iatoolkit 2.21.2__tar.gz → 2.21.3__tar.gz

{iatoolkit-2.21.2/src/iatoolkit.egg-info → iatoolkit-2.21.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.21.2
+Version: 2.21.3
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.21.2"
+__version__ = "2.21.3"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/infra/call_service.py

@@ -40,15 +40,18 @@ class CallServiceClient:
         endpoint: str,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.get(
-                endpoint,
-                params=params,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.get(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -60,17 +63,20 @@ class CallServiceClient:
             data: Any = None,  # Nuevo argumento para datos crudos/binarios
             params: Optional[Dict[str, Any]] = None,
             headers: Optional[Dict[str, str]] = None,
-            timeout: Union[int, float, Tuple[int, int]] = 10
+            timeout: Union[int, float, Tuple[int, int]] = 10,
+            allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.post(
-                endpoint,
-                params=params,
-                json=json_dict,
-                data=data,  # Pasamos data a requests
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "data": data,  # Pasamos data a requests
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.post(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
 
@@ -82,16 +88,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.put(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.put(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -102,16 +111,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.delete(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.delete(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -122,16 +134,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.patch(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.patch(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/locales/en.yaml

@@ -1613,15 +1613,15 @@ ui:
     parameters_help_btn_title: "Show parameters YAML format"
     http_config_title: "HTTP execution_config"
     http_config_help_btn_title: "Show HTTP execution_config YAML format"
-    http_config_hint: "Required for HTTP tools. Minimum: version: 1, request.method, request.url (HTTPS)."
+    http_config_hint: "Required for HTTP tools. Minimum: version: 1, request.method, request.url (HTTPS by default; HTTP only with private-network opt-in)."
     modal_name_placeholder: "e.g. calculate_tax"
     modal_http_method_label: "HTTP method"
-    modal_http_url_label: "HTTPS URL"
+    modal_http_url_label: "HTTP/HTTPS URL"
     modal_http_url_placeholder: "https://api.example.com/resource"
     parameters_help_title: "Parameters YAML format"
     parameters_help_description: "Define tool input parameters as a JSON Schema object serialized in YAML."
     http_config_help_title: "HTTP execution_config YAML format"
-    http_config_help_description: "Use version: 1 and define request/auth/response. Keep URLs as absolute HTTPS."
+    http_config_help_description: "Use version: 1 and define request/auth/response. Keep URLs as absolute HTTPS unless private-network access is explicitly enabled."
     http_config_help_get_example: "GET example"
     http_config_help_post_example: "POST example (Bearer from secrets_manager)"
     output_contract_title: "Output Contract"
@@ -2591,7 +2591,7 @@ js_messages:
   tool_http_execution_config_version: "execution_config.version must be 1"
   tool_http_execution_config_request_required: "execution_config.request is required"
   tool_http_request_method_invalid: "request.method must be one of GET, POST, PUT, PATCH, DELETE"
-  tool_http_request_url_invalid: "request.url must be an absolute HTTPS URL"
+  tool_http_request_url_invalid: "request.url must be an absolute HTTPS URL unless private-network access is explicitly enabled"
   tool_http_request_timeout_invalid: "request.timeout_ms must be an integer between 1 and 120000"
   tool_http_request_field_object: "request.{field} must be an object"
   tool_http_request_body_object: "request.body must be an object"

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/locales/es.yaml

@@ -1617,15 +1617,15 @@ ui:
     parameters_help_btn_title: "Mostrar formato YAML de parámetros"
     http_config_title: "execution_config HTTP"
     http_config_help_btn_title: "Mostrar formato YAML de execution_config HTTP"
-    http_config_hint: "Requerido para herramientas HTTP. Mínimo: version: 1, request.method, request.url (HTTPS)."
+    http_config_hint: "Requerido para herramientas HTTP. Mínimo: version: 1, request.method, request.url (HTTPS por defecto; HTTP solo con opt-in de red privada)."
     modal_name_placeholder: "ej. calcular_impuestos"
     modal_http_method_label: "Método HTTP"
-    modal_http_url_label: "URL HTTPS"
+    modal_http_url_label: "URL HTTP/HTTPS"
     modal_http_url_placeholder: "https://api.ejemplo.com/recurso"
     parameters_help_title: "Formato YAML de parámetros"
     parameters_help_description: "Define parámetros de entrada de la herramienta como un objeto JSON Schema serializado en YAML."
     http_config_help_title: "Formato YAML de execution_config HTTP"
-    http_config_help_description: "Usa version: 1 y define request/auth/response. Mantén URLs HTTPS absolutas."
+    http_config_help_description: "Usa version: 1 y define request/auth/response. Mantén URLs HTTPS absolutas salvo que habilites acceso a red privada explícitamente."
     http_config_help_get_example: "Ejemplo GET"
     http_config_help_post_example: "Ejemplo POST (Bearer desde secrets_manager)"
     output_contract_title: "Output Contract"
@@ -2594,7 +2594,7 @@ js_messages:
   tool_http_execution_config_version: "execution_config.version debe ser 1"
   tool_http_execution_config_request_required: "execution_config.request es obligatorio"
   tool_http_request_method_invalid: "request.method debe ser uno de GET, POST, PUT, PATCH, DELETE"
-  tool_http_request_url_invalid: "request.url debe ser una URL HTTPS absoluta"
+  tool_http_request_url_invalid: "request.url debe ser una URL HTTPS absoluta salvo que el acceso a red privada esté habilitado explícitamente"
   tool_http_request_timeout_invalid: "request.timeout_ms debe ser un entero entre 1 y 120000"
   tool_http_request_field_object: "request.{field} debe ser un objeto"
   tool_http_request_body_object: "request.body debe ser un objeto"

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/services/http_tool_service.py

@@ -78,15 +78,49 @@ class HttpToolService:
               json_payload: dict | None,
               timeout):
         if method == "GET":
-            return self.call_service.get(url, params=params, headers=headers, timeout=timeout)
+            return self.call_service.get(
+                url,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "POST":
-            return self.call_service.post(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.post(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "PUT":
-            return self.call_service.put(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.put(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "PATCH":
-            return self.call_service.patch(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.patch(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "DELETE":
-            return self.call_service.delete(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.delete(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
 
         raise IAToolkitException(
             IAToolkitException.ErrorType.INVALID_PARAMETER,
@@ -182,15 +216,35 @@ class HttpToolService:
 
     def _validate_target_url(self, company_short_name: str, execution_config: dict, url: str):
         parsed = urlparse(url)
+        scheme = parsed.scheme.lower()
         host = (parsed.hostname or "").strip().lower()
+        allow_private_network = self._private_network_enabled(execution_config)
+        allowed_hosts = self._resolve_allowed_hosts(
+            company_short_name,
+            execution_config,
+            include_company_defaults=not allow_private_network,
+        )
 
-        if parsed.scheme.lower() != "https" or not host:
+        allowed_schemes = {"https", "http"} if allow_private_network else {"https"}
+        if scheme not in allowed_schemes or not host:
+            message = "HTTP tools require an absolute HTTPS URL"
+            if allow_private_network:
+                message = (
+                    "HTTP tools require an absolute HTTP or HTTPS URL "
+                    "when allow_private_network=true"
+                )
             raise IAToolkitException(
                 IAToolkitException.ErrorType.INVALID_PARAMETER,
-                "HTTP tools require an absolute HTTPS URL"
+                message
+            )
+
+        if allowed_hosts and not self._host_in_allowlist(host, allowed_hosts):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.REQUEST_ERROR,
+                f"HTTP tool target host '{host}' is not in allowed_hosts"
             )
 
-        if host == "localhost" or host.endswith(".local"):
+        if host == "localhost" or (host.endswith(".local") and not allow_private_network):
             raise IAToolkitException(
                 IAToolkitException.ErrorType.REQUEST_ERROR,
                 f"HTTP tool target host '{host}' is not allowed"
@@ -198,16 +252,35 @@ class HttpToolService:
 
         ip_value = self._to_ip_or_none(host)
         if ip_value:
-            self._assert_public_ip(ip_value)
+            classification = self._assert_allowed_ip(ip_value, allow_private_network)
+            if scheme == "http" and classification != "private":
+                raise IAToolkitException(
+                    IAToolkitException.ErrorType.REQUEST_ERROR,
+                    "HTTP scheme is only allowed for private-network HTTP tools"
+                )
         else:
-            self._assert_public_dns_target(host)
+            dns_result = self._assert_dns_target_allowed(host, allow_private_network)
+            if scheme == "http":
+                if not dns_result["resolved"]:
+                    raise IAToolkitException(
+                        IAToolkitException.ErrorType.REQUEST_ERROR,
+                        "HTTP private-network targets must resolve before request"
+                    )
+                if not dns_result["has_private"] or dns_result["has_public"]:
+                    raise IAToolkitException(
+                        IAToolkitException.ErrorType.REQUEST_ERROR,
+                        "HTTP scheme is only allowed for private-network targets"
+                    )
 
-        allowed_hosts = self._resolve_allowed_hosts(company_short_name, execution_config)
-        if allowed_hosts and not self._host_in_allowlist(host, allowed_hosts):
+    @staticmethod
+    def _private_network_enabled(execution_config: dict) -> bool:
+        security_cfg = execution_config.get("security") or {}
+        if not isinstance(security_cfg, dict):
             raise IAToolkitException(
-                IAToolkitException.ErrorType.REQUEST_ERROR,
-                f"HTTP tool target host '{host}' is not in allowed_hosts"
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                "execution_config.security must be a JSON object"
             )
+        return security_cfg.get("allow_private_network") is True
 
     @staticmethod
     def _to_ip_or_none(host: str):
@@ -216,14 +289,15 @@ class HttpToolService:
         except ValueError:
             return None
 
-    def _assert_public_dns_target(self, hostname: str):
+    def _assert_dns_target_allowed(self, hostname: str, allow_private_network: bool) -> dict:
         # Best effort DNS check to reduce SSRF risk when DNS resolves to private ranges.
         try:
             entries = socket.getaddrinfo(hostname, None)
         except Exception:
             # If DNS cannot be resolved here, let the outbound request fail naturally.
-            return
+            return {"resolved": False, "has_private": False, "has_public": False}
 
+        result = {"resolved": False, "has_private": False, "has_public": False}
         for entry in entries:
             sockaddr = entry[4]
             if not sockaddr:
@@ -231,12 +305,18 @@ class HttpToolService:
             ip_text = sockaddr[0]
             ip_value = self._to_ip_or_none(ip_text)
             if ip_value:
-                self._assert_public_ip(ip_value)
+                result["resolved"] = True
+                classification = self._assert_allowed_ip(ip_value, allow_private_network)
+                if classification == "private":
+                    result["has_private"] = True
+                else:
+                    result["has_public"] = True
+
+        return result
 
     @staticmethod
-    def _assert_public_ip(ip_value):
-        if (ip_value.is_private or
-                ip_value.is_loopback or
+    def _assert_allowed_ip(ip_value, allow_private_network: bool) -> str:
+        if (ip_value.is_loopback or
                 ip_value.is_link_local or
                 ip_value.is_reserved or
                 ip_value.is_multicast or
@@ -245,12 +325,23 @@ class HttpToolService:
                 IAToolkitException.ErrorType.REQUEST_ERROR,
                 f"HTTP tool target IP '{ip_value}' is not allowed"
             )
+        if ip_value.is_private:
+            if allow_private_network:
+                return "private"
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.REQUEST_ERROR,
+                f"HTTP tool target IP '{ip_value}' is not allowed"
+            )
+        return "public"
 
-    def _resolve_allowed_hosts(self, company_short_name: str, execution_config: dict) -> list[str]:
+    def _resolve_allowed_hosts(self,
+                               company_short_name: str,
+                               execution_config: dict,
+                               include_company_defaults: bool = True) -> list[str]:
         security_cfg = execution_config.get("security") or {}
         allowed_hosts = security_cfg.get("allowed_hosts")
 
