iatoolkit 2.41.1__tar.gz → 2.41.2__tar.gz

{iatoolkit-2.41.1/src/iatoolkit.egg-info → iatoolkit-2.41.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.1
+Version: 2.41.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.41.1"
+__version__ = "2.41.2"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/common/model_registry.py

@@ -46,6 +46,58 @@ SERVABLE_PROVIDERS: tuple[str, ...] = (
 )
 
 
+@dataclass(frozen=True)
+class RouteParam:
+    """One thing a provider needs to know before it can be reached.
+
+    `is_env_name` marks a value that is the *name* of a deployment environment
+    variable, not the secret itself: what gets stored is `OSS_LLM_API_KEY`, and the
+    value behind it is read at request time and never persisted here.
+    """
+
+    name: str
+    required: bool = True
+    is_env_name: bool = False
+    #: A regular expression the value must match, or None for "any non-empty".
+    pattern: str | None = None
+
+
+#: What each provider needs in order to be reached, keyed by provider.
+#:
+#: The single declaration behind three things: what a catalogue entry may store,
+#: what refuses to publish without it, and which fields a form draws. Kept beside
+#: SERVABLE_PROVIDERS because the two answer halves of the same question — which
+#: providers exist, and what each one needs.
+#:
+#: Most providers need nothing: their SDK knows its own endpoint, and the
+#: credential comes from the company's provider_api_keys mapping. The two that
+#: appear here are the ones whose endpoint is a decision.
+#:
+#: `openai_compatible` requires both, and that is the point of the whole feature:
+#: an entry that carries its own endpoint and credential is reachable on its own,
+#: instead of depending on a block in every company's own configuration file. Two
+#: self-hosted models on two different endpoints stop being impossible.
+#:
+#: `openrouter` allows both and requires neither: there is one OpenRouter for
+#: everyone and its base URL has a working default, so an entry only overrides
+#: when it has a reason to.
+PROVIDER_ROUTE_PARAMS: dict[str, tuple[RouteParam, ...]] = {
+    "openai_compatible": (
+        RouteParam("base_url", required=True, pattern=r"^https?://\S+$"),
+        RouteParam("api_key_env", required=True, is_env_name=True, pattern=r"^[A-Z][A-Z0-9_]*$"),
+    ),
+    "openrouter": (
+        RouteParam("base_url", required=False, pattern=r"^https?://\S+$"),
+        RouteParam("api_key_env", required=False, is_env_name=True, pattern=r"^[A-Z][A-Z0-9_]*$"),
+    ),
+}
+
+
+def route_params_for(provider: str | None) -> tuple[RouteParam, ...]:
+    """What this provider needs. Empty for the ones that need nothing."""
+    return PROVIDER_ROUTE_PARAMS.get(str(provider or "").strip().lower(), ())
+
+
 @singleton
 class ModelRegistry:
     """

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/infra/llm_proxy.py

@@ -23,6 +23,7 @@ from iatoolkit.services.telemetry_service import NoopTelemetryService
 from openai import OpenAI, Timeout         # For OpenAI and xAI (OpenAI-compatible)
 
 from typing import Dict, List, Any, Tuple
+import os
 import threading
 import logging
 from injector import inject
@@ -586,11 +587,13 @@ class LLMProxy:
     ) -> dict:
         provider_config = self.configuration_service.get_llm_provider_config(company_short_name, provider) or {}
         secret_ref = self._model_credential_ref(model_config)
+        route_api_key_env = str(self._model_route(model_config).get("api_key_env") or "").strip() or None
         provider_api_key = self._get_api_key_from_config(
             company_short_name,
             provider,
             required=False,
             secret_ref=secret_ref,
+            route_api_key_env=route_api_key_env,
         )
         gateway_transport = self.gateway_resolver.resolve(
             company_short_name=company_short_name,
@@ -612,8 +615,9 @@ class LLMProxy:
                 provider,
                 required=True,
                 secret_ref=secret_ref,
+                route_api_key_env=route_api_key_env,
             )
-        configured_base_url = self._get_base_url_from_config(company_short_name, provider)
+        configured_base_url = self._get_base_url_from_config(company_short_name, provider, model_config=model_config)
         configured_headers = self._get_default_headers_from_config(company_short_name, provider)
         effective_base_url = gateway_transport.get("base_url") or configured_base_url
         effective_headers = dict(configured_headers)
@@ -726,6 +730,20 @@ class LLMProxy:
     # -------------------------------------------------------------------------
     # Configuration helpers
     # -------------------------------------------------------------------------
+    @staticmethod
+    def _model_route(model_config: Dict[str, Any] | None) -> Dict[str, Any]:
+        """The endpoint and credential variable this model carries, if any.
+
+        Comes from the catalogue entry, so two models of the same provider can sit
+        on two different endpoints — which is what `openai_compatible` could not do
+        while the endpoint lived in each company's own configuration file.
+
+        Empty means "ask the company's configuration", which is what every model
+        did before entries had routes.
+        """
+        route = (model_config or {}).get("route_config") if isinstance(model_config, dict) else None
+        return dict(route) if isinstance(route, dict) else {}
+
     @staticmethod
     def _model_credential_ref(model_config: Dict[str, Any] | None) -> str | None:
         """The secret this model is entitled to run on, when the company owns it.
@@ -753,6 +771,7 @@ class LLMProxy:
         *,
         required: bool = True,
         secret_ref: str | None = None,
+        route_api_key_env: str | None = None,
     ) -> str:
         """
         Read the LLM API key from company configuration and environment variables.
@@ -774,20 +793,36 @@ class LLMProxy:
         provider_keys = llm_config.get("provider_api_keys") or {}
         env_var_name = None
 
-        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
-        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
-        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
-        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
-        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
-        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
+        # Tres orígenes, en este orden, y el orden es la decisión:
+        #
+        # 1) El secreto de la habilitación del modelo, cuando la empresa trae su
+        #    propia key. Es la decisión explícita y por modelo de quién paga, así
+        #    que gana sobre todo lo demás.
+        # 2) La credencial de la ruta del catálogo, leída del entorno del
+        #    deployment y **no** del store de secretos de la empresa: el endpoint es
+        #    del operador, y un cliente que guarde un secreto con ese nombre no
+        #    debería apropiárselo en silencio. Quien quiera pagar con su key usa (1).
+        # 3) El mapeo del archivo de la empresa, que es el respaldo para todo lo que
+        #    no tiene ruta propia — es decir, todo lo que existía antes de esto.
         if secret_ref:
             env_var_name = secret_ref
 
-        # 1) Intentar api-key específica por proveedor (si existe el bloque provider_api_keys)
+        if not env_var_name and route_api_key_env:
+            route_value = str(os.getenv(route_api_key_env) or "").strip()
+            if route_value:
+                return route_value
+            if not required:
+                return ""
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.API_KEY,
+                f"Environment variable '{route_api_key_env}', named by the catalogue entry "
+                f"for provider '{provider}', is not set in this deployment."
+            )
+
         if not env_var_name and provider_keys and isinstance(provider_keys, dict):
             env_var_name = provider_keys.get(provider)
 
-        # 2) Fallback: usar api-key global si no hay específica
+        # Compatibilidad hacia atrás: api-key global cuando no hay una por proveedor.
         if not env_var_name and llm_config.get("api-key"):
             env_var_name = llm_config["api-key"]
 
@@ -818,10 +853,21 @@ class LLMProxy:
 
         return api_key_value
 
-    def _get_base_url_from_config(self, company_short_name: str, provider: str) -> str:
+    def _get_base_url_from_config(
+        self,
+        company_short_name: str,
+        provider: str,
+        model_config: Dict[str, Any] | None = None,
+    ) -> str:
         if provider not in {self.PROVIDER_OPENAI_COMPATIBLE, self.PROVIDER_OPENROUTER}:
             return ""
 
+        # The entry's own endpoint wins: it is the operator's decision about this
+        # model, while the company's configuration is a default for the provider.
+        route_base_url = str(self._model_route(model_config).get("base_url") or "").strip()
+        if route_base_url:
+            return route_base_url
+
         provider_config = self.configuration_service.get_llm_provider_config(company_short_name, provider) or {}
         if not isinstance(provider_config, dict):
             provider_config = {}

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/locales/en.yaml

@@ -2201,6 +2201,11 @@ ui:
     form_secret_value: "Your provider key"
     secret_hint_new: "Stored encrypted for this provider. Your provider bills you directly."
     secret_hint_stored: "A key is already stored for this provider. Paste one to replace it."
+    form_route_base_url: "Endpoint"
+    form_route_base_url_hint: "The full URL requests go to, e.g. https://your-host/v1"
+    form_route_api_key_env: "Credential variable"
+    form_route_api_key_env_hint: "The NAME of an environment variable in this deployment, e.g. OSS_LLM_API_KEY. Never the key itself."
+    route_required: "This provider needs an endpoint and the name of its credential variable."
   secrets:
     title: "Secrets"
     subtitle: "Manage company secrets used by integrations and services."

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/locales/es.yaml

@@ -2207,6 +2207,11 @@ ui:
     form_secret_value: "Tu key del proveedor"
     secret_hint_new: "Se guarda cifrada para este proveedor. Tu proveedor te factura directamente."
     secret_hint_stored: "Ya hay una key guardada para este proveedor. Pegá otra para reemplazarla."
+    form_route_base_url: "Endpoint"
+    form_route_base_url_hint: "La URL completa a la que van las requests, ej. https://tu-host/v1"
+    form_route_api_key_env: "Variable de la credencial"
+    form_route_api_key_env_hint: "El NOMBRE de una variable de entorno de este deployment, ej. OSS_LLM_API_KEY. Nunca la key."
+    route_required: "Este proveedor necesita un endpoint y el nombre de la variable con su credencial."
   secrets:
     title: "Secrets"
     subtitle: "Administra los secrets de la empresa usados por integraciones y servicios."

{iatoolkit-2.41.1 → iatoolkit-2.41.2}/src/iatoolkit/repositories/models.py

@@ -1241,6 +1241,20 @@ class ModelCatalogEntry(Base):
     model_key = Column(String(120), nullable=False, unique=True, index=True)
     provider = Column(String(60), nullable=False, index=True)
 
+    #: How to reach this model, when reaching it is a decision: the endpoint and
+    #: the name of the environment variable holding its credential.
+    #:
+    #: A JSON object rather than columns because providers do not agree on what
+    #: they need — an Azure deployment wants a deployment name and an api version,
+    #: a gateway may want headers — and `base_url` is meaningless for the
+    #: providers whose SDK knows its own. What may go in here is declared per
+    #: provider in `PROVIDER_ROUTE_PARAMS` and validated on write: an unvalidated
+    #: blob becomes decoration, and a typo in a key is silent.
+    #:
+    #: Empty means "ask the company's own configuration", which is what every
+    #: entry did before this existed.
+    route_config = Column(JSON, nullable=False, default=dict)
+
     display_name = Column(String(120), nullable=False)
     description = Column(Text, nullable=False, default="")
 

{iatoolkit-2.41.1 → iatoolkit-2.41.2/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.41.1
+Version: 2.41.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT