langgraph-api 0.0.8__py3-none-any.whl → 0.0.9__py3-none-any.whl

langgraph_storage/ops.py

@@ -11,15 +11,17 @@ from collections.abc import AsyncIterator, Sequence
 from contextlib import asynccontextmanager
 from copy import deepcopy
 from datetime import UTC, datetime, timedelta
-from typing import Any, Literal
+from typing import Any, Literal, cast
 from uuid import UUID, uuid4
 
 import structlog
 from langgraph.pregel.debug import CheckpointPayload
 from langgraph.pregel.types import StateSnapshot
+from langgraph_sdk import Auth
 from starlette.exceptions import HTTPException
 
 from langgraph_api.asyncio import SimpleTaskGroup, ValueEvent, create_task
+from langgraph_api.auth.custom import handle_event
 from langgraph_api.errors import UserInterrupt, UserRollback
 from langgraph_api.graph import get_graph
 from langgraph_api.schema import (
@@ -41,7 +43,7 @@ from langgraph_api.schema import (
     ThreadUpdateResponse,
 )
 from langgraph_api.serde import Fragment
-from langgraph_api.utils import fetchone
+from langgraph_api.utils import fetchone, get_auth_ctx
 from langgraph_storage.checkpoint import Checkpointer
 from langgraph_storage.database import InMemConnectionProto, connect
 from langgraph_storage.queue import Message, get_stream_manager
@@ -57,13 +59,51 @@ def _ensure_uuid(id_: str | uuid.UUID | None) -> uuid.UUID:
     return id_
 
 
+class WrappedHTTPException(Exception):
+    def __init__(self, http_exception: HTTPException):
+        self.http_exception = http_exception
+
+
 # Right now the whole API types as UUID but frequently passes a str
 # We ensure UUIDs for eveerything EXCEPT the checkpoint storage/writes,
 # which we leave as strings. This is because I'm too lazy to subclass fully
 # and we use non-UUID examples in the OSS version
 
 
-class Assistants:
+class Authenticated:
+    resource: Literal["threads", "crons", "assistants"]
+
+    @classmethod
+    def _context(
+        cls,
+        ctx: Auth.types.BaseAuthContext | None,
+        action: Literal["create", "read", "update", "delete", "create_run"],
+    ) -> Auth.types.AuthContext | None:
+        if not ctx:
+            return
+        return Auth.types.AuthContext(
+            user=ctx.user,
+            scopes=ctx.scopes,
+            resource=cls.resource,
+            action=action,
+        )
+
+    @classmethod
+    async def handle_event(
+        cls,
+        ctx: Auth.types.BaseAuthContext | None,
+        action: Literal["create", "read", "update", "delete", "search"],
+        value: Any,
+    ) -> Auth.types.FilterType | None:
+        ctx = ctx or get_auth_ctx()
+        if not ctx:
+            return
+        return await handle_event(cls._context(ctx, action), value)
+
+
+class Assistants(Authenticated):
+    resource = "assistants"
+
     @staticmethod
     async def search(
         conn: InMemConnectionProto,
@@ -72,7 +112,17 @@ class Assistants:
         metadata: MetadataInput,
         limit: int,
         offset: int,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
+        metadata = metadata if metadata is not None else {}
+        filters = await Assistants.handle_event(
+            ctx,
+            "search",
+            Auth.types.AssistantsSearch(
+                graph_id=graph_id, metadata=metadata, limit=limit, offset=offset
+            ),
+        )
+
         async def filter_and_yield() -> AsyncIterator[Assistant]:
             assistants = conn.store["assistants"]
             filtered_assistants = [
@@ -82,6 +132,7 @@ class Assistants:
                 and (
                     not metadata or is_jsonb_contained(assistant["metadata"], metadata)
                 )
+                and (not filters or _check_filter_match(assistant["metadata"], filters))
             ]
             filtered_assistants.sort(key=lambda x: x["created_at"], reverse=True)
             for assistant in filtered_assistants[offset : offset + limit]:
@@ -91,14 +142,23 @@ class Assistants:
 
     @staticmethod
     async def get(
-        conn: InMemConnectionProto, assistant_id: UUID
+        conn: InMemConnectionProto,
+        assistant_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
         """Get an assistant by ID."""
         assistant_id = _ensure_uuid(assistant_id)
+        filters = await Assistants.handle_event(
+            ctx,
+            "read",
+            Auth.types.AssistantsRead(assistant_id=assistant_id),
+        )
 
         async def _yield_result():
             for assistant in conn.store["assistants"]:
-                if assistant["assistant_id"] == assistant_id:
+                if assistant["assistant_id"] == assistant_id and (
+                    not filters or _check_filter_match(assistant["metadata"], filters)
+                ):
                     yield assistant
 
         return _yield_result()
@@ -113,14 +173,33 @@ class Assistants:
         metadata: MetadataInput,
         if_exists: OnConflictBehavior,
         name: str,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
         """Insert an assistant."""
         assistant_id = _ensure_uuid(assistant_id)
+        metadata = metadata if metadata is not None else {}
+        filters = await Assistants.handle_event(
+            ctx,
+            "create",
+            Auth.types.AssistantsCreate(
+                assistant_id=assistant_id,
+                graph_id=graph_id,
+                config=config,
+                metadata=metadata,
+                name=name,
+            ),
+        )
         existing_assistant = next(
             (a for a in conn.store["assistants"] if a["assistant_id"] == assistant_id),
             None,
         )
         if existing_assistant:
+            if filters and not _check_filter_match(
+                existing_assistant["metadata"], filters
+            ):
+                raise HTTPException(
+                    status_code=409, detail=f"Assistant {assistant_id} already exists"
+                )
             if if_exists == "raise":
                 raise HTTPException(
                     status_code=409, detail=f"Assistant {assistant_id} already exists"
@@ -168,6 +247,7 @@ class Assistants:
         graph_id: str | None = None,
         metadata: MetadataInput | None = None,
         name: str | None = None,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
         """Update an assistant.
 
@@ -182,6 +262,18 @@ class Assistants:
             return the updated assistant model.
         """
         assistant_id = _ensure_uuid(assistant_id)
+        metadata = metadata if metadata is not None else {}
+        filters = await Assistants.handle_event(
+            ctx,
+            "update",
+            Auth.types.AssistantsUpdate(
+                assistant_id=assistant_id,
+                graph_id=graph_id,
+                config=config,
+                metadata=metadata,
+                name=name,
+            ),
+        )
         assistant = next(
             (a for a in conn.store["assistants"] if a["assistant_id"] == assistant_id),
             None,
@@ -190,6 +282,10 @@ class Assistants:
             raise HTTPException(
                 status_code=404, detail=f"Assistant {assistant_id} not found"
             )
+        elif filters and not _check_filter_match(assistant["metadata"], filters):
+            raise HTTPException(
+                status_code=404, detail=f"Assistant {assistant_id} not found"
+            )
 
         now = datetime.now(UTC)
         new_version = (
@@ -204,6 +300,11 @@ class Assistants:
         )
 
         # Update assistant_versions table
+        if metadata:
+            metadata = {
+                **assistant["metadata"],
+                **metadata,
+            }
         new_version_entry = {
             "assistant_id": assistant_id,
             "version": new_version,
@@ -233,10 +334,33 @@ class Assistants:
 
     @staticmethod
     async def delete(
-        conn: InMemConnectionProto, assistant_id: UUID
+        conn: InMemConnectionProto,
+        assistant_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[UUID]:
         """Delete an assistant by ID."""
         assistant_id = _ensure_uuid(assistant_id)
+        filters = await Assistants.handle_event(
+            ctx,
+            "delete",
+            Auth.types.AssistantsDelete(
+                assistant_id=assistant_id,
+            ),
+        )
+        assistant = next(
+            (a for a in conn.store["assistants"] if a["assistant_id"] == assistant_id),
+            None,
+        )
+
+        if not assistant:
+            raise HTTPException(
+                status_code=404, detail=f"Assistant with ID {assistant_id} not found"
+            )
+        elif filters and not _check_filter_match(assistant["metadata"], filters):
+            raise HTTPException(
+                status_code=404, detail=f"Assistant with ID {assistant_id} not found"
+            )
+
         conn.store["assistants"] = [
             a for a in conn.store["assistants"] if a["assistant_id"] != assistant_id
         ]
@@ -249,9 +373,10 @@ class Assistants:
         retained = []
         for run in conn.store["runs"]:
             if run["assistant_id"] == assistant_id:
-                res = await Runs.delete(conn, run["run_id"], thread_id=run["thread_id"])
+                res = await Runs.delete(
+                    conn, run["run_id"], thread_id=run["thread_id"], ctx=ctx
+                )
                 await anext(res)
-
             else:
                 retained.append(run)
 
@@ -262,10 +387,21 @@ class Assistants:
 
     @staticmethod
     async def set_latest(
-        conn: InMemConnectionProto, assistant_id: UUID, version: int
+        conn: InMemConnectionProto,
+        assistant_id: UUID,
+        version: int,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
         """Change the version of an assistant."""
         assistant_id = _ensure_uuid(assistant_id)
+        filters = await Assistants.handle_event(
+            ctx,
+            "update",
+            Auth.types.AssistantsUpdate(
+                assistant_id=assistant_id,
+                version=version,
+            ),
+        )
         assistant = next(
             (a for a in conn.store["assistants"] if a["assistant_id"] == assistant_id),
             None,
@@ -274,6 +410,10 @@ class Assistants:
             raise HTTPException(
                 status_code=404, detail=f"Assistant {assistant_id} not found"
             )
+        elif filters and not _check_filter_match(assistant["metadata"], filters):
+            raise HTTPException(
+                status_code=404, detail=f"Assistant {assistant_id} not found"
+            )
 
         version_data = next(
             (
@@ -310,14 +450,21 @@ class Assistants:
         metadata: MetadataInput,
         limit: int,
         offset: int,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Assistant]:
         """Get all versions of an assistant."""
         assistant_id = _ensure_uuid(assistant_id)
+        filters = await Assistants.handle_event(
+            ctx,
+            "read",
+            Auth.types.AssistantsRead(assistant_id=assistant_id),
+        )
         versions = [
             v
             for v in conn.store["assistant_versions"]
             if v["assistant_id"] == assistant_id
             and (not metadata or is_jsonb_contained(v["metadata"], metadata))
+            and (not filters or _check_filter_match(v["metadata"], filters))
         ]
         versions.sort(key=lambda x: x["version"], reverse=True)
 
@@ -379,7 +526,9 @@ def _replace_thread_id(data, new_thread_id, thread_id):
     return d
 
 
-class Threads:
+class Threads(Authenticated):
+    resource = "threads"
+
     @staticmethod
     async def search(
         conn: InMemConnectionProto,
@@ -389,29 +538,43 @@ class Threads:
         status: ThreadStatus | None,
         limit: int,
         offset: int,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Thread]:
         threads = conn.store["threads"]
         filtered_threads: list[Thread] = []
+        metadata = metadata if metadata is not None else {}
+        values = values if values is not None else {}
+        filters = await Threads.handle_event(
+            ctx,
+            "search",
+            Auth.types.ThreadsSearch(
+                metadata=metadata,
+                values=values,
+                status=status,
+                limit=limit,
+                offset=offset,
+            ),
+        )
 
         # Apply filters
         for thread in threads:
-            matches = True
+            if filters and not _check_filter_match(thread["metadata"], filters):
+                continue
 
             if metadata and not is_jsonb_contained(thread["metadata"], metadata):
-                matches = False
+                continue
 
             if (
                 values
                 and "values" in thread
                 and not is_jsonb_contained(thread["values"], values)
             ):
-                matches = False
+                continue
 
             if status and thread.get("status") != status:
-                matches = False
+                continue
 
-            if matches:
-                filtered_threads.append(thread)
+            filtered_threads.append(thread)
 
         # Sort by created_at in descending order
         sorted_threads = sorted(
@@ -428,8 +591,11 @@ class Threads:
         return thread_iterator()
 
     @staticmethod
-    async def get(conn: InMemConnectionProto, thread_id: UUID) -> AsyncIterator[Thread]:
-        """Get a thread by ID."""
+    async def _get_with_filters(
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        filters: Auth.types.FilterType | None,
+    ) -> Thread | None:
         thread_id = _ensure_uuid(thread_id)
         matching_thread = next(
             (
@@ -439,6 +605,37 @@ class Threads:
             ),
             None,
         )
+        if not matching_thread or (
+            filters and not _check_filter_match(matching_thread["metadata"], filters)
+        ):
+            return
+
+        return matching_thread
+
+    @staticmethod
+    async def _get(
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
+    ) -> Thread | None:
+        """Get a thread by ID."""
+        thread_id = _ensure_uuid(thread_id)
+        filters = await Threads.handle_event(
+            ctx,
+            "read",
+            Auth.types.ThreadsRead(thread_id=thread_id),
+        )
+        return await Threads._get_with_filters(conn, thread_id, filters)
+
+    @staticmethod
+    async def get(
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
+    ) -> AsyncIterator[Thread]:
+        """Get a thread by ID."""
+        matching_thread = await Threads._get(conn, thread_id, ctx)
+
         if not matching_thread:
             raise HTTPException(
                 status_code=404, detail=f"Thread with ID {thread_id} not found"
@@ -457,6 +654,7 @@ class Threads:
         *,
         metadata: MetadataInput,
         if_exists: OnConflictBehavior,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Thread]:
         """Insert or update a thread."""
         thread_id = _ensure_uuid(thread_id)
@@ -467,8 +665,22 @@ class Threads:
         existing_thread = next(
             (t for t in conn.store["threads"] if t["thread_id"] == thread_id), None
         )
+        filters = await Threads.handle_event(
+            ctx,
+            "create",
+            Auth.types.ThreadsCreate(
+                thread_id=thread_id, metadata=metadata, if_exists=if_exists
+            ),
+        )
 
         if existing_thread:
+            if filters and not _check_filter_match(
+                existing_thread["metadata"], filters
+            ):
+                # Should we use a different status code here?
+                raise HTTPException(
+                    status_code=409, detail=f"Thread with ID {thread_id} already exists"
+                )
             if if_exists == "raise":
                 raise HTTPException(
                     status_code=409, detail=f"Thread with ID {thread_id} already exists"
@@ -479,7 +691,6 @@ class Threads:
                     yield existing_thread
 
                 return _yield_existing()
-
         # Create new thread
         new_thread: Thread = {
             "thread_id": thread_id,
@@ -501,7 +712,11 @@ class Threads:
 
     @staticmethod
     async def patch(
-        conn: InMemConnectionProto, thread_id: UUID, *, metadata: MetadataValue
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        *,
+        metadata: MetadataValue,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Thread]:
         """Update a thread."""
         thread_list = conn.store["threads"]
@@ -514,15 +729,23 @@ class Threads:
                 break
 
         if thread_idx is not None:
-            thread = copy.deepcopy(thread_list[thread_idx])
-            thread["metadata"] = {**thread["metadata"], **metadata}
-            thread["updated_at"] = datetime.now(UTC)
-            thread_list[thread_idx] = thread
+            filters = await Threads.handle_event(
+                ctx,
+                "update",
+                Auth.types.ThreadsUpdate(thread_id=thread_id, metadata=metadata),
+            )
+            if not filters or _check_filter_match(
+                thread_list[thread_idx]["metadata"], filters
+            ):
+                thread = copy.deepcopy(thread_list[thread_idx])
+                thread["metadata"] = {**thread["metadata"], **metadata}
+                thread["updated_at"] = datetime.now(UTC)
+                thread_list[thread_idx] = thread
 
-            async def thread_iterator() -> AsyncIterator[Thread]:
-                yield thread
+                async def thread_iterator() -> AsyncIterator[Thread]:
+                    yield thread
 
-            return thread_iterator()
+                return thread_iterator()
 
         async def empty_iterator() -> AsyncIterator[Thread]:
             if False:  # This ensures the iterator is empty
@@ -536,6 +759,7 @@ class Threads:
         thread_id: UUID,
         checkpoint: CheckpointPayload | None,
         exception: BaseException | None,
+        # This does not accept the auth context since it's only used internally
     ) -> None:
         """Set the status of a thread."""
         thread_id = _ensure_uuid(thread_id)
@@ -597,19 +821,34 @@ class Threads:
 
     @staticmethod
     async def delete(
-        conn: InMemConnectionProto, thread_id: UUID
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[UUID]:
         """Delete a thread by ID and cascade delete all associated runs."""
         thread_list = conn.store["threads"]
         thread_idx = None
         thread_id = _ensure_uuid(thread_id)
-        conn.locks.pop(thread_id, None)
 
         # Find the thread to delete
         for idx, thread in enumerate(thread_list):
             if thread["thread_id"] == thread_id:
                 thread_idx = idx
                 break
+        filters = await Threads.handle_event(
+            ctx,
+            "delete",
+            Auth.types.ThreadsDelete(thread_id=thread_id),
+        )
+        if (filters and not _check_filter_match(thread["metadata"], filters)) or (
+            thread_idx is None
+        ):
+            raise HTTPException(
+                status_code=404, detail=f"Thread with ID {thread_id} not found"
+            )
+
+        # Delete the thread
+        conn.locks.pop(thread_id, None)
         # Cascade delete all runs associated with this thread
         conn.store["runs"] = [
             run for run in conn.store["runs"] if run["thread_id"] != thread_id
@@ -635,12 +874,20 @@ class Threads:
 
     @staticmethod
     async def copy(
-        conn: InMemConnectionProto, thread_id: UUID
+        conn: InMemConnectionProto,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Thread]:
         """Create a copy of an existing thread."""
         thread_id = _ensure_uuid(thread_id)
         new_thread_id = uuid4()
-
+        filters = await Threads.handle_event(
+            ctx,
+            "read",
+            Auth.types.ThreadsRead(
+                thread_id=new_thread_id,
+            ),
+        )
         async with conn.pipeline():
             # Find the original thread in our store
             original_thread = next(
@@ -648,7 +895,11 @@ class Threads:
             )
 
             if not original_thread:
-                return
+                return _empty_generator()
+            if filters and not _check_filter_match(
+                original_thread["metadata"], filters
+            ):
+                return _empty_generator()
 
             # Create new thread with copied metadata
             new_thread: Thread = {
@@ -690,15 +941,22 @@ class Threads:
 
             return row_generator()
 
-    class State:
+    class State(Authenticated):
+        # We will treat this like a runs resource for now.
+        resource = "threads"
+
         @staticmethod
         async def get(
-            conn: InMemConnectionProto, config: Config, subgraphs: bool = False
+            conn: InMemConnectionProto,
+            config: Config,
+            subgraphs: bool = False,
+            ctx: Auth.types.BaseAuthContext | None = None,
         ) -> StateSnapshot:
             """Get state for a thread."""
             checkpointer = Checkpointer(conn)
             thread_id = _ensure_uuid(config["configurable"]["thread_id"])
-            thread_iter = await Threads.get(conn, thread_id)
+            # Auth will be applied here so no need to use filters downstream
+            thread_iter = await Threads.get(conn, thread_id, ctx=ctx)
             thread = await anext(thread_iter)
             checkpoint = await checkpointer.aget(config)
 
@@ -747,12 +1005,19 @@ class Threads:
             config: Config,
             values: Sequence[dict] | dict[str, Any] | None,
             as_node: str | None = None,
+            ctx: Auth.types.BaseAuthContext | None = None,
         ) -> ThreadUpdateResponse:
             """Add state to a thread."""
+            thread_id = _ensure_uuid(config["configurable"]["thread_id"])
+            filters = await Threads.handle_event(
+                ctx,
+                "update",
+                Auth.types.ThreadsUpdate(thread_id=thread_id),
+            )
 
             checkpointer = Checkpointer(conn)
-            thread_id = _ensure_uuid(config["configurable"]["thread_id"])
-            thread_iter = await Threads.get(conn, thread_id)
+
+            thread_iter = await Threads.get(conn, thread_id, ctx=ctx)
             thread = await fetchone(
                 thread_iter, not_found_detail=f"Thread {thread_id} not found."
             )
@@ -760,6 +1025,8 @@ class Threads:
 
             if not thread:
                 raise HTTPException(status_code=404, detail="Thread not found")
+            if not _check_filter_match(thread["metadata"], filters):
+                raise HTTPException(status_code=403, detail="Forbidden")
 
             metadata = thread["metadata"]
             thread_config = thread["config"]
@@ -781,7 +1048,7 @@ class Threads:
                 )
 
                 # Get current state
-                state = await Threads.State.get(conn, config, subgraphs=False)
+                state = await Threads.State.get(conn, config, subgraphs=False, ctx=ctx)
                 # Update thread values
                 for thread in conn.store["threads"]:
                     if thread["thread_id"] == thread_id:
@@ -805,22 +1072,26 @@ class Threads:
             limit: int = 10,
             before: str | Checkpoint | None = None,
             metadata: MetadataInput = None,
+            ctx: Auth.types.BaseAuthContext | None = None,
         ) -> list[StateSnapshot]:
             """Get the history of a thread."""
 
             thread_id = _ensure_uuid(config["configurable"]["thread_id"])
             thread = None
-
-            for t in conn.store["threads"]:
-                if t["thread_id"] == thread_id:
-                    thread = t
-                    break
-
-            if not thread:
-                return []
+            filters = await Threads.handle_event(
+                ctx,
+                "read",
+                Auth.types.ThreadsRead(thread_id=thread_id),
+            )
+            thread = await fetchone(
+                await Threads.get(conn, config["configurable"]["thread_id"], ctx=ctx)
+            )
 
             # Parse thread metadata and config
             thread_metadata = thread["metadata"]
+            if not _check_filter_match(thread_metadata, filters):
+                return []
+
             thread_config = thread["config"]
             # If graph_id exists, get state history
             if graph_id := thread_metadata.get("graph_id"):
@@ -847,7 +1118,9 @@ class Threads:
             return []
 
 
-class Runs:
+class Runs(Authenticated):
+    resource = "threads"
+
     @staticmethod
     async def stats(conn: InMemConnectionProto) -> QueueStats:
         """Get stats about the queue."""
@@ -1001,6 +1274,7 @@ class Runs:
         multitask_strategy: MultitaskStrategy = "reject",
         if_not_exists: IfNotExists = "reject",
         after_seconds: int = 0,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Run]:
         """Create a run."""
         assistant_id = _ensure_uuid(assistant_id)
@@ -1009,22 +1283,38 @@ class Runs:
             None,
         )
 
-        async def empty_generator():
-            if False:
-                yield
-
         if not assistant:
-            return empty_generator()
+            return _empty_generator()
 
         thread_id = _ensure_uuid(thread_id) if thread_id else None
         run_id = _ensure_uuid(run_id) if run_id else None
-        metadata = metadata or {}
+        metadata = metadata if metadata is not None else {}
         config = kwargs.get("config", {})
 
         # Handle thread creation/update
         existing_thread = next(
             (t for t in conn.store["threads"] if t["thread_id"] == thread_id), None
         )
+        filters = await Runs.handle_event(
+            ctx,
+            "create",
+            Auth.types.RunsCreate(
+                thread_id=thread_id,
+                assistant_id=assistant_id,
+                run_id=run_id,
+                status=status,
+                metadata=metadata,
+                prevent_insert_if_inflight=prevent_insert_if_inflight,
+                multitask_strategy=multitask_strategy,
+                if_not_exists=if_not_exists,
+                after_seconds=after_seconds,
+                kwargs=kwargs,
+            ),
+        )
+        if existing_thread and filters:
+            # Reject if the user doesn't own the thread
+            if not _check_filter_match(existing_thread["metadata"], filters):
+                return _empty_generator()
 
         if not existing_thread and (thread_id is None or if_not_exists == "create"):
             # Create new thread
@@ -1069,7 +1359,7 @@ class Runs:
                 )
                 existing_thread["updated_at"] = datetime.now(UTC)
         else:
-            return empty_generator()
+            return _empty_generator()
 
         # Check for inflight runs if needed
         inflight_runs = [
@@ -1089,9 +1379,11 @@ class Runs:
         # Create new run
         configurable = Runs._merge_jsonb(
             Runs._get_configurable(assistant["config"]),
-            Runs._get_configurable(existing_thread["config"])
-            if existing_thread
-            else {},
+            (
+                Runs._get_configurable(existing_thread["config"])
+                if existing_thread
+                else {}
+            ),
             Runs._get_configurable(config),
             {
                 "run_id": str(run_id),
@@ -1149,11 +1441,20 @@ class Runs:
 
     @staticmethod
     async def get(
-        conn: InMemConnectionProto, run_id: UUID, *, thread_id: UUID
+        conn: InMemConnectionProto,
+        run_id: UUID,
+        *,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Run]:
         """Get a run by ID."""
 
         run_id, thread_id = _ensure_uuid(run_id), _ensure_uuid(thread_id)
+        filters = await Runs.handle_event(
+            ctx,
+            "read",
+            Auth.types.ThreadsRead(thread_id=thread_id),
+        )
 
         async def _yield_result():
             matching_run = None
@@ -1162,16 +1463,36 @@ class Runs:
                     matching_run = run
                     break
             if matching_run:
+                if filters:
+                    thread = await Threads._get_with_filters(
+                        conn, matching_run["thread_id"], filters
+                    )
+                    if not thread:
+                        return
                 yield matching_run
 
         return _yield_result()
 
     @staticmethod
     async def delete(
-        conn: InMemConnectionProto, run_id: UUID, *, thread_id: UUID
+        conn: InMemConnectionProto,
+        run_id: UUID,
+        *,
+        thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[UUID]:
         """Delete a run by ID."""
         run_id, thread_id = _ensure_uuid(run_id), _ensure_uuid(thread_id)
+        filters = await Runs.handle_event(
+            ctx,
+            "delete",
+            Auth.types.ThreadsDelete(run_id=run_id, thread_id=thread_id),
+        )
+
+        if filters:
+            thread = await Threads._get_with_filters(conn, thread_id, filters)
+            if not thread:
+                return _empty_generator()
         _delete_checkpoints_for_thread(thread_id, conn, run_id=run_id)
         found = False
         for i, run in enumerate(conn.store["runs"]):
@@ -1192,16 +1513,22 @@ class Runs:
         run_id: UUID,
         *,
         thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> Fragment:
         """Wait for a run to complete. If already done, return immediately.
 
         Returns:
             the final state of the run.
         """
+        async with connect() as conn:
+            # Validate ownership
+            thread_iter = await Threads.get(conn, thread_id, ctx=ctx)
+            await fetchone(thread_iter)
         last_chunk: bytes | None = None
         # wait for the run to complete
+        # Rely on this join's auth
         async for mode, chunk in Runs.Stream.join(
-            run_id, thread_id=thread_id, stream_mode="values"
+            run_id, thread_id=thread_id, stream_mode="values", ctx=ctx
         ):
             if mode == b"values":
                 last_chunk = chunk
@@ -1212,7 +1539,7 @@ class Runs:
         else:
             # otherwise, the run had already finished, so fetch the state from thread
             async with connect() as conn:
-                thread_iter = await Threads.get(conn, thread_id)
+                thread_iter = await Threads.get(conn, thread_id, ctx=ctx)
                 thread = await fetchone(thread_iter)
                 return thread["values"]
 
@@ -1223,8 +1550,10 @@ class Runs:
         *,
         action: Literal["interrupt", "rollback"] = "interrupt",
         thread_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> None:
         """Cancel a run."""
+        # Authwise, this invokes the runs.update handler
         # Cancellation tries to take two actions, to cover runs in different states:
         # - For any run, send a cancellation message through the stream manager
         # - For queued runs not yet picked up by a worker, update their status if interrupt,
@@ -1233,6 +1562,15 @@ class Runs:
         # - For runs in any other state, we raise a 404
         run_ids = [_ensure_uuid(run_id) for run_id in run_ids]
         thread_id = _ensure_uuid(thread_id)
+        filters = await Runs.handle_event(
+            ctx,
+            "update",
+            Auth.types.ThreadsUpdate(
+                thread_id=thread_id,
+                action=action,
+                metadata={"run_ids": run_ids},
+            ),
+        )
 
         stream_manager = get_stream_manager()
         found_runs = []
@@ -1247,6 +1585,10 @@ class Runs:
                 None,
             )
             if run:
+                if filters:
+                    thread = await Threads._get_with_filters(conn, thread_id, filters)
+                    if not thread:
+                        continue
                 found_runs.append(run)
                 # Send cancellation message through stream manager
                 control_message = Message(
@@ -1296,16 +1638,26 @@ class Runs:
         offset: int = 0,
         metadata: MetadataInput,
         status: RunStatus | None = None,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Run]:
         """List all runs by thread."""
         runs = conn.store["runs"]
-        metadata = metadata or {}
+        metadata = metadata if metadata is not None else {}
         thread_id = _ensure_uuid(thread_id)
+        filters = await Runs.handle_event(
+            ctx,
+            "search",
+            Auth.types.ThreadsSearch(thread_id=thread_id, metadata=metadata),
+        )
         filtered_runs = [
             run
             for run in runs
             if run["thread_id"] == thread_id
             and is_jsonb_contained(run["metadata"], metadata)
+            and (
+                not filters
+                or (await Threads._get_with_filters(conn, thread_id, filters))
+            )
             and (status is None or run["status"] == status)
         ]
         sorted_runs = sorted(filtered_runs, key=lambda x: x["created_at"], reverse=True)
@@ -1358,6 +1710,7 @@ class Runs:
             ignore_404: bool = False,
             cancel_on_disconnect: bool = False,
             stream_mode: "StreamMode | asyncio.Queue | None" = None,
+            ctx: Auth.types.BaseAuthContext | None = None,
         ) -> AsyncIterator[tuple[bytes, bytes]]:
             """Stream the run output."""
             log = logger.isEnabledFor(logging.DEBUG)
@@ -1369,6 +1722,21 @@ class Runs:
 
             try:
                 async with connect() as conn:
+                    filters = await Runs.handle_event(
+                        ctx,
+                        "read",
+                        Auth.types.ThreadsRead(thread_id=thread_id),
+                    )
+                    if filters:
+                        thread = await Threads._get_with_filters(
+                            cast(InMemConnectionProto, conn), thread_id, filters
+                        )
+                        if not thread:
+                            raise WrappedHTTPException(
+                                HTTPException(
+                                    status_code=404, detail="Thread not found"
+                                )
+                            )
                     channel_prefix = f"run:{run_id}:stream:"
                     len_prefix = len(channel_prefix.encode())
 
@@ -1393,7 +1761,9 @@ class Runs:
                                     )
                         except TimeoutError:
                             # Check if the run is still pending
-                            run_iter = await Runs.get(conn, run_id, thread_id=thread_id)
+                            run_iter = await Runs.get(
+                                conn, run_id, thread_id=thread_id, ctx=ctx
+                            )
                             run = await anext(run_iter, None)
 
                             if ignore_404 and run is None:
@@ -1408,6 +1778,8 @@ class Runs:
                                 break
                             elif run["status"] != "pending":
                                 break
+            except WrappedHTTPException as e:
+                raise e.http_exception from None
             except:
                 if cancel_on_disconnect:
                     create_task(cancel_run(thread_id, run_id))
@@ -1475,22 +1847,32 @@ class Crons:
         schedule: str,
         cron_id: UUID | None = None,
         thread_id: UUID | None = None,
-        user_id: str | None = None,
         end_time: datetime | None = None,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Cron]:
         raise NotImplementedError
 
     @staticmethod
-    async def delete(conn: InMemConnectionProto, cron_id: UUID) -> AsyncIterator[UUID]:
+    async def delete(
+        conn: InMemConnectionProto,
+        cron_id: UUID,
+        ctx: Auth.types.BaseAuthContext | None = None,
+    ) -> AsyncIterator[UUID]:
         raise NotImplementedError
 
     @staticmethod
-    async def next(conn: InMemConnectionProto) -> AsyncIterator[Cron]:
+    async def next(
+        conn: InMemConnectionProto,
+        ctx: Auth.types.BaseAuthContext | None = None,
+    ) -> AsyncIterator[Cron]:
         raise NotImplementedError
 
     @staticmethod
     async def set_next_run_date(
-        conn: InMemConnectionProto, cron_id: UUID, next_run_date: datetime
+        conn: InMemConnectionProto,
+        cron_id: UUID,
+        next_run_date: datetime,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> None:
         raise NotImplementedError
 
@@ -1502,13 +1884,16 @@ class Crons:
         thread_id: UUID | None,
         limit: int,
         offset: int,
+        ctx: Auth.types.BaseAuthContext | None = None,
     ) -> AsyncIterator[Cron]:
         raise NotImplementedError
 
 
-async def cancel_run(thread_id: UUID, run_id: UUID) -> None:
+async def cancel_run(
+    thread_id: UUID, run_id: UUID, ctx: Auth.types.BaseAuthContext | None = None
+) -> None:
     async with connect() as conn:
-        await Runs.cancel(conn, [run_id], thread_id=thread_id)
+        await Runs.cancel(conn, [run_id], thread_id=thread_id, ctx=ctx)
 
 
 def _delete_checkpoints_for_thread(
@@ -1538,6 +1923,47 @@ def _delete_checkpoints_for_thread(
         )
 
 
+def _check_filter_match(metadata: dict, filters: Auth.types.FilterType | None) -> bool:
+    """Check if metadata matches the filter conditions.
+
+    Args:
+        metadata: The metadata to check
+        filters: The filter conditions to apply
+
+    Returns:
+        True if the metadata matches all filter conditions, False otherwise
+    """
+    if not filters:
+        return True
+
+    for key, value in filters.items():
+        if isinstance(value, dict):
+            op = next(iter(value))
+            filter_value = value[op]
+
+            if op == "$eq":
+                if key not in metadata or metadata[key] != filter_value:
+                    return False
+            elif op == "$contains":
+                if (
+                    key not in metadata
+                    or not isinstance(metadata[key], list)
+                    or filter_value not in metadata[key]
+                ):
+                    return False
+        else:
+            # Direct equality
+            if key not in metadata or metadata[key] != value:
+                return False
+
+    return True
+
+
+async def _empty_generator():
+    if False:
+        yield
+
+
 __all__ = [
     "Assistants",
     "Crons",