langgraph-api 0.14.0.dev5__tar.gz → 0.14.0.dev6__tar.gz

{langgraph_api-0.14.0.dev5 → langgraph_api-0.14.0.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.14.0.dev5
+Version: 0.14.0.dev6
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

langgraph_api-0.14.0.dev6/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.14.0.dev6"

langgraph_api-0.14.0.dev6/langgraph_api/beacon_data_plane_jwt_auth.py

@@ -0,0 +1,71 @@
+"""Data-plane JWT authentication for Beacon OTLP exports."""
+
+import time
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+import jwt
+from requests.sessions import Session
+
+DATA_PLANE_AUTH_HEADER = "X-Data-Plane-Auth"
+BEACON_OTEL_COLLECTOR_PURPOSE = "beacon-otel-collector"
+
+_BEACON_OTEL_JWT_TTL_SECONDS = 60 * 60
+_BEACON_OTEL_JWT_REFRESH_BEFORE_SECONDS = 60
+
+
+def sign_data_plane_jwt(data_plane_id: str, organization_id: str, secret: str) -> str:
+    now = datetime.now(UTC)
+    return jwt.encode(
+        {
+            "data_plane_id": data_plane_id,
+            "organization_id": organization_id,
+            "purpose": BEACON_OTEL_COLLECTOR_PURPOSE,
+            "iat": now,
+            "exp": now + timedelta(seconds=_BEACON_OTEL_JWT_TTL_SECONDS),
+        },
+        secret,
+        algorithm="HS256",
+    )
+
+
+class _BeaconOtelJWTCache:
+    def __init__(self, data_plane_id: str, organization_id: str, secret: str) -> None:
+        self._data_plane_id = data_plane_id
+        self._organization_id = organization_id
+        self._secret = secret
+        self._cached_token: tuple[str, float] | None = None
+
+    def get(self) -> str:
+        cached_token = self._cached_token
+        if cached_token is not None:
+            token, refresh_at = cached_token
+            if time.monotonic() < refresh_at:
+                return token
+
+        token = sign_data_plane_jwt(
+            self._data_plane_id, self._organization_id, self._secret
+        )
+        refresh_at = time.monotonic() + (
+            _BEACON_OTEL_JWT_TTL_SECONDS - _BEACON_OTEL_JWT_REFRESH_BEFORE_SECONDS
+        )
+        self._cached_token = (token, refresh_at)
+        return token
+
+
+class _DataPlaneAuthSession(Session):
+    def __init__(self, cache: _BeaconOtelJWTCache) -> None:
+        super().__init__()
+        self._cache = cache
+
+    def request(self, method: str, url: str, **kwargs: Any):
+        headers = dict(kwargs.pop("headers", None) or {})
+        headers[DATA_PLANE_AUTH_HEADER] = self._cache.get()
+        return super().request(method, url, headers=headers, **kwargs)
+
+
+def beacon_otel_session(
+    data_plane_id: str, organization_id: str, secret: str
+) -> Session:
+    cache = _BeaconOtelJWTCache(data_plane_id, organization_id, secret)
+    return _DataPlaneAuthSession(cache)

{langgraph_api-0.14.0.dev5 → langgraph_api-0.14.0.dev6}/langgraph_api/config/__init__.py

@@ -614,6 +614,14 @@ DATADOG_METRICS_ENABLED = bool(LSD_DD_API_KEY)
 EXPOSE_INTERNAL_METRICS_PROMETHEUS = env(
     "EXPOSE_INTERNAL_METRICS_PROMETHEUS", cast=bool, default=False
 )
+
+# These are only set for internal agents (polly/insights/engine/etc..) deployed in byoc so we can fetch logs (see api/langgraph_api/self_hosted_logs.py)
+DATA_PLANE_ID: str | None = env("DATA_PLANE_ID", cast=str, default=None)
+DATA_PLANE_ORG_ID: str | None = env("DATA_PLANE_ORG_ID", cast=str, default=None)
+DATA_PLANE_JWT_SECRET: str | None = env("DATA_PLANE_JWT_SECRET", cast=str, default=None)
+BYOC_HOST = env("BYOC_HOST", cast=str, default="byoc")
+BYOC_ENV = env("BYOC_ENV", cast=str, default="byoc")
+
 LANGGRAPH_LOGS_ENDPOINT = env("LANGGRAPH_LOGS_ENDPOINT", cast=str, default=None)
 LANGGRAPH_LOGS_ENABLED = env("LANGGRAPH_LOGS_ENABLED", cast=bool, default=False)
 
@@ -660,6 +668,8 @@ __all__ = [
     "BG_JOB_MAX_RETRIES",
     "BG_JOB_SHUTDOWN_GRACE_PERIOD_SECS",
     "BG_JOB_TIMEOUT_SECS",
+    "BYOC_ENV",
+    "BYOC_HOST",
     "CHECKPOINTER_CONFIG",
     "CHECKPOINTER_POSTGRES_POOL_MIN_SIZE",
     "CHECKPOINTER_POSTGRES_POOL_TIMEOUT_SECONDS",
@@ -670,6 +680,9 @@ __all__ = [
     "CRON_SCHEDULER_SLEEP_TIME",
     "DATABASE_URI",
     "DATADOG_METRICS_ENABLED",
+    "DATA_PLANE_ID",
+    "DATA_PLANE_JWT_SECRET",
+    "DATA_PLANE_ORG_ID",
     "DB_MIGRATION_BY_CORE_API",
     "EXPOSE_INTERNAL_METRICS_PROMETHEUS",
     "FF_CRONS_ENABLED",

{langgraph_api-0.14.0.dev5 → langgraph_api-0.14.0.dev6}/langgraph_api/self_hosted_logs.py

@@ -10,6 +10,7 @@ from opentelemetry.sdk.resources import SERVICE_NAME, Resource
 from opentelemetry.util.types import Attributes
 
 from langgraph_api import config
+from langgraph_api.beacon_data_plane_jwt_auth import beacon_otel_session
 from langgraph_api.logging import OTLPFormatter
 
 logger = structlog.stdlib.get_logger(__name__)
@@ -45,10 +46,27 @@ def initialize_self_hosted_logs() -> None:
         raise RuntimeError(
             "LANGGRAPH_LOGS_ENABLED is true but no LANGGRAPH_LOGS_ENDPOINT is configured"
         )
+    log_endpoint = config.LANGGRAPH_LOGS_ENDPOINT
+
+    data_plane_settings = (
+        ("DATA_PLANE_ID", config.DATA_PLANE_ID),
+        ("DATA_PLANE_ORG_ID", config.DATA_PLANE_ORG_ID),
+        ("DATA_PLANE_JWT_SECRET", config.DATA_PLANE_JWT_SECRET),
+    )
+    has_data_plane_settings = any(value for _, value in data_plane_settings)
+    missing_data_plane_settings = [
+        name for name, value in data_plane_settings if not value
+    ]
+    if has_data_plane_settings and missing_data_plane_settings:
+        raise RuntimeError(
+            "LANGGRAPH_LOGS_ENABLED is true but required data plane settings are missing: "
+            + ", ".join(missing_data_plane_settings)
+        )
 
-    # For now, this is only enabled for fully self-hosted customers
-    # We will need to update the otel collector auth model to support hybrid customers
-    if not config.LANGGRAPH_CLOUD_LICENSE_KEY:
+    # "data-plane" here refers to a BYOC data plane
+    is_data_plane = has_data_plane_settings
+    # For now, the non-data-plane path is only enabled for fully self-hosted customers.
+    if not is_data_plane and not config.LANGGRAPH_CLOUD_LICENSE_KEY:
         logger.warning(
             "Self-hosted logs require a license key, and do not work with hybrid deployments yet."
         )
@@ -58,6 +76,13 @@ def initialize_self_hosted_logs() -> None:
         resource_attributes = {
             SERVICE_NAME: config.SELF_HOSTED_OBSERVABILITY_SERVICE_NAME,
         }
+        if is_data_plane:
+            resource_attributes["data_plane_id"] = cast("str", config.DATA_PLANE_ID)
+            resource_attributes["organization_id"] = cast(
+                "str", config.DATA_PLANE_ORG_ID
+            )
+            resource_attributes["host"] = config.BYOC_HOST
+            resource_attributes["env"] = config.BYOC_ENV
 
         if config.LANGGRAPH_CLOUD_LICENSE_KEY:
             try:
@@ -70,43 +95,47 @@ def initialize_self_hosted_logs() -> None:
                     _customer_attributes["customer_id"] = CUSTOMER_ID
                 if CUSTOMER_NAME:
                     _customer_attributes["customer_name"] = CUSTOMER_NAME
-
-                # resolves to pod name in k8s, or container id in docker
-                instance_id = os.environ.get("HOSTNAME")
-                if instance_id:
-                    _customer_attributes["instance_id"] = instance_id
             except ImportError:
                 pass
             except Exception as e:
                 logger.warning("Failed to get customer info from license", exc_info=e)
 
+        # Resolves to pod name in k8s, or container ID in Docker.
+        instance_id = os.environ.get("HOSTNAME")
+        if instance_id:
+            _customer_attributes["instance_id"] = instance_id
+
         if config.IS_QUEUE_ENTRYPOINT:
             _customer_attributes["entrypoint"] = "queue"
-        elif config.IS_EXECUTOR_ENTRYPOINT:
-            _customer_attributes["entrypoint"] = "executor"
         else:
             _customer_attributes["entrypoint"] = "api"
 
-        _logger_provider = LoggerProvider(
-            resource=Resource.create(resource_attributes),
-        )
-        _logger_provider.add_log_record_processor(
-            BatchLogRecordProcessor(
-                OTLPLogExporter(
-                    endpoint=config.LANGGRAPH_LOGS_ENDPOINT,
-                    headers={
-                        "X-Langchain-License-Key": config.LANGGRAPH_CLOUD_LICENSE_KEY,
-                    },
-                )
+        if is_data_plane:
+            exporter = OTLPLogExporter(
+                endpoint=log_endpoint,
+                session=beacon_otel_session(
+                    cast("str", config.DATA_PLANE_ID),
+                    cast("str", config.DATA_PLANE_ORG_ID),
+                    cast("str", config.DATA_PLANE_JWT_SECRET),
+                ),
             )
-        )
+        else:
+            exporter = OTLPLogExporter(
+                endpoint=log_endpoint,
+                headers={
+                    "X-Langchain-License-Key": config.LANGGRAPH_CLOUD_LICENSE_KEY,
+                },
+            )
+
+        _logger_provider = LoggerProvider(resource=Resource.create(resource_attributes))
+        _logger_provider.add_log_record_processor(BatchLogRecordProcessor(exporter))
         handler = AttrFilteredLoggingHandler(logger_provider=_logger_provider)
         handler.setFormatter(OTLPFormatter("%(message)s", None, "%"))
         logging.getLogger().addHandler(handler)
 
         logger.info(
             "Self-hosted logs initialized successfully",
-            endpoint=config.LANGGRAPH_LOGS_ENDPOINT,
+            endpoint=log_endpoint,
         )
     except Exception as e:
         logger.exception("Failed to initialize self-hosted logs", exc_info=e)

langgraph_api-0.14.0.dev5/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.14.0.dev5"