kailash 0.6.0__py3-none-any.whl → 0.6.2__py3-none-any.whl

kailash/middleware/gateway/event_store.py

@@ -13,7 +13,7 @@ import logging
 import time
 import uuid
 from dataclasses import dataclass, field
-from datetime import datetime
+from datetime import UTC, datetime
 from enum import Enum
 from typing import Any, AsyncIterator, Callable, Dict, List, Optional
 
@@ -55,7 +55,7 @@ class RequestEvent:
     event_id: str = field(default_factory=lambda: f"evt_{uuid.uuid4().hex[:12]}")
     event_type: EventType = EventType.REQUEST_CREATED
     request_id: str = ""
-    timestamp: datetime = field(default_factory=datetime.utcnow)
+    timestamp: datetime = field(default_factory=lambda: datetime.now(UTC))
     sequence_number: int = 0
     data: Dict[str, Any] = field(default_factory=dict)
     metadata: Dict[str, Any] = field(default_factory=dict)
@@ -103,6 +103,7 @@ class EventStore:
         # In-memory buffer
         self._buffer: List[RequestEvent] = []
         self._buffer_lock = asyncio.Lock()
+        self._flush_in_progress = False
 
         # Event stream
         self._event_stream: List[RequestEvent] = []
@@ -120,7 +121,16 @@ class EventStore:
         self.flush_count = 0
 
         # Start flush task
-        self._flush_task = asyncio.create_task(self._flush_loop())
+        try:
+            self._flush_task = asyncio.create_task(self._flush_loop())
+        except RuntimeError:
+            # If no event loop is running, defer task creation
+            self._flush_task = None
+
+    async def _ensure_flush_task(self):
+        """Ensure the flush task is running."""
+        if self._flush_task is None:
+            self._flush_task = asyncio.create_task(self._flush_loop())
 
     async def append(
         self,
@@ -130,6 +140,9 @@ class EventStore:
         metadata: Optional[Dict[str, Any]] = None,
     ) -> RequestEvent:
         """Append an event to the store."""
+        # Ensure flush task is running
+        await self._ensure_flush_task()
+
         async with self._buffer_lock:
             # Get next sequence number
             sequence = self._sequences.get(request_id, 0)
@@ -148,19 +161,27 @@ class EventStore:
             self._buffer.append(event)
             self.event_count += 1
 
-            # Flush if buffer is full
-            if len(self._buffer) >= self.batch_size:
-                await self._flush_buffer()
+            # Check if we need to flush (but don't flush inside the lock)
+            needs_flush = len(self._buffer) >= self.batch_size
 
-            # Apply projections
-            await self._apply_projections(event)
+        # Apply projections outside the lock
+        await self._apply_projections(event)
 
-            logger.debug(
-                f"Appended event {event.event_type.value} for request {request_id} "
-                f"(seq: {sequence})"
-            )
+        # Flush if needed (outside the lock to avoid deadlock)
+        if needs_flush and not self._flush_in_progress:
+            # Set flag to prevent concurrent flushes
+            self._flush_in_progress = True
+            try:
+                await self._flush_buffer()
+            finally:
+                self._flush_in_progress = False
 
-            return event
+        logger.debug(
+            f"Appended event {event.event_type.value} for request {request_id} "
+            f"(seq: {sequence})"
+        )
+
+        return event
 
     async def get_events(
         self,
@@ -233,6 +254,9 @@ class EventStore:
         follow: bool = False,
     ) -> AsyncIterator[RequestEvent]:
         """Stream events as they occur."""
+        # Ensure buffer is flushed before streaming
+        await self._flush_buffer()
+
         last_index = 0
 
         while True:
@@ -294,12 +318,19 @@ class EventStore:
 
     async def _flush_buffer(self) -> None:
         """Flush event buffer to storage."""
-        async with self._buffer_lock:
-            if not self._buffer:
-                return
-
-            events_to_flush = self._buffer.copy()
-            self._buffer.clear()
+        # Acquire lock with timeout to prevent deadlock
+        try:
+            # Use wait_for to add timeout on lock acquisition
+            async with asyncio.timeout(1.0):  # 1 second timeout
+                async with self._buffer_lock:
+                    if not self._buffer:
+                        return
+
+                    events_to_flush = self._buffer.copy()
+                    self._buffer.clear()
+        except asyncio.TimeoutError:
+            logger.warning("Timeout acquiring buffer lock during flush")
+            return
 
         # Add to in-memory stream
         async with self._stream_lock:
@@ -317,10 +348,16 @@ class EventStore:
         while True:
             try:
                 await asyncio.sleep(self.flush_interval)
-                await self._flush_buffer()
+                if not self._flush_in_progress:
+                    self._flush_in_progress = True
+                    try:
+                        await self._flush_buffer()
+                    finally:
+                        self._flush_in_progress = False
             except asyncio.CancelledError:
                 # Final flush before shutdown
-                await self._flush_buffer()
+                if not self._flush_in_progress:
+                    await self._flush_buffer()
                 break
             except Exception as e:
                 logger.error(f"Flush error: {e}")
@@ -388,11 +425,14 @@ class EventStore:
 
     async def close(self) -> None:
         """Close event store and flush remaining events."""
-        self._flush_task.cancel()
-        try:
-            await self._flush_task
-        except asyncio.CancelledError:
-            pass
+        if self._flush_task is not None:
+            self._flush_task.cancel()
+            try:
+                await self._flush_task
+            except asyncio.CancelledError:
+                pass
+        # Final flush
+        await self._flush_buffer()
 
 
 # Example projection handlers

kailash/middleware/mcp/enhanced_server.py

@@ -389,7 +389,7 @@ result = {'execution_result': execution_result}
         tool_node = self.tools[tool_name]
 
         try:
-            result = tool_node.process({"tool_input": arguments})
+            result = tool_node.execute(tool_input=arguments)
 
             # Emit middleware event
             if self.event_stream:
@@ -433,7 +433,7 @@ result = {'execution_result': execution_result}
         resource_node = self.resources[uri]
 
         try:
-            result = resource_node.process({"resource_uri": uri})
+            result = resource_node.execute({"resource_uri": uri})
 
             # Emit middleware event
             if self.event_stream:

kailash/nodes/admin/permission_check.py

@@ -721,36 +721,67 @@ class PermissionCheckNode(Node):
         }
 
     def _get_user_context(self, user_id: str, tenant_id: str) -> Optional[UserContext]:
-        """Get user context for permission evaluation."""
-        # Query user data from unified admin schema
-        query = """
-        SELECT user_id, email, roles, attributes, status, tenant_id
+        """Get user context for permission evaluation with strict tenant isolation."""
+        # Query user data and assigned roles from unified admin schema
+        user_query = """
+        SELECT user_id, email, attributes, status, tenant_id
         FROM users
         WHERE user_id = $1 AND tenant_id = $2 AND status = 'active'
         """
 
+        # Get assigned roles from user_role_assignments table with strict tenant isolation
+        roles_query = """
+        SELECT role_id
+        FROM user_role_assignments
+        WHERE user_id = $1 AND tenant_id = $2 AND is_active = true
+        """
+
         try:
-            result = self._db_node.run(
-                query=query, parameters=[user_id, tenant_id], result_format="dict"
+            # Get user data - strict tenant check
+            user_result = self._db_node.run(
+                query=user_query, parameters=[user_id, tenant_id], result_format="dict"
             )
 
-            # Handle the corrected result structure
-            user_rows = result.get("data", [])
+            user_rows = user_result.get("data", [])
             if not user_rows:
+                # User not found in this tenant - strict tenant isolation
+                self.logger.debug(f"User {user_id} not found in tenant {tenant_id}")
                 return None
 
             user_data = user_rows[0]
 
+            # Verify tenant isolation - ensure user belongs to the requested tenant
+            if user_data.get("tenant_id") != tenant_id:
+                self.logger.warning(
+                    f"Tenant isolation violation: User {user_id} belongs to {user_data.get('tenant_id')} but permission check requested for {tenant_id}"
+                )
+                return None
+
+            # Get assigned roles - also with strict tenant isolation
+            roles_result = self._db_node.run(
+                query=roles_query, parameters=[user_id, tenant_id], result_format="dict"
+            )
+
+            role_rows = roles_result.get("data", [])
+            assigned_roles = [row["role_id"] for row in role_rows]
+
+            # Log for debugging tenant isolation
+            self.logger.debug(
+                f"User {user_id} in tenant {tenant_id} has roles: {assigned_roles}"
+            )
+
             return UserContext(
                 user_id=user_data["user_id"],
                 tenant_id=user_data["tenant_id"],
                 email=user_data["email"],
-                roles=user_data.get("roles", []),
+                roles=assigned_roles,
                 attributes=user_data.get("attributes", {}),
             )
         except Exception as e:
             # Log the error and return None to indicate user not found
-            self.logger.warning(f"Failed to get user context for {user_id}: {e}")
+            self.logger.warning(
+                f"Failed to get user context for {user_id} in tenant {tenant_id}: {e}"
+            )
             return None
 
     def _check_rbac_permission(
@@ -826,39 +857,57 @@ class PermissionCheckNode(Node):
         return permissions
 
     def _get_role_permissions(self, role_id: str, tenant_id: str) -> Set[str]:
-        """Get permissions for a specific role including inherited permissions."""
-        # Query role and its hierarchy
+        """Get permissions for a specific role including inherited permissions with strict tenant isolation."""
+        # Query role and its hierarchy with strict tenant boundaries
         query = """
         WITH RECURSIVE role_hierarchy AS (
-            SELECT role_id, permissions, parent_roles
+            SELECT role_id, permissions, parent_roles, tenant_id
             FROM roles
             WHERE role_id = $1 AND tenant_id = $2 AND is_active = true
 
             UNION ALL
 
-            SELECT r.role_id, r.permissions, r.parent_roles
+            SELECT r.role_id, r.permissions, r.parent_roles, r.tenant_id
             FROM roles r
             JOIN role_hierarchy rh ON r.role_id = ANY(
                 SELECT jsonb_array_elements_text(rh.parent_roles)
             )
-            WHERE r.tenant_id = $2 AND r.is_active = true
+            WHERE r.tenant_id = $3 AND r.is_active = true
         )
         SELECT DISTINCT unnest(
             CASE
                 WHEN jsonb_typeof(permissions) = 'array'
                 THEN ARRAY(SELECT jsonb_array_elements_text(permissions))
+                WHEN permissions IS NOT NULL AND permissions::text != 'null'
+                THEN ARRAY[permissions::text]
                 ELSE ARRAY[]::text[]
             END
         ) as permission
         FROM role_hierarchy
+        WHERE tenant_id = $4
         """
 
-        result = self._db_node.run(
-            query=query, parameters=[role_id, tenant_id], result_format="dict"
-        )
-        permission_rows = result.get("data", [])
+        try:
+            result = self._db_node.run(
+                query=query,
+                parameters=[role_id, tenant_id, tenant_id, tenant_id],
+                result_format="dict",
+            )
+            permission_rows = result.get("data", [])
 
-        return {row["permission"] for row in permission_rows}
+            permissions = {
+                row["permission"] for row in permission_rows if row["permission"]
+            }
+            self.logger.debug(
+                f"Role {role_id} in tenant {tenant_id} has permissions: {permissions}"
+            )
+
+            return permissions
+        except Exception as e:
+            self.logger.warning(
+                f"Failed to get permissions for role {role_id} in tenant {tenant_id}: {e}"
+            )
+            return set()
 
     def _build_permission_explanation(
         self,
@@ -1189,23 +1238,54 @@ class PermissionCheckNode(Node):
         }
 
     def _get_role_direct_permissions(self, role_id: str, tenant_id: str) -> Set[str]:
-        """Get direct permissions for a role (no inheritance)."""
+        """Get direct permissions for a role (no inheritance) with proper format handling."""
         query = """
         SELECT permissions
         FROM roles
         WHERE role_id = $1 AND tenant_id = $2 AND is_active = true
         """
 
-        result = self._db_node.run(
-            query=query, parameters=[role_id, tenant_id], result_format="dict"
-        )
-        role_rows = result.get("data", [])
-        role_data = role_rows[0] if role_rows else None
+        try:
+            result = self._db_node.run(
+                query=query, parameters=[role_id, tenant_id], result_format="dict"
+            )
+            role_rows = result.get("data", [])
+            role_data = role_rows[0] if role_rows else None
 
-        if not role_data:
-            return set()
+            if not role_data:
+                self.logger.debug(f"Role {role_id} not found in tenant {tenant_id}")
+                return set()
 
-        return set(role_data.get("permissions", []))
+            permissions_data = role_data.get("permissions", [])
+
+            # Handle different permission storage formats
+            if isinstance(permissions_data, list):
+                permissions = set(permissions_data)
+            elif isinstance(permissions_data, str):
+                try:
+                    # Try to parse as JSON array
+                    import json
+
+                    parsed = json.loads(permissions_data)
+                    permissions = (
+                        set(parsed) if isinstance(parsed, list) else {permissions_data}
+                    )
+                except (json.JSONDecodeError, TypeError):
+                    # Treat as single permission string
+                    permissions = {permissions_data} if permissions_data else set()
+            else:
+                permissions = set()
+
+            self.logger.debug(
+                f"Role {role_id} direct permissions in tenant {tenant_id}: {permissions}"
+            )
+            return permissions
+
+        except Exception as e:
+            self.logger.warning(
+                f"Failed to get direct permissions for role {role_id} in tenant {tenant_id}: {e}"
+            )
+            return set()
 
     def _explain_permission(self, inputs: Dict[str, Any]) -> Dict[str, Any]:
         """Provide detailed explanation of permission logic."""
@@ -1625,7 +1705,7 @@ class PermissionCheckNode(Node):
             audit_query = """
             INSERT INTO admin_audit_log (
                 user_id, action, resource_type, resource_id,
-                operation, details, success, tenant_id, created_at
+                operation, context, success, tenant_id, created_at
             ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
             """