llama-stack 0.3.5__py3-none-any.whl → 0.4.1__py3-none-any.whl

llama_stack/__init__.py

@@ -3,8 +3,3 @@
 #
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
-
-from llama_stack.core.library_client import (  # noqa: F401
-    AsyncLlamaStackAsLibraryClient,
-    LlamaStackAsLibraryClient,
-)

llama_stack/cli/llama.py

@@ -8,6 +8,9 @@ import argparse
 
 from llama_stack.log import setup_logging
 
+# Initialize logging early before any loggers get created
+setup_logging()
+
 from .stack import StackParser
 from .stack.utils import print_subcommand_description
 
@@ -44,9 +47,6 @@ class LlamaCLIParser:
 
 
 def main():
-    # Initialize logging from environment variables before any other operations
-    setup_logging()
-
     parser = LlamaCLIParser()
     args = parser.parse_args()
     parser.run(args)

llama_stack/cli/stack/_list_deps.py

@@ -11,17 +11,11 @@ from pathlib import Path
 import yaml
 from termcolor import cprint
 
-from llama_stack.cli.stack.utils import ImageType
 from llama_stack.core.build import get_provider_dependencies
-from llama_stack.core.datatypes import (
-    BuildConfig,
-    BuildProvider,
-    DistributionSpec,
-)
+from llama_stack.core.datatypes import Provider, StackConfig
 from llama_stack.core.distribution import get_provider_registry
-from llama_stack.core.stack import replace_env_vars
 from llama_stack.log import get_logger
-from llama_stack.providers.datatypes import Api
+from llama_stack_api import Api
 
 TEMPLATES_PATH = Path(__file__).parent.parent.parent / "templates"
 
@@ -70,9 +64,9 @@ def format_output_deps_only(
 def run_stack_list_deps_command(args: argparse.Namespace) -> None:
     if args.config:
         try:
-            from llama_stack.core.utils.config_resolution import Mode, resolve_config_or_distro
+            from llama_stack.core.utils.config_resolution import resolve_config_or_distro
 
-            config_file = resolve_config_or_distro(args.config, Mode.BUILD)
+            config_file = resolve_config_or_distro(args.config)
         except ValueError as e:
             cprint(
                 f"Could not parse config file {args.config}: {e}",
@@ -84,9 +78,7 @@ def run_stack_list_deps_command(args: argparse.Namespace) -> None:
             with open(config_file) as f:
                 try:
                     contents = yaml.safe_load(f)
-                    contents = replace_env_vars(contents)
-                    build_config = BuildConfig(**contents)
-                    build_config.image_type = "venv"
+                    config = StackConfig(**contents)
                 except Exception as e:
                     cprint(
                         f"Could not parse config file {config_file}: {e}",
@@ -95,7 +87,7 @@ def run_stack_list_deps_command(args: argparse.Namespace) -> None:
                     )
                     sys.exit(1)
     elif args.providers:
-        provider_list: dict[str, list[BuildProvider]] = dict()
+        provider_list: dict[str, list[Provider]] = dict()
         for api_provider in args.providers.split(","):
             if "=" not in api_provider:
                 cprint(
@@ -114,8 +106,9 @@ def run_stack_list_deps_command(args: argparse.Namespace) -> None:
                 )
                 sys.exit(1)
             if provider_type in providers_for_api:
-                provider = BuildProvider(
+                provider = Provider(
                     provider_type=provider_type,
+                    provider_id=provider_type.split("::")[1],
                     module=None,
                 )
                 provider_list.setdefault(api, []).append(provider)
@@ -126,20 +119,16 @@ def run_stack_list_deps_command(args: argparse.Namespace) -> None:
                     file=sys.stderr,
                 )
                 sys.exit(1)
-        distribution_spec = DistributionSpec(
-            providers=provider_list,
-            description=",".join(args.providers),
-        )
-        build_config = BuildConfig(image_type=ImageType.VENV.value, distribution_spec=distribution_spec)
+        config = StackConfig(providers=provider_list, image_name="providers-run")
 
-    normal_deps, special_deps, external_provider_dependencies = get_provider_dependencies(build_config)
+    normal_deps, special_deps, external_provider_dependencies = get_provider_dependencies(config)
     normal_deps += SERVER_DEPENDENCIES
 
     # Add external API dependencies
-    if build_config.external_apis_dir:
+    if config.external_apis_dir:
         from llama_stack.core.external import load_external_apis
 
-        external_apis = load_external_apis(build_config)
+        external_apis = load_external_apis(config)
         if external_apis:
             for _, api_spec in external_apis.items():
                 normal_deps.extend(api_spec.pip_packages)

llama_stack/cli/stack/list_stacks.py

@@ -9,48 +9,67 @@ from pathlib import Path
 
 from llama_stack.cli.subcommand import Subcommand
 from llama_stack.cli.table import print_table
+from llama_stack.core.utils.config_dirs import DISTRIBS_BASE_DIR
 
 
 class StackListBuilds(Subcommand):
-    """List built stacks in .llama/distributions directory"""
+    """List available distributions (both built-in and custom)"""
 
     def __init__(self, subparsers: argparse._SubParsersAction):
         super().__init__()
         self.parser = subparsers.add_parser(
             "list",
             prog="llama stack list",
-            description="list the build stacks",
+            description="list available distributions",
             formatter_class=argparse.ArgumentDefaultsHelpFormatter,
         )
         self._add_arguments()
         self.parser.set_defaults(func=self._list_stack_command)
 
-    def _get_distribution_dirs(self) -> dict[str, Path]:
-        """Return a dictionary of distribution names and their paths"""
+    def _get_distribution_dirs(self) -> dict[str, tuple[Path, str]]:
+        """Return a dictionary of distribution names and their paths with source type
+
+        Returns:
+            dict mapping distro name to (path, source_type) where source_type is 'built-in' or 'custom'
+        """
         distributions = {}
-        dist_dir = Path.home() / ".llama" / "distributions"
 
-        if dist_dir.exists():
-            for stack_dir in dist_dir.iterdir():
-                if stack_dir.is_dir():
-                    distributions[stack_dir.name] = stack_dir
+        # Get built-in distributions from source code
+        distro_dir = Path(__file__).parent.parent.parent / "distributions"
+        if distro_dir.exists():
+            for stack_dir in distro_dir.iterdir():
+                if stack_dir.is_dir() and not stack_dir.name.startswith(".") and not stack_dir.name.startswith("__"):
+                    distributions[stack_dir.name] = (stack_dir, "built-in")
+
+        # Get custom/run distributions from ~/.llama/distributions
+        # These override built-in ones if they have the same name
+        if DISTRIBS_BASE_DIR.exists():
+            for stack_dir in DISTRIBS_BASE_DIR.iterdir():
+                if stack_dir.is_dir() and not stack_dir.name.startswith("."):
+                    # Clean up the name (remove llamastack- prefix if present)
+                    name = stack_dir.name.replace("llamastack-", "")
+                    distributions[name] = (stack_dir, "custom")
+
         return distributions
 
     def _list_stack_command(self, args: argparse.Namespace) -> None:
         distributions = self._get_distribution_dirs()
 
         if not distributions:
-            print("No stacks found in ~/.llama/distributions")
+            print("No distributions found")
             return
 
-        headers = ["Stack Name", "Path"]
-        headers.extend(["Build Config", "Run Config"])
+        headers = ["Stack Name", "Source", "Path", "Config"]
         rows = []
-        for name, path in distributions.items():
-            row = [name, str(path)]
-            # Check for build and run config files
-            build_config = "Yes" if (path / f"{name}-build.yaml").exists() else "No"
-            run_config = "Yes" if (path / f"{name}-run.yaml").exists() else "No"
-            row.extend([build_config, run_config])
+        for name, (path, source_type) in sorted(distributions.items()):
+            row = [name, source_type, str(path)]
+            # Check for config files
+            # For built-in distributions, configs are named config.yaml
+            # For custom distributions, configs are named {name}-config.yaml
+            if source_type == "built-in":
+                config = "Yes" if (path / "config.yaml").exists() else "No"
+            else:
+                config = "Yes" if (path / f"{name}-config.yaml").exists() else "No"
+            row.extend([config])
             rows.append(row)
         print_table(rows, headers, separate_rows=True)

llama_stack/cli/stack/run.py

@@ -8,17 +8,31 @@ import argparse
 import os
 import ssl
 import subprocess
+import sys
 from pathlib import Path
 
 import uvicorn
 import yaml
+from termcolor import cprint
 
 from llama_stack.cli.stack.utils import ImageType
 from llama_stack.cli.subcommand import Subcommand
-from llama_stack.core.datatypes import LoggingConfig, StackRunConfig
+from llama_stack.core.datatypes import Api, Provider, StackConfig
+from llama_stack.core.distribution import get_provider_registry
 from llama_stack.core.stack import cast_image_name_to_string, replace_env_vars
-from llama_stack.core.utils.config_resolution import Mode, resolve_config_or_distro
-from llama_stack.log import get_logger
+from llama_stack.core.storage.datatypes import (
+    InferenceStoreReference,
+    KVStoreReference,
+    ServerStoresConfig,
+    SqliteKVStoreConfig,
+    SqliteSqlStoreConfig,
+    SqlStoreReference,
+    StorageConfig,
+)
+from llama_stack.core.utils.config_dirs import DISTRIBS_BASE_DIR
+from llama_stack.core.utils.config_resolution import resolve_config_or_distro
+from llama_stack.core.utils.dynamic import instantiate_class_type
+from llama_stack.log import LoggingConfig, get_logger
 
 REPO_ROOT = Path(__file__).parent.parent.parent.parent
 
@@ -68,6 +82,12 @@ class StackRun(Subcommand):
             action="store_true",
             help="Start the UI server",
         )
+        self.parser.add_argument(
+            "--providers",
+            type=str,
+            default=None,
+            help="Run a stack with only a list of providers. This list is formatted like: api1=provider1,api1=provider2,api2=provider3. Where there can be multiple providers per API.",
+        )
 
     def _run_stack_run_cmd(self, args: argparse.Namespace) -> None:
         import yaml
@@ -88,16 +108,65 @@ class StackRun(Subcommand):
 
         if args.config:
             try:
-                from llama_stack.core.utils.config_resolution import Mode, resolve_config_or_distro
+                from llama_stack.core.utils.config_resolution import resolve_config_or_distro
 
-                config_file = resolve_config_or_distro(args.config, Mode.RUN)
+                config_file = resolve_config_or_distro(args.config)
             except ValueError as e:
                 self.parser.error(str(e))
+        elif args.providers:
+            provider_list: dict[str, list[Provider]] = dict()
+            for api_provider in args.providers.split(","):
+                if "=" not in api_provider:
+                    cprint(
+                        "Could not parse `--providers`. Please ensure the list is in the format api1=provider1,api2=provider2",
+                        color="red",
+                        file=sys.stderr,
+                    )
+                    sys.exit(1)
+                api, provider_type = api_provider.split("=")
+                providers_for_api = get_provider_registry().get(Api(api), None)
+                if providers_for_api is None:
+                    cprint(
+                        f"{api} is not a valid API.",
+                        color="red",
+                        file=sys.stderr,
+                    )
+                    sys.exit(1)
+                if provider_type in providers_for_api:
+                    config_type = instantiate_class_type(providers_for_api[provider_type].config_class)
+                    if config_type is not None and hasattr(config_type, "sample_run_config"):
+                        config = config_type.sample_run_config(__distro_dir__="~/.llama/distributions/providers-run")
+                    else:
+                        config = {}
+                    provider = Provider(
+                        provider_type=provider_type,
+                        config=config,
+                        provider_id=provider_type.split("::")[1],
+                    )
+                    provider_list.setdefault(api, []).append(provider)
+                else:
+                    cprint(
+                        f"{provider} is not a valid provider for the {api} API.",
+                        color="red",
+                        file=sys.stderr,
+                    )
+                    sys.exit(1)
+            run_config = self._generate_run_config_from_providers(providers=provider_list)
+            config_dict = run_config.model_dump(mode="json")
+
+            # Write config to disk in providers-run directory
+            distro_dir = DISTRIBS_BASE_DIR / "providers-run"
+            config_file = distro_dir / "config.yaml"
+
+            logger.info(f"Writing generated config to: {config_file}")
+            with open(config_file, "w") as f:
+                yaml.dump(config_dict, f, default_flow_style=False, sort_keys=False)
+
         else:
             config_file = None
 
         if config_file:
-            logger.info(f"Using run configuration: {config_file}")
+            logger.info(f"Using stack configuration: {config_file}")
 
             try:
                 config_dict = yaml.safe_load(config_file.read_text())
@@ -118,17 +187,17 @@ class StackRun(Subcommand):
         if not config_file:
             self.parser.error("Config file is required")
 
-        config_file = resolve_config_or_distro(str(config_file), Mode.RUN)
+        config_file = resolve_config_or_distro(str(config_file))
         with open(config_file) as fp:
             config_contents = yaml.safe_load(fp)
             if isinstance(config_contents, dict) and (cfg := config_contents.get("logging_config")):
                 logger_config = LoggingConfig(**cfg)
             else:
                 logger_config = None
-            config = StackRunConfig(**cast_image_name_to_string(replace_env_vars(config_contents)))
+            config = StackConfig(**cast_image_name_to_string(replace_env_vars(config_contents)))
 
         port = args.port or config.server.port
-        host = config.server.host or "0.0.0.0"
+        host = config.server.host or ["::", "0.0.0.0"]
 
         # Set the config file in environment so create_app can find it
         os.environ["LLAMA_STACK_CONFIG"] = str(config_file)
@@ -170,7 +239,7 @@ class StackRun(Subcommand):
         # Another approach would be to ignore SIGINT entirely - let uvicorn handle it through its own
         # signal handling but this is quite intrusive and not worth the effort.
         try:
-            uvicorn.run("llama_stack.core.server.server:create_app", **uvicorn_config)
+            uvicorn.run("llama_stack.core.server.server:create_app", **uvicorn_config)  # type: ignore[arg-type]
         except (KeyboardInterrupt, SystemExit):
             logger.info("Received interrupt signal, shutting down gracefully...")
 
@@ -184,7 +253,7 @@ class StackRun(Subcommand):
             )
             return
 
-        ui_dir = REPO_ROOT / "llama_stack" / "ui"
+        ui_dir = REPO_ROOT / "llama_stack_ui"
         logs_dir = Path("~/.llama/ui/logs").expanduser()
         try:
             # Create logs directory if it doesn't exist
@@ -214,3 +283,44 @@ class StackRun(Subcommand):
             )
         except Exception as e:
             logger.error(f"Failed to start UI development server in {ui_dir}: {e}")
+
+    def _generate_run_config_from_providers(self, providers: dict[str, list[Provider]]):
+        apis = list(providers.keys())
+        distro_dir = DISTRIBS_BASE_DIR / "providers-run"
+        # need somewhere to put the storage.
+        os.makedirs(distro_dir, exist_ok=True)
+        storage = StorageConfig(
+            backends={
+                "kv_default": SqliteKVStoreConfig(
+                    db_path=f"${{env.SQLITE_STORE_DIR:={distro_dir}}}/kvstore.db",
+                ),
+                "sql_default": SqliteSqlStoreConfig(
+                    db_path=f"${{env.SQLITE_STORE_DIR:={distro_dir}}}/sql_store.db",
+                ),
+            },
+            stores=ServerStoresConfig(
+                metadata=KVStoreReference(
+                    backend="kv_default",
+                    namespace="registry",
+                ),
+                inference=InferenceStoreReference(
+                    backend="sql_default",
+                    table_name="inference_store",
+                ),
+                conversations=SqlStoreReference(
+                    backend="sql_default",
+                    table_name="openai_conversations",
+                ),
+                prompts=KVStoreReference(
+                    backend="kv_default",
+                    namespace="prompts",
+                ),
+            ),
+        )
+
+        return StackConfig(
+            image_name="providers-run",
+            apis=apis,
+            providers=providers,
+            storage=storage,
+        )

llama_stack/cli/stack/utils.py

@@ -4,36 +4,9 @@
 # This source code is licensed under the terms described in the LICENSE file in
 # the root directory of this source tree.
 
-import json
-import sys
 from enum import Enum
-from functools import lru_cache
 from pathlib import Path
 
-import yaml
-from termcolor import cprint
-
-from llama_stack.core.datatypes import (
-    BuildConfig,
-    Provider,
-    StackRunConfig,
-    StorageConfig,
-)
-from llama_stack.core.distribution import get_provider_registry
-from llama_stack.core.resolver import InvalidProviderError
-from llama_stack.core.storage.datatypes import (
-    InferenceStoreReference,
-    KVStoreReference,
-    ServerStoresConfig,
-    SqliteKVStoreConfig,
-    SqliteSqlStoreConfig,
-    SqlStoreReference,
-)
-from llama_stack.core.utils.config_dirs import DISTRIBS_BASE_DIR, EXTERNAL_PROVIDERS_DIR
-from llama_stack.core.utils.dynamic import instantiate_class_type
-from llama_stack.core.utils.image_types import LlamaStackImageType
-from llama_stack.providers.datatypes import Api
-
 TEMPLATES_PATH = Path(__file__).parent.parent.parent / "distributions"
 
 
@@ -49,103 +22,3 @@ def print_subcommand_description(parser, subparsers):
         description = subcommand.description
         description_text += f"  {name:<21} {description}\n"
     parser.epilog = description_text
-
-
-def generate_run_config(
-    build_config: BuildConfig,
-    build_dir: Path,
-    image_name: str,
-) -> Path:
-    """
-    Generate a run.yaml template file for user to edit from a build.yaml file
-    """
-    apis = list(build_config.distribution_spec.providers.keys())
-    distro_dir = DISTRIBS_BASE_DIR / image_name
-    run_config = StackRunConfig(
-        container_image=(image_name if build_config.image_type == LlamaStackImageType.CONTAINER.value else None),
-        image_name=image_name,
-        apis=apis,
-        providers={},
-        storage=StorageConfig(
-            backends={
-                "kv_default": SqliteKVStoreConfig(db_path=str(distro_dir / "kvstore.db")),
-                "sql_default": SqliteSqlStoreConfig(db_path=str(distro_dir / "sql_store.db")),
-            },
-            stores=ServerStoresConfig(
-                metadata=KVStoreReference(backend="kv_default", namespace="registry"),
-                inference=InferenceStoreReference(backend="sql_default", table_name="inference_store"),
-                conversations=SqlStoreReference(backend="sql_default", table_name="openai_conversations"),
-            ),
-        ),
-        external_providers_dir=build_config.external_providers_dir
-        if build_config.external_providers_dir
-        else EXTERNAL_PROVIDERS_DIR,
-    )
-    # build providers dict
-    provider_registry = get_provider_registry(build_config)
-    for api in apis:
-        run_config.providers[api] = []
-        providers = build_config.distribution_spec.providers[api]
-
-        for provider in providers:
-            pid = provider.provider_type.split("::")[-1]
-
-            p = provider_registry[Api(api)][provider.provider_type]
-            if p.deprecation_error:
-                raise InvalidProviderError(p.deprecation_error)
-
-            try:
-                config_type = instantiate_class_type(provider_registry[Api(api)][provider.provider_type].config_class)
-            except (ModuleNotFoundError, ValueError) as exc:
-                # HACK ALERT:
-                # This code executes after building is done, the import cannot work since the
-                # package is either available in the venv or container - not available on the host.
-                # TODO: use a "is_external" flag in ProviderSpec to check if the provider is
-                # external
-                cprint(
-                    f"Failed to import provider {provider.provider_type} for API {api} - assuming it's external, skipping: {exc}",
-                    color="yellow",
-                    file=sys.stderr,
-                )
-                # Set config_type to None to avoid UnboundLocalError
-                config_type = None
-
-            if config_type is not None and hasattr(config_type, "sample_run_config"):
-                config = config_type.sample_run_config(__distro_dir__=f"~/.llama/distributions/{image_name}")
-            else:
-                config = {}
-
-            p_spec = Provider(
-                provider_id=pid,
-                provider_type=provider.provider_type,
-                config=config,
-                module=provider.module,
-            )
-            run_config.providers[api].append(p_spec)
-
-    run_config_file = build_dir / f"{image_name}-run.yaml"
-
-    with open(run_config_file, "w") as f:
-        to_write = json.loads(run_config.model_dump_json())
-        f.write(yaml.dump(to_write, sort_keys=False))
-
-    # Only print this message for non-container builds since it will be displayed before the
-    # container is built
-    # For non-container builds, the run.yaml is generated at the very end of the build process so it
-    # makes sense to display this message
-    if build_config.image_type != LlamaStackImageType.CONTAINER.value:
-        cprint(f"You can now run your stack with `llama stack run {run_config_file}`", color="green", file=sys.stderr)
-    return run_config_file
-
-
-@lru_cache
-def available_templates_specs() -> dict[str, BuildConfig]:
-    import yaml
-
-    template_specs = {}
-    for p in TEMPLATES_PATH.rglob("*build.yaml"):
-        template_name = p.parent.name
-        with open(p) as f:
-            build_config = BuildConfig(**yaml.safe_load(f))
-            template_specs[template_name] = build_config
-    return template_specs

llama_stack/core/access_control/access_control.py

@@ -7,6 +7,7 @@
 from typing import Any
 
 from llama_stack.core.datatypes import User
+from llama_stack.log import get_logger
 
 from .conditions import (
     Condition,
@@ -19,6 +20,8 @@ from .datatypes import (
     Scope,
 )
 
+logger = get_logger(name=__name__, category="core::auth")
+
 
 def matches_resource(resource_scope: str, actual_resource: str) -> bool:
     if resource_scope == actual_resource:
@@ -63,7 +66,17 @@ def default_policy() -> list[AccessRule]:
     return [
         AccessRule(
             permit=Scope(actions=list(Action)),
-            when=["user in owners " + name for name in ["roles", "teams", "projects", "namespaces"]],
+            when=["user in owners " + name],
+        )
+        for name in ["roles", "teams", "projects", "namespaces"]
+    ] + [
+        AccessRule(
+            permit=Scope(actions=list(Action)),
+            when=["user is owner"],
+        ),
+        AccessRule(
+            permit=Scope(actions=list(Action)),
+            when=["resource is unowned"],
         ),
     ]
 
@@ -74,35 +87,63 @@ def is_action_allowed(
     resource: ProtectedResource,
     user: User | None,
 ) -> bool:
+    qualified_resource_id = f"{resource.type}::{resource.identifier}"
+    decision = False
+    reason = ""
+    index = -1
+
     # If user is not set, assume authentication is not enabled
     if not user:
-        return True
-
-    if not len(policy):
-        policy = default_policy()
-
-    qualified_resource_id = f"{resource.type}::{resource.identifier}"
-    for rule in policy:
-        if rule.forbid and matches_scope(rule.forbid, action, qualified_resource_id, user.principal):
-            if rule.when:
-                if matches_conditions(parse_conditions(as_list(rule.when)), resource, user):
-                    return False
-            elif rule.unless:
-                if not matches_conditions(parse_conditions(as_list(rule.unless)), resource, user):
-                    return False
-            else:
-                return False
-        elif rule.permit and matches_scope(rule.permit, action, qualified_resource_id, user.principal):
-            if rule.when:
-                if matches_conditions(parse_conditions(as_list(rule.when)), resource, user):
-                    return True
-            elif rule.unless:
-                if not matches_conditions(parse_conditions(as_list(rule.unless)), resource, user):
-                    return True
-            else:
-                return True
-    # assume access is denied unless we find a rule that permits access
-    return False
+        decision = True
+        reason = "no auth"
+    else:
+        if not len(policy):
+            policy = default_policy()
+
+        for index, rule in enumerate(policy):  # noqa: B007
+            if rule.forbid and matches_scope(rule.forbid, action, qualified_resource_id, user.principal):
+                if rule.when:
+                    if matches_conditions(parse_conditions(as_list(rule.when)), resource, user):
+                        decision = False
+                        reason = rule.description or ""
+                        break
+                elif rule.unless:
+                    if not matches_conditions(parse_conditions(as_list(rule.unless)), resource, user):
+                        decision = False
+                        reason = rule.description or ""
+                        break
+                else:
+                    decision = False
+                    reason = rule.description or ""
+                    break
+            elif rule.permit and matches_scope(rule.permit, action, qualified_resource_id, user.principal):
+                if rule.when:
+                    if matches_conditions(parse_conditions(as_list(rule.when)), resource, user):
+                        decision = True
+                        reason = rule.description or ""
+                        break
+                elif rule.unless:
+                    if not matches_conditions(parse_conditions(as_list(rule.unless)), resource, user):
+                        decision = True
+                        reason = rule.description or ""
+                        break
+                else:
+                    decision = True
+                    reason = rule.description or ""
+                    break
+        else:
+            reason = "no matching rule"
+            index = -1
+
+    # print apprived or denied
+    decision_str = "APPROVED" if decision else "DENIED"
+    user_str = user.principal if user else "none"
+    logger.debug(
+        f"AUTHZ,decision={decision_str},user={user_str},"
+        f"resource_id={qualified_resource_id},action={action},"
+        f"rule_index={index},reason={reason!r}"
+    )
+    return decision
 
 
 class AccessDeniedError(RuntimeError):