memgres 0.8.0__tar.gz → 0.10.0__tar.gz

{memgres-0.8.0 → memgres-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgres
-Version: 0.8.0
+Version: 0.10.0
 Summary: Drop-in memory for AI agents: one Postgres, lexical + semantic recall, diff-versioned history, GDPR-erasable.
 Author: mozgsml
 License-Expression: MIT
@@ -214,6 +214,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_KEY_MODE` | `single` | `single` (no auth, one space) · `open` (bring-your-own token, self-registers) · `managed` (admin-provisioned). See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_ADMIN_TOKEN` | — | global admin bearer for provisioning (managed mode) |
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
+| `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |

{memgres-0.8.0 → memgres-0.10.0}/README.md

@@ -178,6 +178,7 @@ Everything is env, all optional (defaults suit a single-user embed). Full list i
 | `MEMGRES_KEY_MODE` | `single` | `single` (no auth, one space) · `open` (bring-your-own token, self-registers) · `managed` (admin-provisioned). See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_ADMIN_TOKEN` | — | global admin bearer for provisioning (managed mode) |
 | `MEMGRES_TOKEN` | — | default token used when a call passes none (single-tenant endpoints) |
+| `MEMGRES_TOKEN_SINK` | — | absolute directory a minted secret is **written to** (`<token-id>.token`, `0600`) instead of being returned. Set it when provisioning is done by an agent — a secret in a tool result is a secret in a transcript. See [docs/TENANCY.md](docs/TENANCY.md) |
 | `MEMGRES_TREE` | `true` | `ltree` path column + GiST index (fast subtree select) |
 | `MEMGRES_REQUIRE_TITLE` | `true` | `true` = a write that stores content must supply `title`. Captions are what name a memory in results and what title-weighted ranking weighs; `move`/`retag` are exempt (they store no content) |
 | `MEMGRES_REQUIRE_PARENT` | `false` | `true` = a node's parent path must already exist |

{memgres-0.8.0 → memgres-0.10.0}/memgres/_version.py

@@ -8,4 +8,4 @@ here at release; nowhere else carries the number.
 PEP 440: a ``.devN`` suffix marks an unreleased build ahead of the last tag.
 """
 
-__version__ = "0.8.0"
+__version__ = "0.10.0"

{memgres-0.8.0 → memgres-0.10.0}/memgres/admin.py

@@ -353,7 +353,8 @@ def create_namespace(conn, p: Principal, *, owner_user_id: str, name: str,
 
 def edit_namespace(conn, p: Principal, *, namespace_id: str,
                    description: Optional[str] = None,
-                   instruction: Optional[str] = None) -> dict:
+                   instruction: Optional[str] = None,
+                   name: Optional[str] = None) -> dict:
     """Amend a namespace's description or routing instruction.
 
     `create_namespace` is an idempotent upsert that ignores conflicts, so
@@ -363,19 +364,92 @@ def edit_namespace(conn, p: Principal, *, namespace_id: str,
     """
     require_namespace_admin(conn, p, namespace_id)
     identity.edit_namespace(conn, namespace_id, description=description,
-                            instruction=instruction)
-    return {"namespace_id": namespace_id}
+                            instruction=instruction, name=name)
+    out = {"namespace_id": namespace_id}
+    if name is not None:
+        out["name"] = name
+        out["warning"] = ("renamed — anyone addressing it by the old name now "
+                          "gets 'no such namespace'. Ids and aliases still work")
+    return out
+
+
+def require_namespace_owner(conn, p: Principal, namespace_id: str) -> None:
+    """Owner-or-superadmin, a tier narrower than `require_namespace_admin`.
+
+    For the acts that dispose of the namespace itself rather than work inside
+    it. An admin MEMBER was given authority over the contents; giving away
+    somebody else's namespace is not part of that, and the difference only
+    matters here — which is why this is its own check rather than a flag.
+    """
+    require_namespace_admin(conn, p, namespace_id)      # ceiling + scope + exists
+    if p.is_admin:
+        return
+    if identity.namespace_owner(conn, namespace_id) != p.user_id:
+        raise Forbidden("only the owner (or a superadmin) may do this")
 
 
 def add_member(conn, p: Principal, *, namespace_id: str, user_id: str,
                permission: str = "read") -> dict:
-    """Share a namespace with another user — cross-tenant, so superadmin only."""
-    require_superadmin(p)
+    """Share a namespace with another user.
+
+    Authorized per-NAMESPACE, not deployment-wide. It used to demand superadmin,
+    on the reasoning that sharing reaches across tenants — but the thing being
+    shared is the caller's OWN namespace, and requiring the deployment's root
+    for that made "let a colleague into my cabinet" an operator ticket. What it
+    still demands is an admin-ceiling credential for that namespace, so a
+    read-only or differently-scoped token cannot hand out access.
+    """
+    require_namespace_admin(conn, p, namespace_id)
     identity.add_member(conn, namespace_id, user_id, permission)
     return {"namespace_id": namespace_id, "user_id": user_id,
             "permission": permission}
 
 
+def remove_member(conn, p: Principal, *, namespace_id: str, user_id: str) -> dict:
+    """Un-share a namespace. `removed: false` means they were not a member.
+
+    The other half of `add_member`, and its absence was the sharpest gap in this
+    control plane: access could be granted and never taken back except by
+    revoking every token the person held, which cuts them off from everything
+    rather than from this.
+    """
+    require_namespace_admin(conn, p, namespace_id)
+    return {"namespace_id": namespace_id, "user_id": user_id,
+            "removed": identity.remove_member(conn, namespace_id, user_id)}
+
+
+def transfer_namespace(conn, p: Principal, *, namespace_id: str,
+                       new_owner_user_id: str,
+                       keep_previous_owner: Optional[str] = "admin") -> dict:
+    """Hand a namespace to another account — owner or superadmin.
+
+    The outgoing owner stays behind as an `admin` member unless
+    `keep_previous_owner` is null. Defaulting to keeping them is the safer
+    footing: the alternative is a single call that removes the caller from a
+    namespace whose contents they may be the only one who knows.
+    """
+    require_namespace_owner(conn, p, namespace_id)
+    return identity.transfer_namespace(
+        conn, namespace_id, new_owner_user_id,
+        keep_previous_owner=keep_previous_owner)
+
+
+def set_disabled(conn, p: Principal, *, user_id: str, disabled: bool) -> dict:
+    """Switch an account off, or back on. Every token it holds stops at once.
+
+    Offboarding as ONE act. Doing it by revoking tokens one at a time is a loop
+    that has to be complete to be correct, and nothing stops a new token being
+    issued afterwards. Reversible and destructive of nothing — authorship,
+    namespaces and memberships all survive, which is what makes it usable for
+    "gone for now" as well as "gone".
+    """
+    require_manage_users(p)
+    _require_target_is_plain_user(conn, p, user_id,
+                                  "disabling an account" if disabled
+                                  else "re-enabling an account")
+    return identity.set_disabled(conn, user_id, disabled)
+
+
 def list_namespaces(conn, p: Principal, *, owner_user_id: Optional[str] = None,
                     limit: Optional[int] = None, offset: int = 0) -> List[dict]:
     """Deployment-wide namespace inventory.
@@ -407,24 +481,118 @@ def list_spaces(conn, p: Principal) -> List[dict]:
 
 # ─── tokens ──────────────────────────────────────────────────────────────────
 
+def _unreachable_warning(conn, user_id: str,
+                         namespace_id: Optional[str]) -> Optional[str]:
+    """Warn when a credential is about to be scoped to a namespace its owner
+    cannot reach.
+
+    Scoping is not granting: reach comes from ownership or membership, and a
+    token pinned to a namespace the account is not in is perfectly valid and
+    reaches nothing. The person enrols, everything answers "no namespace", and
+    it reads as a broken server rather than an unfinished provisioning. A
+    warning rather than a refusal, because issuing the credential first and
+    adding the membership after is a legitimate order.
+    """
+    if not namespace_id:
+        return None
+    if identity.reaches(conn, user_id, namespace_id) is not None:
+        return None
+    return ("that user cannot reach this namespace yet, so the token will be "
+            "valid and see NOTHING — add them with memory_admin_add_member "
+            "(or hand the namespace over) before they try to use it")
+
+
 def issue_token(conn, p: Principal, *, user_id: str,
                 namespace_id: Optional[str] = None, permission: str = "write",
-                label: str = "", expires_days: Optional[int] = None) -> dict:
+                label: str = "", expires_days: Optional[int] = None,
+                sink_dir: str = "") -> dict:
     """Mint a token for `user_id`. The secret is returned once and never again.
 
     `expires_days` rather than a timestamp: both doors were converting the same
     way, so the conversion belongs here.
+
+    `sink_dir` (the deployment's `MEMGRES_TOKEN_SINK`) diverts the secret to a
+    0600 file on the server and returns its path instead — see
+    `identity.stash_secret`. The caller then never holds the secret at all,
+    which is the point when the caller is an agent.
     """
     require_manage_users(p)
     _require_target_is_plain_user(conn, p, user_id, "issuing a token")
     expires_at = None
     if expires_days:
         expires_at = dt.datetime.now(dt.timezone.utc) + dt.timedelta(days=expires_days)
+    warning = _unreachable_warning(conn, user_id, namespace_id)
     secret, tid = identity.issue_token(conn, user_id, namespace_id=namespace_id,
                                        permission=permission, label=label,
                                        expires_at=expires_at)
-    return {"token": secret, "id": tid,
-            "note": "store this now — it is not recoverable"}
+    out = deliver_secret(secret, tid, sink_dir)
+    if warning:
+        out["warning"] = warning
+    return out
+
+
+def deliver_secret(secret: str, token_id: str, sink_dir: str) -> dict:
+    """The reply for a freshly minted token: the secret itself, or — when the
+    deployment set a sink — only where it was put. One function so both minting
+    doors (this module and the MCP self-service tool) cannot disagree about
+    whether a secret is allowed into a response body."""
+    if sink_dir:
+        path = identity.stash_secret(sink_dir, token_id, secret)
+        return {"id": token_id, "delivered": "file", "path": path,
+                "exposed": False,
+                "note": "the secret was written to that file on the server and "
+                        "deliberately NOT returned here — read it there"}
+    return {"token": secret, "id": token_id, "exposed": True,
+            "note": "store this now — it is not recoverable. This secret was "
+                    "returned in a reply: if that reply reached an LLM, treat "
+                    "the token as exposed and rotate it once delivered. Set "
+                    "MEMGRES_TOKEN_SINK to stop returning secrets at all."}
+
+
+def create_enrollment(conn, p: Principal, *, user_id: str,
+                      namespace_id: Optional[str] = None,
+                      permission: str = "write", label: str = "",
+                      expires_minutes: Optional[int] = None) -> dict:
+    """Mint a one-time key that lets `user_id` bind a token THEY generate.
+
+    Provisioning-tier, and gated exactly like `issue_token`, because it grants
+    the same thing by another route: whoever redeems it ends up holding a
+    credential for that account. What it does not do is put a secret anywhere —
+    the key is worthless after one use and after `expires_minutes`, and the
+    token itself is created on the far side and never travels.
+    """
+    require_manage_users(p)
+    _require_target_is_plain_user(conn, p, user_id, "issuing an enrollment key")
+    kw = {} if expires_minutes is None else {"expires_minutes": expires_minutes}
+    out = identity.create_enrollment(
+        conn, user_id, namespace_id=namespace_id, permission=permission,
+        label=label, created_by=p.user_id, **kw)
+    out["note"] = ("give this key to its owner over any channel you would use "
+                   "for a meeting link — it is single-use and short-lived. They "
+                   "generate their own token, put it in their client's config, "
+                   "and call memory_enroll with this key.")
+    warning = _unreachable_warning(conn, user_id, namespace_id)
+    if warning:
+        out["warning"] = warning
+    return out
+
+
+def list_enrollments(conn, p: Principal, *,
+                     user_id: Optional[str] = None) -> List[dict]:
+    """Enrollment keys and what became of them — metadata only, never a key."""
+    require_manage_users(p)
+    if user_id is not None:
+        _require_target_is_plain_user(conn, p, user_id, "listing enrollment keys")
+    return identity.list_enrollments(conn, user_id=user_id)
+
+
+def revoke_enrollment(conn, p: Principal, *, enrollment_id: str) -> bool:
+    """Kill an unredeemed key. False if it was already spent, revoked or absent."""
+    require_manage_users(p)
+    _require_target_is_plain_user(conn, p,
+                                  identity.enrollment_owner(conn, enrollment_id),
+                                  "revoking an enrollment key")
+    return identity.revoke_enrollment(conn, enrollment_id)
 
 
 def revoke_token(conn, p: Principal, *, token_id: str) -> bool:

{memgres-0.8.0 → memgres-0.10.0}/memgres/config.py

@@ -70,6 +70,12 @@ class Config:
                                  # path only. Mutually exclusive with admin_token.
     admin_role: str              # role the bootstrap admin is seeded with:
                                  # user_manager (default) | superadmin
+    token_sink: str              # directory a freshly minted token secret is
+                                 # WRITTEN to (0600) instead of being returned in
+                                 # the reply. Set it when the caller is an agent:
+                                 # a secret in a tool result is a secret in a chat
+                                 # transcript, and every transcript is copied,
+                                 # summarized and stored. Empty = return it.
     # organization
     tree_enabled: bool           # ltree path column + GiST index for fast subtree selection
     require_title: bool          # True = a write that stores CONTENT must caption it
@@ -182,6 +188,11 @@ class Config:
             raise ValueError(
                 "MEMGRES_ADMIN_ROLE must be user_manager or superadmin "
                 f"(got {self.admin_role!r})")
+        if self.token_sink and not os.path.isabs(self.token_sink):
+            # A relative sink resolves against each process's CWD, so the server
+            # and the CLI would write the same operator's secrets to different
+            # directories — and neither would say so.
+            raise ValueError("MEMGRES_TOKEN_SINK must be an absolute path")
         if self.admin_token and self.admin_token_file:
             raise ValueError(
                 "set only one of MEMGRES_ADMIN_TOKEN / MEMGRES_ADMIN_TOKEN_FILE")
@@ -208,6 +219,7 @@ def load() -> Config:
         admin_token=_str("MEMGRES_ADMIN_TOKEN", ""),
         admin_token_file=_str("MEMGRES_ADMIN_TOKEN_FILE", ""),
         admin_role=_str("MEMGRES_ADMIN_ROLE", "user_manager"),
+        token_sink=_str("MEMGRES_TOKEN_SINK", ""),
         tree_enabled=_bool("MEMGRES_TREE", True),
         require_title=_bool("MEMGRES_REQUIRE_TITLE", True),
         require_parent=_bool("MEMGRES_REQUIRE_PARENT", False),