iatoolkit 2.69.0__tar.gz → 2.70.0__tar.gz

{iatoolkit-2.69.0/src/iatoolkit.egg-info → iatoolkit-2.70.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.69.0
+Version: 2.70.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.69.0"
+__version__ = "2.70.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/locales/en.yaml

@@ -2087,6 +2087,11 @@ ui:
     routing_profile_hint: "Used by enterprise tool routing to rank and select candidate tools."
 
   api_key:
+    can_act_for_users: "May act on behalf of users"
+    can_act_for_users_help: "Without this, the key acts as itself (service:<name>) and cannot pass for anyone. Turn it on only for integrations that must name the user they act for (a portal with its own login, an MCP gateway)."
+    acts: "Acts"
+    acts_as_itself: "As itself"
+    acts_for_users: "On behalf of users"
     title: "API Keys"
     subtitle: "Manage company API keys used to authenticate external requests."
     new_btn: "New API Key"

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/locales/es.yaml

@@ -2105,6 +2105,11 @@ ui:
     routing_profile_hint: "Usado por el router enterprise para rankear y seleccionar herramientas candidatas."
 
   api_key:
+    can_act_for_users: "Puede actuar en nombre de usuarios"
+    can_act_for_users_help: "Sin esta opción, la llave actúa como sí misma (service:<nombre>) y no puede hacerse pasar por nadie. Actívala solo para integraciones que deben indicar el usuario por el que actúan (un portal con login propio, un gateway MCP)."
+    acts: "Actúa"
+    acts_as_itself: "Como sí misma"
+    acts_for_users: "En nombre de usuarios"
     title: "API Keys"
     subtitle: "Administra las API keys de la empresa para autenticar solicitudes externas."
     new_btn: "Nueva API Key"

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/repositories/models.py

@@ -9,6 +9,7 @@ from sqlalchemy import Column, Integer, BigInteger, String, DateTime, Enum, Text
 from sqlalchemy.orm import DeclarativeBase
 from sqlalchemy.orm import relationship, class_mapper
 from sqlalchemy.sql import func, literal_column
+from sqlalchemy.sql import text as sql_text
 from sqlalchemy import UniqueConstraint, Index
 from sqlalchemy.dialects.postgresql import JSONB
 from datetime import datetime
@@ -125,6 +126,11 @@ class ApiKey(Base):
     is_active = Column(Boolean, default=True, nullable=False)
     created_at = Column(DateTime, default=datetime.now)
     last_used_at = Column(DateTime, nullable=True) # Opcional: para rastrear uso
+    # A key is a service account that acts as itself ("service:<key name>"). Only with
+    # this on may it name the user it acts for, who must belong to the company
+    # (BL-010, Fase 0). Keys created before it existed keep acting for users;
+    # migration: iatoolkit-enterprise/migrations/2026-10-18-api-keys-can-act-for-users.sql
+    can_act_for_users = Column(Boolean, nullable=False, default=False, server_default=sql_text("true"))
 
     company = relationship("Company", back_populates="api_keys")
 

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/services/api_key_service.py

@@ -30,6 +30,8 @@ class ApiKeyService:
             "key_name": api_key.key_name,
             "key": api_key.key,
             "is_active": api_key.is_active,
+            # BL-010, Fase 0: whether the key may name the user it acts for.
+            "can_act_for_users": bool(getattr(api_key, "can_act_for_users", False)),
             "created_at": api_key.created_at.isoformat() if api_key.created_at else None,
             "last_used_at": api_key.last_used_at.isoformat() if api_key.last_used_at else None,
         }
@@ -65,7 +67,7 @@ class ApiKeyService:
 
         return {"data": self._api_key_to_dict(api_key)}
 
-    def create_api_key_entry(self, company_short_name: str, key_name: str) -> Dict:
+    def create_api_key_entry(self, company_short_name: str, key_name: str, can_act_for_users: bool = False) -> Dict:
         company, error = self._get_company(company_short_name)
         if error:
             return error
@@ -81,7 +83,8 @@ class ApiKeyService:
         alphabet = string.ascii_letters + string.digits
         key = ''.join(secrets.choice(alphabet) for _ in range(length))
 
-        api_key = ApiKey(key=key, company_id=company.id, key_name=key_name)
+        # A new key acts as itself unless the admin allows it to act for users (BL-010).
+        api_key = ApiKey(key=key, company_id=company.id, key_name=key_name, can_act_for_users=bool(can_act_for_users))
         created = self.api_key_repo.create_api_key(api_key)
         return {"data": self._api_key_to_dict(created)}
 
@@ -89,7 +92,8 @@ class ApiKeyService:
                              company_short_name: str,
                              api_key_id: int,
                              key_name: str | None = None,
-                             is_active: bool | None = None) -> Dict:
+                             is_active: bool | None = None,
+                             can_act_for_users: bool | None = None) -> Dict:
         company, error = self._get_company(company_short_name)
         if error:
             return error
@@ -98,7 +102,7 @@ class ApiKeyService:
         if not api_key:
             return {"error": "API key not found.", "status_code": 404}
 
-        if key_name is None and is_active is None:
+        if key_name is None and is_active is None and can_act_for_users is None:
             return {"error": "No changes provided.", "status_code": 400}
 
         if key_name is not None:
@@ -116,6 +120,11 @@ class ApiKeyService:
                 return {"error": "Invalid value for is_active.", "status_code": 400}
             api_key.is_active = is_active
 
+        if can_act_for_users is not None:
+            if not isinstance(can_act_for_users, bool):
+                return {"error": "Invalid value for can_act_for_users.", "status_code": 400}
+            api_key.can_act_for_users = can_act_for_users
+
         updated = self.api_key_repo.update_api_key(api_key)
         return {"data": self._api_key_to_dict(updated)}
 

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/services/auth_service.py

@@ -14,6 +14,8 @@ from iatoolkit.repositories.models import AccessLog
 from iatoolkit.infra.google_auth_client import GoogleAuthClient, GoogleAuthError
 from flask import request
 import logging
+import re
+import unicodedata
 import hashlib
 
 
@@ -284,7 +286,11 @@ class AuthService:
                 "success": True,
                 "company_short_name": session_info['company_short_name'],
                 "user_identifier": session_info['user_identifier'],
-                "user_role": (session_info.get('profile') or {}).get('user_role'),
+                # From the database, never from the stored session profile: an SSO
+                # hook writes that profile, and must not be able to grant admin
+                # (BL-010, Fase 0).
+                "user_role": self._role_in_company(session_info['company_short_name'],
+                                                   session_info['user_identifier']),
             }
 
         # --- Priority 2: Check for a valid API Key in headers ---
@@ -311,7 +317,22 @@ class AuthService:
         # get the company from the api_key_entry
         company = api_key_entry.company
 
-        # For API calls, the external_user_id must be provided in the request.
+        # The key is a service account (BL-010, Fase 0): it acts as itself unless it
+        # was allowed to act for users. Every result says which key acted.
+        principal = self.service_principal(api_key_entry)
+        base = {
+            "success": True,
+            "company_short_name": company.short_name,
+            "auth_type": "api_key",
+            "auth_principal": principal,
+            "api_key_id": api_key_entry.id,
+        }
+        # Only an explicit False: a key loaded before the column existed keeps acting for users.
+        if getattr(api_key_entry, "can_act_for_users", None) is False:
+            # Whatever user the request names is ignored: the key cannot pass for anyone.
+            return {**base, "user_identifier": principal, "acting_for": None}
+
+        # A key allowed to act for users must say who (unless the endpoint allows none).
         data = request.get_json(silent=True) or {}
         user_identifier = data.get('user_identifier', '')
         if not anonymous and not user_identifier:
@@ -320,11 +341,20 @@ class AuthService:
                     "error_message": self.i18n_service.t('errors.auth.no_user_identifier_api'),
                     "status_code": 403}
 
-        return {
-            "success": True,
-            "company_short_name": company.short_name,
-            "user_identifier": user_identifier
-        }
+        return {**base, "user_identifier": user_identifier, "acting_for": user_identifier or None}
+
+    SERVICE_PREFIX = "service:"
+
+    @classmethod
+    def service_principal(cls, api_key_entry) -> str:
+        """The identity a key acts with by itself: "service:<key name>" (lowercase, dashes)."""
+        raw = unicodedata.normalize("NFKD", str(getattr(api_key_entry, "key_name", "") or ""))
+        ascii_name = raw.encode("ascii", "ignore").decode("ascii").strip().lower()
+        name = re.sub(r"[^a-z0-9._-]+", "-", ascii_name)
+        return f"{cls.SERVICE_PREFIX}{name.strip('-') or getattr(api_key_entry, 'id', 'key')}"
+
+    def _role_in_company(self, company_short_name: str, user_identifier: str) -> str | None:
+        return self.profile_service.get_role_in_company(company_short_name, user_identifier)
 
     def verify_for_company(self, company_short_name: str, anonymous: bool = False) -> dict:
         """

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/services/profile_service.py

@@ -396,6 +396,20 @@ class ProfileService:
             "profile": profile
         }
 
+    def get_role_in_company(self, company_short_name: str, user_identifier: str) -> str | None:
+        """
+        The person's role in the company as iat_user_company records it; None if
+        not a member. Every authorization reads the role here, never from the
+        stored session profile: an SSO hook writes that profile (BL-010, Fase 0).
+        """
+        try:
+            company = self.profile_repo.get_company_by_short_name(company_short_name)
+            user = self.profile_repo.get_user_by_email(str(user_identifier or "").strip().lower()) if company else None
+            return self.profile_repo.get_user_role_in_company(company.id, user.id) if user else None
+        except Exception as exc:
+            logging.warning("Role of %s in %s could not be read: %s", user_identifier, company_short_name, exc)
+            return None
+
     def _account_user(self, company_short_name: str, session_info: dict):
         profile = session_info.get("profile") or {}
         method = (profile.get("extras") or {}).get("auth_method")

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/views/api_key_api_view.py

@@ -56,7 +56,8 @@ class ApiKeyApiView(MethodView):
 
         data = request.get_json() or {}
         key_name = (data.get("key_name") or "").strip()
-        result = self.api_key_service.create_api_key_entry(company_short_name, key_name)
+        result = self.api_key_service.create_api_key_entry(
+            company_short_name, key_name, can_act_for_users=bool(data.get("can_act_for_users")))
         return self._build_response(result, success_status_code=201)
 
     def put(self, company_short_name: str, api_key_id: int):
@@ -70,12 +71,14 @@ class ApiKeyApiView(MethodView):
             key_name = key_name.strip()
 
         is_active = data["is_active"] if "is_active" in data else None
+        can_act_for_users = data["can_act_for_users"] if "can_act_for_users" in data else None
 
         result = self.api_key_service.update_api_key_entry(
             company_short_name=company_short_name,
             api_key_id=api_key_id,
             key_name=key_name,
-            is_active=is_active
+            is_active=is_active,
+            can_act_for_users=can_act_for_users,
         )
         return self._build_response(result, success_status_code=200)
 

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/views/users_api_view.py

@@ -10,6 +10,7 @@ class UsersApiView(MethodView):
     """
     list company users and their roles
     """
+    MANAGER_ROLES = {"editor", "admin", "owner"}
     @inject
     def __init__(self,
                  auth_service: AuthService,
@@ -22,6 +23,10 @@ class UsersApiView(MethodView):
             auth_result = self.auth_service.verify_for_company(company_short_name, anonymous=True)
             if not auth_result.get("success"):
                 return jsonify(auth_result), auth_result.get("status_code", 401)
+            # Who is in the company and with which role is for the people who run it
+            # (the admin's Team screen), not for every user (BL-010, Fase 0).
+            if "user_role" in auth_result and str(auth_result.get("user_role") or "").lower() not in self.MANAGER_ROLES:
+                return jsonify({"error": "Forbidden"}), 403
 
             # get users of the company
             users = self.profile_service.get_company_users(company_short_name)

{iatoolkit-2.69.0 → iatoolkit-2.70.0}/src/iatoolkit/views/wiki_page_view.py

@@ -59,8 +59,8 @@ class WikiPageView(MethodView):
                                     next=request.full_path.rstrip('?')))
 
         page_kwargs = {"wiki_key": wiki_key, "path": page_path or "/", "user_identifier": user_identifier}
-        # The role lives in the session's profile (ProfileService.get_current_session_info).
-        user_role = (session_info.get('profile') or {}).get('user_role') or session_info.get('user_role')
+        # From the database, never from the session profile (an SSO hook writes it).
+        user_role = self.profile_service.get_role_in_company(company_short_name, user_identifier)
         if self.tenant_wiki_service.viewer_may_read_system_wiki(company_short_name, wiki_key, user_role):
             # A system wiki its feature opened to this role (Memoria for admin and owner).
             page_kwargs["include_system"] = True

{iatoolkit-2.69.0 → iatoolkit-2.70.0/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.69.0
+Version: 2.70.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT