iatoolkit 2.72.1__tar.gz → 2.72.2__tar.gz

{iatoolkit-2.72.1/src/iatoolkit.egg-info → iatoolkit-2.72.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.72.1
+Version: 2.72.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.72.1"
+__version__ = "2.72.2"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/common/access.py

@@ -192,6 +192,38 @@ def filter_llm_models(company_short_name: str, user_identifier: str | None, defa
     return default_model, allowed
 
 
+def stamp(company_short_name: str) -> str | None:
+    """A value that changes whenever the company's groups, members or grants change.
+
+    A person's chat context is built once and cached; when this changes, it is rebuilt
+    so the tools, SQL schema and collections it describes follow the new access."""
+    decider = Access._decider
+    hook = getattr(decider, "stamp", None) if decider is not None else None
+    if not callable(hook):
+        return None
+    try:
+        return hook(company_short_name)
+    except Exception as exc:
+        logging.warning("Access stamp of %s not read: %s", company_short_name, exc)
+        return None
+
+
+def sql_table_filter(company_short_name: str, user_identifier: str | None):
+    """`fn(database, table) -> bool` for the SQL schema shown to this person, or None.
+
+    Some SQL sources hold resources of their own (enterprise's knowledge tables): the
+    decider names their resource type, and each table needs level 1 over it."""
+    decider = Access._decider
+    hook = getattr(decider, "sql_table_resource", None) if decider is not None else None
+    if not user_identifier or not callable(hook):
+        return None
+
+    def allowed(database: str, table: str) -> bool:
+        resource_type = hook(company_short_name, database)
+        return not resource_type or can(company_short_name, user_identifier, USE, resource_type, table)
+    return allowed
+
+
 def person_can(company_short_name: str, auth_result: dict | None, level: int, resource_type: str = "company",
                resource_key: str | None = None) -> bool:
     """A signed-in person's access, from an AuthService result.

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/company_context_service.py

@@ -53,6 +53,7 @@ class CompanyContextService:
         include_yaml_context: bool = True,
         selected_context_files: List[str] | None = None,
         allowed_databases: List[str] | None = None,
+        table_filter=None,
     ) -> dict[str, str]:
         """
         Builds the full context by aggregating three sources:
@@ -81,7 +82,8 @@ class CompanyContextService:
             try:
                 # allowed_databases: the sources this person may query (BL-010); None is all.
                 sql_context, db_tables = self._get_sql_enriched_context(company_short_name,
-                                                                        allowed_databases=allowed_databases)
+                                                                        allowed_databases=allowed_databases,
+                                                                        table_filter=table_filter)
                 sql_context = sql_context.strip()
                 sql_source_table_scopes = self._get_sql_source_table_scopes(company_short_name)
             except Exception as e:
@@ -138,11 +140,13 @@ class CompanyContextService:
             )
         return files
 
-    def get_sql_context(self, company_short_name: str, allowed_databases: List[str] | None = None) -> str:
+    def get_sql_context(self, company_short_name: str, allowed_databases: List[str] | None = None,
+                        table_filter=None) -> str:
         try:
             sql_context, _ = self._get_sql_enriched_context(
                 company_short_name,
                 allowed_databases=allowed_databases,
+                table_filter=table_filter,
             )
             return sql_context
         except Exception as e:
@@ -177,7 +181,8 @@ class CompanyContextService:
             return False
         return bool(cls._table_name_candidates(table_name) & allowed_tables)
 
-    def _get_sql_enriched_context(self, company_short_name: str, allowed_databases: List[str] | None = None):
+    def _get_sql_enriched_context(self, company_short_name: str, allowed_databases: List[str] | None = None,
+                                  table_filter=None):
         """
         Generates the SQL context for the LLM using the enriched schema logic.
         It iterates over configured databases, fetches their enriched structure,
@@ -221,6 +226,15 @@ class CompanyContextService:
                     }
                     if not enriched_structure:
                         continue
+                if table_filter is not None:
+                    # Tables the person may not query (enterprise's knowledge tables, BL-010).
+                    enriched_structure = {
+                        table_name: table_data
+                        for table_name, table_data in enriched_structure.items()
+                        if table_filter(db_name, table_name)
+                    }
+                    if not enriched_structure:
+                        continue
 
                 # 2. Build Header for this Database
                 dialect = self.sql_service.get_database_dialect(company_short_name, db_name)

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/context_builder_service.py

@@ -19,6 +19,7 @@ from iatoolkit.services.prompt_service import PromptService
 from iatoolkit.services.structured_output_service import StructuredOutputService
 from iatoolkit.common.util import Utility
 from iatoolkit.repositories.models import Company, PromptResourceType
+from iatoolkit.common import access
 
 
 class ContextBuilderService:
@@ -227,7 +228,8 @@ class ContextBuilderService:
         # sources and collections this person may use (BL-010, Fase 2).
         allowed_databases, allowed_collections = self._access_restrictions(company_short_name, user_identifier)
         company_context_blocks = self.company_context_service.get_company_context_blocks(
-            company_short_name, allowed_databases=allowed_databases)
+            company_short_name, allowed_databases=allowed_databases,
+            table_filter=access.sql_table_filter(company_short_name, user_identifier))
         collection_context = "" if allowed_collections == [] else self._build_collection_context(
             company_short_name, collection_names=allowed_collections)
 
@@ -386,6 +388,7 @@ class ContextBuilderService:
             sql_context = self.company_context_service.get_sql_context(
                 company_short_name,
                 allowed_databases=sql_sources,
+                table_filter=access.sql_table_filter(company_short_name, user_identifier),
             )
 
         collection_context = ""
@@ -399,6 +402,7 @@ class ContextBuilderService:
         company_context_blocks = self.company_context_service.get_company_context_blocks(
             company_short_name,
             allowed_databases=allowed_databases,
+            table_filter=access.sql_table_filter(company_short_name, user_identifier),
             include_sql_context=bool(company_context_policy.get("sql_context")),
             include_yaml_context=bool(company_context_policy.get("yaml_context")),
         )

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/knowledge_base_service.py

@@ -610,7 +610,11 @@ class KnowledgeBaseService:
             else:
                 query = query.filter(Document.status == status)
 
-        if collection:
+        if isinstance(collection, (list, tuple, set)):
+            # Several collections: those a person may see (BL-010). An empty list is none.
+            names = [str(c).strip().lower() for c in collection if str(c or "").strip()]
+            query = query.join(Document.collection_type).filter(func.lower(CollectionType.name).in_(names or [""]))
+        elif collection:
             normalized_collection = str(collection).strip().lower()
             query = query.join(Document.collection_type).filter(
                 func.lower(CollectionType.name) == normalized_collection

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/query_service.py

@@ -962,6 +962,18 @@ class QueryService:
 
         return paths
 
+    def _access_changed_since_context(self, company_short_name: str, user_identifier: str) -> bool:
+        if not access.Access.registered():
+            return False
+        current = access.stamp(company_short_name)
+        if not current:
+            return False
+        try:
+            built_with = self.session_context.get_access_stamp(company_short_name, user_identifier)
+        except Exception:
+            return False
+        return built_with is not None and built_with != current
+
     def _ensure_valid_history(self, company,
                               user_identifier: str,
                               effective_model: str,
@@ -987,6 +999,10 @@ class QueryService:
         needs_rebuild = self.history_manager.populate_request_params(
             handle, user_turn_prompt, ignore_history
         )
+        # A context built before an access change describes tools, SQL sources or
+        # collections the person may no longer use (or misses new ones): rebuild it.
+        if not needs_rebuild and self._access_changed_since_context(company.short_name, user_identifier):
+            needs_rebuild = True
 
         if needs_rebuild:
             logging.warning(f"No valid history for {company.short_name}/{user_identifier}. Rebuilding context...")
@@ -1241,6 +1257,9 @@ class QueryService:
         # Determine if we need to persist the prepared context again.
         rebuild_is_needed = (prev_version != current_version)
 
+        # The access the context was built with: when it changes, the context is rebuilt.
+        self.session_context.save_access_stamp(company_short_name, user_identifier, access.stamp(company_short_name))
+
         # Save the prepared context and its version for `set_context_for_llm` to use.
         self.session_context.save_prepared_context(company_short_name,
                                                    user_identifier,

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/resource_access_scope.py

@@ -101,6 +101,48 @@ class ResourceAccessScope:
                     scoped["allowed_wiki_keys"] = [k for k in allowed if not requested or k in requested]
         return scoped
 