-        if allowed_hosts is None:
+        if allowed_hosts is None and include_company_defaults:
             company_params = self.config_service.get_configuration(company_short_name, "parameters") or {}
             http_tools_cfg = company_params.get("http_tools") or {}
             allowed_hosts = http_tools_cfg.get("allowed_hosts")

{iatoolkit-2.21.2 → iatoolkit-2.21.3}/src/iatoolkit/services/tool_service.py

@@ -431,11 +431,50 @@ class ToolService:
                 "execution_config.request.url is required and must be a non-empty string"
             )
 
+        security_cfg = execution_config.get("security")
+        allow_private_network = False
+        if security_cfg is not None:
+            if not isinstance(security_cfg, dict):
+                raise IAToolkitException(
+                    IAToolkitException.ErrorType.INVALID_PARAMETER,
+                    "execution_config.security must be a JSON object"
+                )
+
+            allowed_hosts = security_cfg.get("allowed_hosts")
+            if allowed_hosts is not None:
+                if not isinstance(allowed_hosts, list):
+                    raise IAToolkitException(
+                        IAToolkitException.ErrorType.INVALID_PARAMETER,
+                        "execution_config.security.allowed_hosts must be a list"
+                    )
+                for host in allowed_hosts:
+                    if not isinstance(host, str) or not host.strip():
+                        raise IAToolkitException(
+                            IAToolkitException.ErrorType.INVALID_PARAMETER,
+                            "execution_config.security.allowed_hosts must contain non-empty strings"
+                        )
+
+            allow_private_network_value = security_cfg.get("allow_private_network", False)
+            if not isinstance(allow_private_network_value, bool):
+                raise IAToolkitException(
+                    IAToolkitException.ErrorType.INVALID_PARAMETER,
+                    "execution_config.security.allow_private_network must be a boolean"
+                )
+            allow_private_network = allow_private_network_value
+
         parsed = urlparse(url)
-        if parsed.scheme.lower() != "https" or not parsed.netloc:
+        scheme = parsed.scheme.lower()
+        allowed_schemes = {"https", "http"} if allow_private_network else {"https"}
+        if scheme not in allowed_schemes or not parsed.netloc:
+            message = "execution_config.request.url must be an absolute HTTPS URL"
+            if allow_private_network:
+                message = (
+                    "execution_config.request.url must be an absolute HTTP or HTTPS URL "
+                    "when allow_private_network=true"
+                )
             raise IAToolkitException(
                 IAToolkitException.ErrorType.INVALID_PARAMETER,
-                "execution_config.request.url must be an absolute HTTPS URL"
+                message
             )
 
         timeout_ms = request_cfg.get("timeout_ms")
@@ -545,35 +584,6 @@ class ToolService:
                     "execution_config.response.max_response_bytes must be a positive integer"
                 )
 
-        security_cfg = execution_config.get("security")
-        if security_cfg is not None:
-            if not isinstance(security_cfg, dict):
-                raise IAToolkitException(
-                    IAToolkitException.ErrorType.INVALID_PARAMETER,
-                    "execution_config.security must be a JSON object"
-                )
-
-            allowed_hosts = security_cfg.get("allowed_hosts")
-            if allowed_hosts is not None:
-                if not isinstance(allowed_hosts, list):
-                    raise IAToolkitException(
-                        IAToolkitException.ErrorType.INVALID_PARAMETER,
-                        "execution_config.security.allowed_hosts must be a list"
-                    )
-                for host in allowed_hosts:
-                    if not isinstance(host, str) or not host.strip():
-                        raise IAToolkitException(
-                            IAToolkitException.ErrorType.INVALID_PARAMETER,
-                            "execution_config.security.allowed_hosts must contain non-empty strings"
-                        )
-
-            allow_private_network = security_cfg.get("allow_private_network")
-            if allow_private_network is True:
-                raise IAToolkitException(
-                    IAToolkitException.ErrorType.INVALID_PARAMETER,
-                    "execution_config.security.allow_private_network=true is not supported"
-                )
-
     @staticmethod
     def _build_tool_snapshot(tool_obj) -> dict:
         if tool_obj is None:

{iatoolkit-2.21.2 → iatoolkit-2.21.3/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.21.2
+Version: 2.21.3
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT