imbi-plugin-openai 2.44.0__py3-none-any.whl

imbi/plugins/openai/__init__.py

@@ -0,0 +1,8 @@
+"""Imbi OpenAI plugin: workload identity federation."""
+
+from imbi.plugins.openai.plugin import OpenAIPlugin
+from imbi.plugins.openai.wif import OpenAIExchanger, OpenAIWif
+
+PLUGIN = OpenAIPlugin
+
+__all__ = ['PLUGIN', 'OpenAIExchanger', 'OpenAIPlugin', 'OpenAIWif']

imbi/plugins/openai/plugin.py

@@ -0,0 +1,21 @@
+"""The OpenAI plugin manifest.
+
+The plugin has no Integration capability. It adds the ``openai_wif``
+secret provider and the OpenAI token exchanger (for AI Providers).
+"""
+
+import imbi.common.plugins as plugins
+from imbi.plugins.openai import wif
+
+
+class OpenAIPlugin(plugins.Plugin):
+    manifest = plugins.PluginManifest(
+        slug='openai',
+        name='OpenAI',
+        description='OpenAI workload identity federation for model calls',
+        icon='si-openai',
+        auth_type='none',
+        capabilities=[],
+        secret_providers=[wif.OpenAIWif],
+        token_exchangers=[wif.OpenAIExchanger],
+    )

imbi/plugins/openai/wif.py

@@ -0,0 +1,83 @@
+"""OpenAI workload identity federation (WIF plan 3.3, 4.3, 4.5).
+
+- :class:`OpenAIExchanger` exchanges an identity JWT for an OpenAI
+  access token at a fixed endpoint (D8), with an RFC 8693 token
+  exchange.
+- :class:`OpenAIWif` is the ``openai_wif`` secret provider. A dynamic
+  binding holds the exchanger target. Each resolution mints a new token
+  for the agent of the task through core (``vendor_token``).
+
+The subject token and the access token are never logged.
+"""
+
+import typing
+
+import pydantic
+
+from imbi.common.plugins import identity
+
+#: Fixed in code (D8). No tenant setting can change it.
+TOKEN_URL = 'https://auth.openai.com/oauth/token'
+_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange'
+_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:jwt'
+
+_Id = typing.Annotated[
+    str,
+    pydantic.StringConstraints(
+        min_length=1, max_length=128, pattern=r'^[A-Za-z0-9_-]+$'
+    ),
+]
+
+
+class _Target(pydantic.BaseModel):
+    """The OpenAI ids of one workload identity provider and account."""
+
+    model_config = pydantic.ConfigDict(extra='forbid')
+
+    identity_provider_id: _Id
+    service_account_id: _Id
+
+
+class OpenAIExchanger(identity.TokenExchanger):
+    vendor = 'openai'
+    label = 'OpenAI'
+    target_help = (
+        f'{identity.target_keys(_Target)}, the ids from the OpenAI dashboard.'
+    )
+    #: The audience of the OpenAI workload identity provider. The
+    #: provider in the OpenAI dashboard must use this value.
+    audience = 'https://api.openai.com/v1'
+    #: An OpenAI token never outlives its subject token. 3300 seconds
+    #: keeps the ``aws_sts`` role session at 3600 seconds, the AWS
+    #: limit for role chaining (imbi-api on IRSA or EKS Pod Identity).
+    jwt_seconds = 3300
+
+    def validate_target(
+        self, target: dict[str, typing.Any]
+    ) -> dict[str, typing.Any]:
+        return identity.validate_model(_Target, target)
+
+    async def exchange(
+        self, target: dict[str, typing.Any], identity_token: str
+    ) -> identity.AccessToken:
+        return await identity.post_exchange(
+            'OpenAI',
+            TOKEN_URL,
+            {
+                'grant_type': _GRANT_TYPE,
+                'subject_token': identity_token,
+                'subject_token_type': _SUBJECT_TOKEN_TYPE,
+                **target,
+            },
+        )
+
+
+EXCHANGER = OpenAIExchanger()
+
+
+class OpenAIWif(identity.WifSecretProvider):
+    """``openai_wif``: an OpenAI token for the agent of the task."""
+
+    type = 'openai_wif'
+    label = 'OpenAI workload identity'
+    exchanger = EXCHANGER

imbi_plugin_openai-2.44.0.dist-info/METADATA

@@ -0,0 +1,54 @@
+Metadata-Version: 2.5
+Name: imbi-plugin-openai
+Version: 2.44.0
+Summary: OpenAI workload identity federation for Imbi
+Author-email: "Gavin M. Roy" <gavinr@aweber.com>
+License-Expression: BSD-3-Clause
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.14
+Requires-Dist: imbi-common==2.44.0
+Requires-Dist: pydantic>=2
+Description-Content-Type: text/markdown
+
+# imbi-plugin-openai
+
+OpenAI workload identity federation (WIF) for Imbi. The plugin adds:
+
+- The OpenAI token exchanger. An OpenAI AI Provider can then use workload
+  identity instead of a stored key (Admin, AI Models).
+- The `openai_wif` secret provider. A dynamic binding then mints a
+  short-lived OpenAI token for the agent of the task. The harness does
+  not use it yet: the Claude Agent SDK calls only the Anthropic API.
+
+## How it works
+
+1. The organization selects an identity source (for example `aws_sts`) in
+   Admin, Secrets, Identity.
+2. In the OpenAI dashboard, create a workload identity provider for the
+   issuer of that identity source. Set its audience to
+   `https://api.openai.com/v1`. Imbi always requests this audience.
+   See the [OpenAI guide](https://developers.openai.com/api/reference/workload-identity-federation).
+3. Create a service account and a mapping. The mapping matches the role
+   ARN (`sub`) and the request tag `imbi_ai_provider` (an AI Provider) or
+   `imbi_agent` (an agent). AWS request tags are nested in the JWT, so
+   expose them with a CEL transformation, for example
+   `assertion["https://sts.amazonaws.com/"]["request_tags"]["imbi_ai_provider"]`.
+4. Give Imbi the ids: on the AI Provider (Admin, AI Models, the key icon)
+   or in a dynamic `openai_wif` binding.
+5. At use time, Imbi gets a new identity JWT that lasts 55 minutes, and
+   exchanges it at `https://auth.openai.com/oauth/token` (RFC 8693). The
+   token never outlives the JWT.
+
+## Target
+
+| Field                  | Required | Description                               |
+| ---------------------- | -------- | ----------------------------------------- |
+| `identity_provider_id` | yes      | The OpenAI workload identity provider id. |
+| `service_account_id`   | yes      | The OpenAI service account id.            |
+
+The provider takes no configuration.

imbi_plugin_openai-2.44.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+imbi/plugins/openai/__init__.py,sha256=AF8RgSyQ-1_wxySgEUHsOyNPFNCzaWwot_-J7DQpAfc,265
+imbi/plugins/openai/plugin.py,sha256=vNGYtnSJ242FaFMtrQ0dNZrHKyFeeOaEjSy7V1dbMIQ,618
+imbi/plugins/openai/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+imbi/plugins/openai/wif.py,sha256=Gvf-k3j8WZrZxt_9R3UDZ7Jp7mBIzetjD3lbkjC51-w,2567
+imbi_plugin_openai-2.44.0.dist-info/METADATA,sha256=5ESav64AQ8uoe6CnQWGu0mfSwj3_i0BL5IeRC-eWAEE,2469
+imbi_plugin_openai-2.44.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+imbi_plugin_openai-2.44.0.dist-info/RECORD,,

imbi_plugin_openai-2.44.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any