+    # ---------------------------------------------------------------- the RAG API
+    def scope_collection(self, company_short_name: str, user_identifier: str | None, collection,
+                         *, multi: bool):
+        """A collection argument narrowed for this person (the RAG REST API, BL-010).
+
+        Named collections must all be visible; with none named, the visible ones
+        (a list when `multi`, the only one otherwise). Raises PERMISSION."""
+        if not user_identifier or not access.Access.registered():
+            return collection
+        named = _as_list(collection)
+        if named:
+            denied = [c for c in named if not self._can_see_collection(company_short_name, user_identifier, c)]
+            if denied:
+                raise _denied(f"No access to the collection '{denied[0]}'.")
+            return collection
+        allowed = self.allowed_collections(company_short_name, user_identifier)
+        if allowed is None:
+            return collection
+        if not allowed:
+            raise _denied("No access to any document collection.")
+        if multi:
+            return allowed
+        if len(allowed) == 1:
+            return allowed[0]
+        raise _denied("Name the collection: you can see only some of them.")
+
+    def document_allowed(self, company_short_name: str, user_identifier: str | None, document_id) -> bool:
+        if not user_identifier or not access.Access.registered():
+            return True
+        collection = self._document_collection(company_short_name, document_id)
+        return not collection or self._can_see_collection(company_short_name, user_identifier, collection)
+
+    def visible_collection_filter(self, company_short_name: str, user_identifier: str | None):
+        """`fn(collection_name) -> bool` for lists of documents; None when nothing is restricted."""
+        if not user_identifier or not access.Access.registered():
+            return None
+        allowed = self.allowed_collections(company_short_name, user_identifier)
+        if allowed is None:
+            return None
+        allowed_set = set(allowed)
+        return lambda name: name in allowed_set
+
     # ------------------------------------------------------------------- listings
     def allowed_collections(self, company_short_name: str, user_identifier: str | None) -> list[str] | None:
         """The collections the person may see, or None when nothing is restricted for them."""

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/services/user_session_context_service.py

@@ -190,6 +190,18 @@ class UserSessionContextService:
             normalized.append(key)
         return normalized
 
+    def save_access_stamp(self, company_short_name: str, user_identifier: str, stamp: str | None):
+        """The company's access stamp the person's cached context was built with (BL-010)."""
+        session_key = self._get_session_key(company_short_name, user_identifier)
+        if session_key and stamp:
+            RedisSessionManager.hset(session_key, "access_stamp", stamp)
+
+    def get_access_stamp(self, company_short_name: str, user_identifier: str) -> Optional[str]:
+        session_key = self._get_session_key(company_short_name, user_identifier)
+        if not session_key:
+            return None
+        return RedisSessionManager.hget(session_key, "access_stamp")
+
     def save_context_version(self,
             company_short_name: str,
             user_identifier: str,

{iatoolkit-2.72.1 → iatoolkit-2.72.2}/src/iatoolkit/views/rag_api_view.py

@@ -39,6 +39,35 @@ class RagApiView(MethodView):
         self.utility = utility
         self.i18n_service = i18n_service
 
+    # What a person may reach (BL-010): only the collections and documents they may see.
+    @staticmethod
+    def _access_scope():
+        from iatoolkit import current_iatoolkit
+        from iatoolkit.services.resource_access_scope import ResourceAccessScope
+        return current_iatoolkit().get_injector().get(ResourceAccessScope)
+
+    def _scoped_collection(self, company_short_name: str, auth_result: dict, collection, *, multi: bool):
+        """The collection argument narrowed to what the person sees; raises PERMISSION."""
+        from iatoolkit.common import access
+        if not access.Access.registered():
+            return collection
+        return self._access_scope().scope_collection(company_short_name, auth_result.get("user_identifier"),
+                                                     collection, multi=multi)
+
+    def _document_denied(self, company_short_name: str, auth_result: dict, document_id):
+        from iatoolkit.common import access
+        if not access.Access.registered():
+            return None
+        if self._access_scope().document_allowed(company_short_name, auth_result.get("user_identifier"), document_id):
+            return None
+        return jsonify({'result': 'error', 'message': 'No access to that document.'}), 403
+
+    @staticmethod
+    def _permission_denied(exc: IAToolkitException):
+        if exc.error_type == IAToolkitException.ErrorType.PERMISSION:
+            return jsonify({'result': 'error', 'message': exc.message, 'error_message': exc.message}), 403
+        return None
+
     def dispatch_request(self, *args, **kwargs):
         """
         Sobreescribimos el dispatch para soportar el mapeo de acciones personalizadas
@@ -111,7 +140,8 @@ class RagApiView(MethodView):
             keyword = data.get('filename_keyword')
             from_date_str = data.get('from_date')
             to_date_str = data.get('to_date')
-            collection = data.get('collection', '')
+            collection = self._scoped_collection(company_short_name, auth_result, data.get('collection', ''),
+                                                 multi=True)
             metadata_key = str(data.get('metadata_key') or '').strip()
             metadata_value = str(data.get('metadata_value') or '').strip()
             metadata_match_mode = str(data.get('metadata_match_mode') or '').strip().lower()
@@ -181,6 +211,8 @@ class RagApiView(MethodView):
             }), 200
 
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({'result': 'error', 'message': e.message}), e.http_code
         except Exception as e:
             return jsonify({'result': 'error', 'message': str(e)}), 500
@@ -242,6 +274,9 @@ class RagApiView(MethodView):
                 return jsonify(auth_result), auth_result.get("status_code")
 
             # 2. Get content from service
+            denied = self._document_denied(company_short_name, auth_result, document_id)
+            if denied:
+                return denied
             file_bytes, filename = self.knowledge_base_service.get_document_content(document_id)
 
             if not file_bytes:
@@ -262,6 +297,8 @@ class RagApiView(MethodView):
             )
 
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({'result': 'error', 'message': e.message}), e.http_code
         except Exception as e:
             return jsonify({'result': 'error', 'message': str(e)}), 500
@@ -278,6 +315,9 @@ class RagApiView(MethodView):
                 return jsonify(auth_result), auth_result.get("status_code")
 
             # 2. Call Service
+            denied = self._document_denied(company_short_name, auth_result, document_id)
+            if denied:
+                return denied
             success = self.knowledge_base_service.delete_document(document_id)
 
             if success:
@@ -288,6 +328,8 @@ class RagApiView(MethodView):
                 return jsonify({'result': 'error', 'message': msg}), 404
 
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({'result': 'error', 'message': e.message}), e.http_code
         except Exception as e:
             return jsonify({'result': 'error', 'message': str(e)}), 500
@@ -308,7 +350,7 @@ class RagApiView(MethodView):
             data = request.get_json() or {}
             query = data.get('query')
             n_results = int(data.get('k', 5))
-            collection = data.get('collection')
+            collection = self._scoped_collection(company_short_name, auth_result, data.get('collection'), multi=True)
             metadata_filter = data.get('metadata_filter')
             # The Search Lab can compare modes; empty means the company's own.
             search_mode = str(data.get('search_mode') or '').strip().lower() or None
@@ -340,6 +382,8 @@ class RagApiView(MethodView):
             }), 200
 
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({'result': 'error', 'error_message': e.message}), 501
         except Exception as e:
             return jsonify({'result': 'error', 'error_message': str(e)}), 500
@@ -360,6 +404,7 @@ class RagApiView(MethodView):
                 return self._bad_request("query is required", error_code="INVALID_REQUEST")
 
             collection, n_results, metadata_filter = self._parse_common_search_params(data)
+            collection = self._scoped_collection(company_short_name, auth_result, collection, multi=True)
 
             chunks = self.knowledge_base_service.search(
                 company_short_name=company_short_name,
@@ -381,6 +426,8 @@ class RagApiView(MethodView):
         except ValueError as e:
             return self._bad_request(str(e), error_code="INVALID_REQUEST")
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": e.message}), e.http_code
         except Exception as e:
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": str(e)}), 500
@@ -401,6 +448,7 @@ class RagApiView(MethodView):
                 return self._bad_request("query is required", error_code="INVALID_REQUEST")
 
             collection, n_results, metadata_filter = self._parse_common_search_params(data)
+            collection = self._scoped_collection(company_short_name, auth_result, collection, multi=False)
 
             results = self.visual_kb_service.search_images(
                 company_short_name=company_short_name,
@@ -422,6 +470,8 @@ class RagApiView(MethodView):
         except ValueError as e:
             return self._bad_request(str(e), error_code="INVALID_REQUEST")
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": e.message}), e.http_code
         except Exception as e:
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": str(e)}), 500
@@ -442,6 +492,7 @@ class RagApiView(MethodView):
                 return self._bad_request("image_base64 is required", error_code="INVALID_REQUEST")
 
             collection, n_results, metadata_filter = self._parse_common_search_params(data)
+            collection = self._scoped_collection(company_short_name, auth_result, collection, multi=False)
             image_bytes = self.utility.normalize_base64_payload(image_base64)
             if not image_bytes:
                 return self._bad_request("image_base64 is empty or invalid", error_code="INVALID_REQUEST")
@@ -466,6 +517,8 @@ class RagApiView(MethodView):
         except ValueError as e:
             return self._bad_request(str(e), error_code="INVALID_REQUEST")
         except IAToolkitException as e:
+            if self._permission_denied(e):
+                return self._permission_denied(e)
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": e.message}), e.http_code
         except Exception as e:
             return jsonify({"result": "error", "error_code": "INTERNAL_ERROR", "message": str(e)}), 500

{iatoolkit-2.72.1 → iatoolkit-2.72.2/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.72.1
+Version: 2.72.2
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT