get(
+                "mappings", {}
+            )
+            quantities_props = (
+                current_mapping.get("properties", {})
+                .get("quantities", {})
+                .get("properties", {})
+            )
+            if name in quantities_props:
+                return
+            body = {"properties": {"quantities": {"properties": {name: mapping}}}}
+            self.client.indices.put_mapping(index=self.index, body=body)
+            logger.info("[OPENSEARCH][KPI] added quantities.%s mapping", name)
+        except OpenSearchException as e:
+            logger.warning(
+                "[OPENSEARCH][KPI] failed to add quantities.%s mapping: %s", name, e
+            )
+
     # -- writes ----------------------------------------------------------------
     def index_event(self, event: KPIEvent) -> None:
         try:

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/portable/observability.py

@@ -209,7 +209,6 @@ class MetricsProvider:
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         """Time a block. Yields a mutable dims dict callers can annotate."""
         yield dict(dims) if dims else {}
@@ -238,7 +237,6 @@ class LoggingMetricsProvider(MetricsProvider):
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         import time as _time
 
@@ -258,7 +256,6 @@ class LoggingMetricsProvider(MetricsProvider):
                         "name": name,
                         "dims": d,
                         "duration_ms": round((_time.perf_counter() - start) * 1000, 2),
-                        "groups": groups,
                     }
                 },
             )
@@ -305,7 +302,6 @@ class InMemoryMetricsProvider(MetricsProvider):
         name: str,
         *,
         dims: dict[str, str | None] | None = None,
-        groups: list[str] | None = None,
     ) -> Generator[dict[str, str | None], None, None]:
         import time as _time
 

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/scheduler/temporal_client_provider.py

@@ -54,10 +54,27 @@ class TemporalClientProvider:
                 self._config.host,
                 self._config.namespace,
             )
-            # temporalio Client.connect is async
-            self._client = await Client.connect(
+            # temporalio Client.connect is async and exposes no per-call rpc_timeout of
+            # its own — bound it ourselves so an unreachable/slow Temporal frontend
+            # cannot hang every caller of get_client() indefinitely.
+            connect_call = Client.connect(
                 self._config.host,
                 namespace=self._config.namespace,
                 data_converter=pydantic_data_converter,
             )
+            timeout = self._config.connect_timeout_seconds
+            try:
+                self._client = (
+                    await asyncio.wait_for(connect_call, timeout=timeout)
+                    if timeout
+                    else await connect_call
+                )
+            except TimeoutError:
+                logger.error(
+                    "[TEMPORAL] Connect to host=%s namespace=%s timed out after %ss",
+                    self._config.host,
+                    self._config.namespace,
+                    timeout,
+                )
+                raise
             return self._client

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/security/models.py

@@ -41,7 +41,6 @@ class Resource(str, Enum):
     TABLES_DATABASES = "tables_database"
     KPIS = "kpi"
     OPENSEARCH = "opensearch"
-    NEO4J = "neo4j"
     LOGS = "logs"
     FILES = "files"
 

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/security/oidc.py

@@ -308,7 +308,6 @@ def decode_jwt(token: str) -> KeycloakUser:
             username=username,
             roles=["admin"],
             email=f"{username}@localhost",
-            groups=["admins"],
         )
 
     cached_user = _get_cached_user(token)
@@ -434,7 +433,6 @@ def decode_jwt(token: str) -> KeycloakUser:
         username=payload.get("preferred_username", ""),
         roles=client_roles,
         email=payload.get("email"),
-        groups=payload.get("groups", []),
     )
     logger.debug("KeycloakUser built: %s", user)
     _cache_user(token, payload, user)
@@ -498,7 +496,6 @@ async def get_current_user_without_gcu(
             username="admin",
             roles=["admin"],
             email="admin@mail.com",
-            groups=["admins"],
         )
 
     if not token:

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/security/rebac/noop_engine.py

@@ -83,6 +83,17 @@ class NoopRebacEngine(RebacEngine):
     ) -> list[RebacReference] | RebacDisabledResult:
         return RebacDisabledResult()
 
+    async def has_direct_relation(
+        self,
+        subject: RebacReference,
+        relation: RelationType,
+        resource: RebacReference,
+        *,
+        consistency_token: str | None = None,
+    ) -> bool:
+        # Nothing is ever persisted under the no-op engine.
+        return False
+
     async def has_permission(
         self,
         subject: RebacReference,

{fred_core-3.4.1 → fred_core-3.4.2}/fred_core/security/rebac/openfga_engine.py

@@ -28,13 +28,14 @@ from fred_core.security.rebac.openfga_schema import (
     DEFAULT_SCHEMA,
 )
 from fred_core.security.rebac.rebac_engine import (
+    ORGANIZATION_ID,
     RebacEngine,
     RebacPermission,
     RebacReference,
     Relation,
     RelationType,
 )
-from fred_core.security.structure import M2MSecurity, OpenFgaRebacConfig
+from fred_core.security.structure import OpenFgaRebacConfig
 from openfga_sdk.client.client import OpenFgaClient
 from openfga_sdk.client.configuration import ClientConfiguration
 from openfga_sdk.client.models.check_request import ClientCheckRequest
@@ -72,13 +73,10 @@ class OpenFgaRebacEngine(RebacEngine):
     def __init__(
         self,
         config: OpenFgaRebacConfig,
-        m2m_security: M2MSecurity,
         *,
         token: str | None = None,
         schema: str = DEFAULT_SCHEMA,
     ) -> None:
-        super().__init__(m2m_security)
-
         resolved_token = token or os.getenv(config.token_env_var)
         if not resolved_token:
             raise ValueError(
@@ -193,8 +191,12 @@ class OpenFgaRebacEngine(RebacEngine):
         subject_type: Resource | None = None,
         consistency_token: str | None = None,
     ) -> list[Relation]:
-        # Only used to sync Keycloakc groups with the rebac engine. Not needed
-        # with OpenFGA as we handle this with contextual tuples.
+        # No current caller needs a bulk tuple read: every authorization
+        # decision goes through `has_permission`, `lookup_resources`, or
+        # `lookup_subjects` instead, each backed by a persisted OpenFGA tuple
+        # (never Keycloak-derived). Implemented by 2 other engines and
+        # exercised elsewhere; this OpenFGA-backed stub stays a stub until a
+        # real caller needs it.
         raise NotImplementedError(
             "OpenFGA relation listing is not implemented as it is not needed"
         )
@@ -256,6 +258,30 @@ class OpenFgaRebacEngine(RebacEngine):
             for user in response.users
         ]
 
+    async def has_direct_relation(
+        self,
+        subject: RebacReference,
+        relation: RelationType,
+        resource: RebacReference,
+        *,
+        consistency_token: str | None = None,
+    ) -> bool:
+        # A fully-specified tuple key (user + relation + object) queried via
+        # the raw `Read` API returns only literally-persisted tuples — unlike
+        # `Check`/`ListUsers`, it does not expand userset rewrites (e.g.
+        # schema.fga's `team_member: [user] or team_admin or team_editor or
+        # team_analyst`). This is the same primitive already used by
+        # `delete_all_relations_of_reference` for a bulk tuple read.
+        client = await self.get_client()
+        body = ReadRequestTupleKey(
+            user=OpenFgaRebacEngine._reference_to_openfga_id(subject),
+            relation=relation.value,
+            object=OpenFgaRebacEngine._reference_to_openfga_id(resource),
+        )
+        options = self._build_options(consistency=consistency_token)
+        response = await client.read(body, options)
+        return len(response.tuples) > 0
+
     async def has_permission(
         self,
         subject: RebacReference,
@@ -375,12 +401,51 @@ class OpenFgaRebacEngine(RebacEngine):
         if self._config.sync_schema_on_init:
             await self.sync_schema(client)
 
+        # AUTHZ-05 bootstrap (RFC §24.3): config-seeded platform_admin/platform_observer.
+        await self._bootstrap_platform_roles(client)
+
         logger.info(
             "[REBAC] OpenFGA engine initialized in %dms",
             int((time.monotonic() - started) * 1000),
         )
         return client
 
+    async def _bootstrap_platform_roles(self, client: OpenFgaClient) -> None:
+        """Write config-seeded platform_admin/platform_observer tuples once.
+
+        Called with the client already resolved (not `self.get_client()`) because
+        this runs from inside `_initialize_client_and_store`, which itself holds
+        the client-initialization lock — going through `add_relation` here would
+        deadlock on that lock. Writes are idempotent (`_build_options` sets
+        `on_duplicate_writes=IGNORE`) and never remove an existing grant.
+        """
+        relations = [
+            Relation(
+                subject=RebacReference(Resource.USER, sub),
+                relation=RelationType.PLATFORM_ADMIN,
+                resource=RebacReference(Resource.ORGANIZATION, ORGANIZATION_ID),
+            )
+            for sub in self._config.platform_admin_subjects
+        ] + [
+            Relation(
+                subject=RebacReference(Resource.USER, sub),
+                relation=RelationType.PLATFORM_OBSERVER,
+                resource=RebacReference(Resource.ORGANIZATION, ORGANIZATION_ID),
+            )
+            for sub in self._config.platform_observer_subjects
+        ]
+        if not relations:
+            return
+
+        logger.info(
+            "[REBAC] Bootstrapping %d config-seeded platform-role tuple(s)",
+            len(relations),
+        )
+        body = ClientWriteRequest(
+            writes=[OpenFgaRebacEngine._relation_to_tuple(r) for r in relations]
+        )
+        _ = await client.write(body, self._build_options())
+
     async def get_client(self) -> OpenFgaClient:
         """Lazily initialize and cache an OpenFGA client with store ID."""
         if self._cached_client is None: