kailash 0.6.1__py3-none-any.whl → 0.6.2__py3-none-any.whl

kailash/__init__.py

@@ -33,7 +33,7 @@ except ImportError:
 # For backward compatibility
 WorkflowGraph = Workflow
 
-__version__ = "0.6.1"
+__version__ = "0.6.2"
 
 __all__ = [
     # Core workflow components

kailash/core/actors/connection_actor.py

@@ -47,7 +47,7 @@ class Message:
     type: MessageType = MessageType.QUERY
     payload: Any = None
     reply_to: Optional[asyncio.Queue] = None
-    timestamp: datetime = field(default_factory=datetime.utcnow)
+    timestamp: datetime = field(default_factory=lambda: datetime.now(UTC))
 
 
 @dataclass
@@ -70,8 +70,8 @@ class ConnectionStats:
     total_execution_time: float = 0.0
     health_checks_passed: int = 0
     health_checks_failed: int = 0
-    created_at: datetime = field(default_factory=datetime.utcnow)
-    last_used_at: datetime = field(default_factory=datetime.utcnow)
+    created_at: datetime = field(default_factory=lambda: datetime.now(UTC))
+    last_used_at: datetime = field(default_factory=lambda: datetime.now(UTC))
     health_score: float = 100.0
 
 

kailash/gateway/api.py

@@ -11,7 +11,7 @@ from typing import Any, Dict, List, Optional, Union
 
 from fastapi import APIRouter, BackgroundTasks, Depends, FastAPI, HTTPException
 from fastapi.responses import JSONResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 from ..resources.registry import ResourceRegistry
 from .enhanced_gateway import (
@@ -37,14 +37,15 @@ class ResourceReferenceModel(BaseModel):
         None, description="Reference to credentials secret"
     )
 
-    class Config:
-        schema_extra = {
+    model_config = ConfigDict(
+        json_schema_extra={
             "example": {
                 "type": "database",
                 "config": {"host": "localhost", "port": 5432, "database": "myapp"},
                 "credentials_ref": "db_credentials",
             }
         }
+    )
 
 
 class WorkflowRequestModel(BaseModel):
@@ -59,8 +60,8 @@ class WorkflowRequestModel(BaseModel):
         None, description="Additional context variables"
     )
 
-    class Config:
-        schema_extra = {
+    model_config = ConfigDict(
+        json_schema_extra={
             "example": {
                 "inputs": {"user_id": 123, "action": "process"},
                 "resources": {
@@ -74,6 +75,7 @@ class WorkflowRequestModel(BaseModel):
                 "context": {"environment": "production", "trace_id": "abc123"},
             }
         }
+    )
 
 
 class WorkflowResponseModel(BaseModel):

kailash/gateway/enhanced_gateway.py

@@ -40,7 +40,7 @@ class WorkflowRequest:
     inputs: Dict[str, Any] = field(default_factory=dict)
     resources: Dict[str, Union[str, ResourceReference]] = field(default_factory=dict)
     context: Dict[str, Any] = field(default_factory=dict)
-    timestamp: datetime = field(default_factory=datetime.utcnow)
+    timestamp: datetime = field(default_factory=lambda: datetime.now(UTC))
 
     def to_dict(self) -> Dict[str, Any]:
         """Convert to JSON-serializable dict."""

kailash/middleware/auth/access_control.py

@@ -60,11 +60,11 @@ class MiddlewareAccessControlManager:
         self.enable_audit = enable_audit
 
         # Kailash nodes for operations
-        self.user_mgmt_node = UserManagementNode("middleware_user_mgmt")
-        self.role_mgmt_node = RoleManagementNode("middleware_role_mgmt")
-        self.permission_check_node = PermissionCheckNode("middleware_perm_check")
-        self.audit_node = AuditLogNode("middleware_audit") if enable_audit else None
-        self.security_event_node = SecurityEventNode("middleware_security")
+        self.user_mgmt_node = UserManagementNode()
+        self.role_mgmt_node = RoleManagementNode()
+        self.permission_check_node = PermissionCheckNode()
+        self.audit_node = AuditLogNode() if enable_audit else None
+        self.security_event_node = SecurityEventNode()
 
     async def check_session_access(
         self, user_context: UserContext, session_id: str, action: str = "access"

kailash/middleware/gateway/checkpoint_manager.py

@@ -175,8 +175,32 @@ class CheckpointManager:
         compression_enabled: bool = True,
         compression_threshold_bytes: int = 1024,  # 1KB
         retention_hours: int = 24,
+        # Backward compatibility parameter
+        storage: Optional[DiskStorage] = None,
     ):
-        """Initialize checkpoint manager."""
+        """Initialize checkpoint manager.
+
+        Args:
+            memory_storage: Memory storage backend (optional)
+            disk_storage: Disk storage backend (optional)
+            cloud_storage: Cloud storage backend (optional)
+            compression_enabled: Enable compression for large checkpoints
+            compression_threshold_bytes: Minimum size for compression
+            retention_hours: Hours to retain checkpoints
+            storage: DEPRECATED - Use disk_storage instead
+        """
+        # Handle backward compatibility
+        if storage is not None:
+            import warnings
+
+            warnings.warn(
+                "The 'storage' parameter is deprecated. Use 'disk_storage' instead.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            if disk_storage is None:
+                disk_storage = storage
+
         self.memory_storage = memory_storage or MemoryStorage()
         self.disk_storage = disk_storage or DiskStorage()
         self.cloud_storage = cloud_storage  # Optional cloud backend
@@ -189,11 +213,23 @@ class CheckpointManager:
         self.load_count = 0
         self.compression_ratio_sum = 0.0
 
-        # Start garbage collection task
-        self._gc_task = asyncio.create_task(self._garbage_collection_loop())
+        # Initialize garbage collection task (will be started when first used)
+        self._gc_task = None
+        self._gc_started = False
+
+    def _ensure_gc_started(self):
+        """Ensure garbage collection task is started (lazy initialization)."""
+        if not self._gc_started:
+            try:
+                self._gc_task = asyncio.create_task(self._garbage_collection_loop())
+                self._gc_started = True
+            except RuntimeError:
+                # No event loop running, GC will be started later
+                pass
 
     async def save_checkpoint(self, checkpoint: Checkpoint) -> None:
         """Save checkpoint to storage."""
+        self._ensure_gc_started()
         start_time = time.time()
 
         # Serialize checkpoint
@@ -391,8 +427,9 @@ class CheckpointManager:
 
     async def close(self) -> None:
         """Close checkpoint manager and cleanup."""
-        self._gc_task.cancel()
-        try:
-            await self._gc_task
-        except asyncio.CancelledError:
-            pass
+        if self._gc_task is not None:
+            self._gc_task.cancel()
+            try:
+                await self._gc_task
+            except asyncio.CancelledError:
+                pass

kailash/nodes/admin/permission_check.py

@@ -721,36 +721,67 @@ class PermissionCheckNode(Node):
         }
 
     def _get_user_context(self, user_id: str, tenant_id: str) -> Optional[UserContext]:
-        """Get user context for permission evaluation."""
-        # Query user data from unified admin schema
-        query = """
-        SELECT user_id, email, roles, attributes, status, tenant_id
+        """Get user context for permission evaluation with strict tenant isolation."""
+        # Query user data and assigned roles from unified admin schema
+        user_query = """
+        SELECT user_id, email, attributes, status, tenant_id
         FROM users
         WHERE user_id = $1 AND tenant_id = $2 AND status = 'active'
         """
 
+        # Get assigned roles from user_role_assignments table with strict tenant isolation
+        roles_query = """
+        SELECT role_id
+        FROM user_role_assignments
+        WHERE user_id = $1 AND tenant_id = $2 AND is_active = true
+        """
+
         try:
-            result = self._db_node.run(
-                query=query, parameters=[user_id, tenant_id], result_format="dict"
+            # Get user data - strict tenant check
+            user_result = self._db_node.run(
+                query=user_query, parameters=[user_id, tenant_id], result_format="dict"
             )
 
-            # Handle the corrected result structure
-            user_rows = result.get("data", [])
+            user_rows = user_result.get("data", [])
             if not user_rows:
+                # User not found in this tenant - strict tenant isolation
+                self.logger.debug(f"User {user_id} not found in tenant {tenant_id}")
                 return None
 
             user_data = user_rows[0]
 
+            # Verify tenant isolation - ensure user belongs to the requested tenant
+            if user_data.get("tenant_id") != tenant_id:
+                self.logger.warning(
+                    f"Tenant isolation violation: User {user_id} belongs to {user_data.get('tenant_id')} but permission check requested for {tenant_id}"
+                )
+                return None
+
+            # Get assigned roles - also with strict tenant isolation
+            roles_result = self._db_node.run(
+                query=roles_query, parameters=[user_id, tenant_id], result_format="dict"
+            )
+
+            role_rows = roles_result.get("data", [])
+            assigned_roles = [row["role_id"] for row in role_rows]
+
+            # Log for debugging tenant isolation
+            self.logger.debug(
+                f"User {user_id} in tenant {tenant_id} has roles: {assigned_roles}"
+            )
+
             return UserContext(
                 user_id=user_data["user_id"],
                 tenant_id=user_data["tenant_id"],
                 email=user_data["email"],
-                roles=user_data.get("roles", []),
+                roles=assigned_roles,
                 attributes=user_data.get("attributes", {}),
             )
         except Exception as e:
             # Log the error and return None to indicate user not found
-            self.logger.warning(f"Failed to get user context for {user_id}: {e}")
+            self.logger.warning(
+                f"Failed to get user context for {user_id} in tenant {tenant_id}: {e}"
+            )
             return None
 
     def _check_rbac_permission(
@@ -826,39 +857,57 @@ class PermissionCheckNode(Node):
         return permissions
 
     def _get_role_permissions(self, role_id: str, tenant_id: str) -> Set[str]:
-        """Get permissions for a specific role including inherited permissions."""
-        # Query role and its hierarchy
+        """Get permissions for a specific role including inherited permissions with strict tenant isolation."""
+        # Query role and its hierarchy with strict tenant boundaries
         query = """
         WITH RECURSIVE role_hierarchy AS (
-            SELECT role_id, permissions, parent_roles
+            SELECT role_id, permissions, parent_roles, tenant_id
             FROM roles
             WHERE role_id = $1 AND tenant_id = $2 AND is_active = true
 
             UNION ALL
 
-            SELECT r.role_id, r.permissions, r.parent_roles
+            SELECT r.role_id, r.permissions, r.parent_roles, r.tenant_id
             FROM roles r
             JOIN role_hierarchy rh ON r.role_id = ANY(
                 SELECT jsonb_array_elements_text(rh.parent_roles)
             )
-            WHERE r.tenant_id = $2 AND r.is_active = true
+            WHERE r.tenant_id = $3 AND r.is_active = true
         )
         SELECT DISTINCT unnest(
             CASE
                 WHEN jsonb_typeof(permissions) = 'array'
                 THEN ARRAY(SELECT jsonb_array_elements_text(permissions))
+                WHEN permissions IS NOT NULL AND permissions::text != 'null'
+                THEN ARRAY[permissions::text]
                 ELSE ARRAY[]::text[]
             END
         ) as permission
         FROM role_hierarchy
+        WHERE tenant_id = $4
         """
 
-        result = self._db_node.run(
-            query=query, parameters=[role_id, tenant_id], result_format="dict"
-        )
-        permission_rows = result.get("data", [])
+        try:
+            result = self._db_node.run(
+                query=query,
+                parameters=[role_id, tenant_id, tenant_id, tenant_id],
+                result_format="dict",
+            )
+            permission_rows = result.get("data", [])
 
-        return {row["permission"] for row in permission_rows}
+            permissions = {
+                row["permission"] for row in permission_rows if row["permission"]
+            }
+            self.logger.debug(
+                f"Role {role_id} in tenant {tenant_id} has permissions: {permissions}"
+            )
+
+            return permissions
+        except Exception as e:
+            self.logger.warning(
+                f"Failed to get permissions for role {role_id} in tenant {tenant_id}: {e}"
+            )
+            return set()
 
     def _build_permission_explanation(
         self,
@@ -1189,23 +1238,54 @@ class PermissionCheckNode(Node):
         }
 
     def _get_role_direct_permissions(self, role_id: str, tenant_id: str) -> Set[str]:
-        """Get direct permissions for a role (no inheritance)."""
+        """Get direct permissions for a role (no inheritance) with proper format handling."""
         query = """
         SELECT permissions
         FROM roles
         WHERE role_id = $1 AND tenant_id = $2 AND is_active = true
         """
 
-        result = self._db_node.run(
-            query=query, parameters=[role_id, tenant_id], result_format="dict"
-        )
-        role_rows = result.get("data", [])
-        role_data = role_rows[0] if role_rows else None
+        try:
+            result = self._db_node.run(
+                query=query, parameters=[role_id, tenant_id], result_format="dict"
+            )
+            role_rows = result.get("data", [])
+            role_data = role_rows[0] if role_rows else None
 
-        if not role_data:
-            return set()
+            if not role_data:
+                self.logger.debug(f"Role {role_id} not found in tenant {tenant_id}")
+                return set()
 
-        return set(role_data.get("permissions", []))
+            permissions_data = role_data.get("permissions", [])
+
+            # Handle different permission storage formats
+            if isinstance(permissions_data, list):
+                permissions = set(permissions_data)
+            elif isinstance(permissions_data, str):
+                try:
+                    # Try to parse as JSON array
+                    import json
+
+                    parsed = json.loads(permissions_data)
+                    permissions = (
+                        set(parsed) if isinstance(parsed, list) else {permissions_data}
+                    )
+                except (json.JSONDecodeError, TypeError):
+                    # Treat as single permission string
+                    permissions = {permissions_data} if permissions_data else set()
+            else:
+                permissions = set()
+
+            self.logger.debug(
+                f"Role {role_id} direct permissions in tenant {tenant_id}: {permissions}"
+            )
+            return permissions
+
+        except Exception as e:
+            self.logger.warning(
+                f"Failed to get direct permissions for role {role_id} in tenant {tenant_id}: {e}"
+            )
+            return set()
 
     def _explain_permission(self, inputs: Dict[str, Any]) -> Dict[str, Any]:
         """Provide detailed explanation of permission logic."""
@@ -1625,7 +1705,7 @@ class PermissionCheckNode(Node):
             audit_query = """
             INSERT INTO admin_audit_log (
                 user_id, action, resource_type, resource_id,
-                operation, details, success, tenant_id, created_at
+                operation, context, success, tenant_id, created_at
             ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
             """