iatoolkit 2.41.0__tar.gz → 2.41.1__tar.gz

{iatoolkit-2.41.0/src/iatoolkit.egg-info → iatoolkit-2.41.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.0
+Version: 2.41.1
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.41.0"
+__version__ = "2.41.1"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/core.py

@@ -170,11 +170,9 @@ class IAToolkit:
         def _run_warmup():
             try:
                 warmup_service = self._injector.get(WarmupService)
-                warmed_companies = warmup_service.warmup_startup_configured_companies(trigger="core_startup")
-                if warmed_companies:
-                    logging.info("🔥 Startup warm-up completed for companies=%s", warmed_companies)
-                else:
-                    logging.info("🔥 Startup warm-up skipped: no embedding provider enabled warmup_on_startup.")
+                woken_endpoints = warmup_service.warmup_startup_configured_companies(trigger="core_startup")
+                if woken_endpoints:
+                    logging.info("🔥 Startup warm-up completed for endpoints=%s", woken_endpoints)
             except Exception:
                 logging.exception("⚠️ Startup warm-up failed.")
 

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/locales/en.yaml

@@ -703,6 +703,18 @@ ui:
     mode_external_sync: "External"
     mode_managed_help: "The wiki is edited from this workspace and pages are saved into storage."
     mode_external_sync_help: "The wiki stays read-only in IAToolkit and updates from the configured storage root."
+    access_control: "Access control"
+    access_mode_off: "Off"
+    access_mode_off_help: "Access labels are stored but no page is filtered."
+    access_mode_dry_run: "Dry run"
+    access_mode_dry_run_help: "What would be denied is computed and logged, but every page is still served."
+    access_mode_enforce: "Enforced"
+    access_mode_enforce_help: "A reader only gets pages whose labels they hold. The admin panel still sees everything."
+    access_coverage: "{labelled} of {pages} pages carry access labels."
+    access_coverage_gap: "{unlabelled} with no label: nobody sees those while access control is enforced."
+    access_mode_ok: "Access control mode updated."
+    access_mode_error: "Could not change the access control mode."
+    access_mode_confirm: "Once enforced, each user only sees pages whose labels they hold. Continue?"
     root: "Storage root"
     edit_root: "Edit storage root"
     lock_root: "Lock storage root editing"

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/locales/es.yaml

@@ -705,6 +705,18 @@ ui:
     mode_external_sync: "Externa"
     mode_managed_help: "La wiki se edita desde esta interfaz y guarda sus páginas en storage."
     mode_external_sync_help: "La wiki queda de solo lectura en IAToolkit y se actualiza desde la raíz storage configurada."
+    access_control: "Control de acceso"
+    access_mode_off: "Desactivado"
+    access_mode_off_help: "Las etiquetas de acceso se guardan pero no se filtra ninguna página."
+    access_mode_dry_run: "Simulación"
+    access_mode_dry_run_help: "Se calcula y registra en el log qué páginas se negarían, pero se siguen entregando todas."
+    access_mode_enforce: "Activo"
+    access_mode_enforce_help: "Cada lector recibe solo las páginas cuyas etiquetas posee. El panel de administración sigue viendo todo."
+    access_coverage: "{labelled} de {pages} páginas con etiquetas de acceso."
+    access_coverage_gap: "{unlabelled} sin etiqueta: con el control activo no las ve nadie."
+    access_mode_ok: "Modo de control de acceso actualizado."
+    access_mode_error: "No se pudo cambiar el modo de control de acceso."
+    access_mode_confirm: "Al activarlo, cada usuario verá solo las páginas cuyas etiquetas posee. ¿Continuar?"
     root: "Raíz storage"
     edit_root: "Editar raíz storage"
     lock_root: "Bloquear edición de raíz storage"

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/services/tenant_wiki_service.py

@@ -445,6 +445,25 @@ class TenantWikiService:
             "mcp_index_source_path": self._index_source_display_path(wiki, source_storage_key),
             "index_path": "/",
             "index_source_path": self._index_source_display_path(wiki, source_storage_key),
+            "access_control": self._access_summary(wiki),
+        }
+
+    def _access_summary(self, wiki: KnowledgeWiki) -> dict:
+        """
+        The wiki's access control state, for the admin panel: the mode in force
+        and how many pages carry labels. A page with none is denied to everyone
+        once the mode is enforce, so that count is the number an operator has to
+        look at before raising it.
+        """
+        access_control = self.wiki_access_control(wiki)
+        pages = self.knowledge_wiki_repo.list_pages(wiki.id, include_archived=False, limit=self.MAX_PAGES)
+        labelled = sum(1 for page in pages if (page.access_tags or []))
+        return {
+            **access_control,
+            "modes": list(self.ACCESS_MODES),
+            "pages": len(pages),
+            "labelled": labelled,
+            "unlabelled": len(pages) - labelled,
         }
 
     def get_page(
@@ -1004,6 +1023,96 @@ class TenantWikiService:
             )
             return None
 
+    def set_access_control_mode(
+        self,
+        company_short_name: str,
+        *,
+        wiki_key: str,
+        mode: str,
+        allow_dark: bool = False,
+    ) -> dict:
+        """
+        Raises or lowers a wiki's access control mode, and nothing else.
+
+        Deliberately not routed through `configure_wiki`: that one rebuilds the
+        wiki from its arguments, so calling it with only settings would rename the
+        wiki and repoint its storage prefix to the default. This touches
+        `settings.access_control` and leaves every other field alone.
+
+        Enforcing a wiki whose pages carry no labels at all would serve nothing
+        to anyone, which is never the intent, so that case is refused unless
+        `allow_dark` says otherwise.
+        """
+        company = self._get_company(company_short_name)
+        if not company:
+            return {"status": "error", "error_message": "company not found"}
+        wiki = self.knowledge_wiki_repo.get_wiki_by_key(company.id, self.normalize_wiki_key(wiki_key))
+        if not wiki:
+            return {"status": "error", "error_message": "wiki not found"}
+
+        requested_mode = str(mode or "").strip().lower()
+        if requested_mode not in self.ACCESS_MODES:
+            # Not normalized silently: an unrecognized mode here would read as
+            # 'off' and quietly turn access control off.
+            return {
+                "status": "error",
+                "error_message": f"mode must be one of {', '.join(self.ACCESS_MODES)}",
+            }
+
+        pages = self.knowledge_wiki_repo.list_pages(wiki.id, include_archived=False, limit=self.MAX_PAGES)
+        labelled = sum(1 for page in pages if (page.access_tags or []))
+        previous = self.wiki_access_control(wiki)
+        if requested_mode == self.ACCESS_MODE_ENFORCE and not labelled and not allow_dark:
+            return {
+                "status": "error",
+                "error_message": (
+                    f"wiki '{wiki.wiki_key}' has no page carrying access labels, so enforcing would "
+                    "hide all of it from everyone. Sync the access manifest first."
+                ),
+            }
+
+        settings = dict(wiki.settings if isinstance(wiki.settings, dict) else {})
+        # Reassigned rather than mutated in place: an in-place change to a JSON
+        # column is not tracked and would never be written.
+        settings["access_control"] = {
+            "mode": requested_mode,
+            "manifest": previous["manifest"],
+        }
+        wiki.settings = settings
+        self.knowledge_wiki_repo.commit()
+
+        return {
+            "status": "success",
+            "wiki_key": wiki.wiki_key,
+            "previous_mode": previous["mode"],
+            "mode": requested_mode,
+            "manifest": previous["manifest"],
+            "manifest_status": self._probe_access_manifest(company_short_name, wiki, requested_mode),
+            "pages": len(pages),
+            "labelled": labelled,
+            "unlabelled": len(pages) - labelled,
+        }
+
+    def _probe_access_manifest(self, company_short_name: str, wiki: KnowledgeWiki, mode: str) -> str:
+        """
+        Reports whether the manifest could be read right now, without failing.
+
+        Answers the question that matters after raising the mode: would the next
+        sync abort? From dry_run up the manifest is required.
+        """
+        try:
+            _pages, meta = self._load_access_manifest(
+                company_short_name,
+                wiki,
+                {"mode": self.ACCESS_MODE_OFF, "manifest": self.wiki_access_control(wiki)["manifest"]},
+            )
+        except Exception as exc:
+            return f"error: {exc}"
+        status = str(meta.get("manifest_status") or "unknown")
+        if status != "loaded" and mode != self.ACCESS_MODE_OFF:
+            return f"{status} (the next sync will abort while the mode is '{mode}')"
+        return status
+
     def access_visibility_report(
         self,
         company_short_name: str,

{iatoolkit-2.41.0 → iatoolkit-2.41.1}/src/iatoolkit/services/warmup_service.py

@@ -7,6 +7,8 @@ from __future__ import annotations
 
 import logging
 import time
+from urllib.parse import urlparse
+
 from injector import inject
 
 from iatoolkit.common.interfaces.secret_provider import SecretProvider
@@ -19,7 +21,12 @@ from iatoolkit.services.embedding_service import EmbeddingService
 class WarmupService:
     """
     Lightweight warm-up orchestrator.
-    Keep it simple: no shared state, no locking, no dedup.
+    Keep it simple: no shared state, no locking.
+
+    The one exception is the startup path, which deduplicates by resolved
+    endpoint URL. That is not coordination between processes — each process
+    still knocks on its own — it is not knocking N times for N tenants that
+    share one endpoint.
     """
 
     @inject
@@ -57,41 +64,80 @@ class WarmupService:
             self.warmup_company(company_short_name, trigger=trigger)
 
     def warmup_startup_configured_companies(self, trigger: str = "startup") -> list[str]:
-        warmed_companies: list[str] = []
-        for company_short_name in get_registered_companies().keys():
-            profiles = self._get_remote_text_embedding_profiles(company_short_name, startup_only=True)
-            if not profiles:
-                logging.info(
-                    "Startup warm-up skipped for company='%s': no embedding provider enabled warmup_on_startup.",
+        """Wakes each distinct inference endpoint once. Returns the hosts woken.
+
+        Once per endpoint, not once per tenant: waking is a property of the
+        endpoint, and tenants normally share one. Doing it per tenant only
+        multiplied requests against a container that was already starting, each
+        one willing to spend the tool's whole retry budget getting there.
+
+        Nothing is awaited beyond the call. Surviving a cold start is the
+        inference client's job, through ``retry_budget_seconds``; this only has
+        to knock on the door.
+        """
+        targets = self._startup_endpoints()
+        if not targets:
+            logging.info("Startup warm-up skipped: no embedding provider enabled warmup_on_startup.")
+            return []
+
+        woken: list[str] = []
+        for endpoint_url, (company_short_name, profile) in targets.items():
+            model_type, _config_section, _tool_name = profile
+            label = self._format_profile_labels([profile])[0]
+            host = self._endpoint_host(endpoint_url)
+            try:
+                self.embedding_service.embed_text(
                     company_short_name,
+                    "hello",
+                    model_type=model_type,
+                    suppress_error_logging=True,
                 )
-                continue
-
-            logging.info(
-                "Startup warm-up starting for company='%s' profiles=%s trigger='%s'.",
-                company_short_name,
-                self._format_profile_labels(profiles),
-                trigger,
-            )
-            warmed_profiles = self._warmup_remote_text_embeddings(
-                company_short_name,
-                startup_only=True,
-                profiles=profiles,
-            )
-            if not warmed_profiles:
+                logging.info(
+                    "🔥 Startup warm-up woke endpoint='%s' via company='%s' profile=%s trigger='%s'.",
+                    host, company_short_name, label, trigger,
+                )
+                woken.append(host)
+            except Exception as e:
                 logging.warning(
-                    "Startup warm-up attempted but no embedding profiles warmed for company='%s' profiles=%s.",
-                    company_short_name,
-                    self._format_profile_labels(profiles),
+                    "Startup warm-up could not wake endpoint='%s' via company='%s' profile=%s: %s",
+                    host, company_short_name, label, e,
                 )
+
+        return woken
+
+    def _startup_endpoints(self) -> dict[str, tuple[str, tuple[str, str, str]]]:
+        """One representative (company, profile) per distinct endpoint URL.
+
+        Keyed by the resolved URL rather than by company or tool name, so a
+        deployment where every tenant shares one endpoint knocks once, and a
+        tenant later pointed somewhere else gets its own knock without anyone
+        having to remember this function exists.
+        """
+        targets: dict[str, tuple[str, tuple[str, str, str]]] = {}
+        for company_short_name in get_registered_companies().keys():
+            inference_tools = self.config_service.get_configuration(company_short_name, "inference_tools") or {}
+            if not isinstance(inference_tools, dict):
                 continue
 
-            logging.info(
-                "Startup warm-up warmed company='%s' profiles=%s.",
-                company_short_name,
-                self._format_profile_labels(warmed_profiles),
-            )
-            warmed_companies.append(company_short_name)
+            for profile in self._get_remote_text_embedding_profiles(company_short_name, startup_only=True):
+                _model_type, _config_section, tool_name = profile
+                endpoint_url = self._resolve_endpoint_url(company_short_name, inference_tools, tool_name)
+                if not endpoint_url:
+                    continue
+
+                existing = targets.get(endpoint_url)
+                # Prefer the default text profile as the representative: it is the
+                # one rag_search uses, so if the container loads models on demand
+                # the one most likely to be asked for first is the one primed.
+                if existing is None or (profile[0] == "text" and existing[1][0] != "text"):
+                    targets[endpoint_url] = (company_short_name, profile)
+
+        return targets
+
+    @staticmethod
+    def _endpoint_host(endpoint_url: str) -> str:
+        """Host only: the URL can come from a secret, and the host is enough to log."""
+        return urlparse(endpoint_url).hostname or "unknown"
 
         return warmed_companies
 
@@ -205,8 +251,23 @@ class WarmupService:
         if provider != "huggingface":
             return False
 
+        return bool(self._resolve_endpoint_url(company_short_name, inference_tools, tool_name))
+
+    def _resolve_endpoint_url(
+            self,
+            company_short_name: str,
+            inference_tools: dict,
+            tool_name: str,
+    ) -> str:
+        """Where a tool's requests actually go, or "" when it resolves nowhere.
+
+        Same precedence the inference client uses — literal, secret ref, then
+        environment variable — because this is what identifies the thing being
+        woken. Two profiles that resolve here to the same URL are one endpoint,
+        whatever they are called in the company's configuration.
+        """
         if not tool_name:
-            return False
+            return ""
 
         defaults = inference_tools.get("_defaults") or {}
         if not isinstance(defaults, dict):
@@ -214,7 +275,7 @@ class WarmupService:
 
         tool_cfg = inference_tools.get(tool_name) or {}
         if not isinstance(tool_cfg, dict):
-            return False
+            return ""
 
         resolved_cfg = {**defaults, **tool_cfg}
         endpoint_url = (resolved_cfg.get("endpoint_url") or "").strip()
@@ -231,4 +292,4 @@ class WarmupService:
                     resolve_secret(self.secret_provider, company_short_name, endpoint_url_env, default="") or ""
                 ).strip()
 
-        return bool(endpoint_url)
+        return endpoint_url

{iatoolkit-2.41.0 → iatoolkit-2.41.1/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.0
+Version: 2.41.1
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT