monkeybrain-runtime 1.0.0__py3-none-any.whl

services/file/main.py

@@ -0,0 +1,45 @@
+import os
+import asyncio
+import uvicorn
+import logging
+import sys
+from dotenv import load_dotenv
+
+try:
+    from services.file.src.core.config import app, logger, FORWARD_ENABLED, FORWARD_URL
+except ModuleNotFoundError:
+    from src.core.config import app, logger, FORWARD_ENABLED, FORWARD_URL
+
+# Load environment variables
+load_dotenv()
+
+# ============================
+# RUN SERVER
+# ============================
+async def run_server():
+    """Run the FastAPI server with uvicorn"""
+    port = int(os.getenv("PORT", "8005"))
+
+    try:
+        if FORWARD_ENABLED:
+            logger.info(f"🔌 Forward URL: {FORWARD_URL}")
+        logger.info("=" * 70)
+
+        config = uvicorn.Config(
+            app=app,
+            host="0.0.0.0",
+            port=port,
+            log_level="info",
+            access_log=True
+        )
+        server = uvicorn.Server(config)
+        await server.serve()
+
+    except Exception as e:
+        logger.error(f"FAILURE: Could not start server — {e}", exc_info=True)
+
+if __name__ == "__main__":
+    try:
+        asyncio.run(run_server())
+    except KeyboardInterrupt:
+        logger.info("\n🛑 Stopped by user")

services/file/recieve.py

@@ -0,0 +1,54 @@
+import asyncio
+import base64
+import io
+import json
+from pypdf import PdfReader
+import websockets
+
+WS_URL = "ws://172.19.0.6:6789"  # change if needed
+
+
+async def extract_text_from_pdf(message: str):
+    try:
+        res = json.loads(message)
+
+        print("📄 PDF file received, extracting text...")
+
+        pdf_base64 = res["data"]
+        pdf_bytes = base64.b64decode(pdf_base64)
+
+        pdf_file = io.BytesIO(pdf_bytes)
+        pdf_reader = PdfReader(pdf_file)
+
+        text = ""
+        for page_num, page in enumerate(pdf_reader.pages):
+            text += f"\n--- Page {page_num + 1} ---\n"
+            extracted = page.extract_text()
+            if extracted:
+                text += extracted
+        return text
+
+    except Exception as e:
+        print("❌ Failed to extract PDF text:", e)
+
+async def receive_messages():
+    print(f"🔌 Connecting to {WS_URL} ...")
+
+    async with websockets.connect(WS_URL) as ws:
+        print("✅ Connected. Waiting for messages...\n")
+
+        try:
+            async for message in ws:
+                if isinstance(message, bytes):
+                    print(f"📦 Binary message received ({len(message)} bytes)")
+                else:
+                    print("💬 Text message received")
+
+                    # Try to process as PDF payload
+                    text = await extract_text_from_pdf(message)
+
+        except websockets.exceptions.ConnectionClosed as e:
+            print(f"❌ Connection closed: {e}")
+
+
+asyncio.run(receive_messages())

services/file/send.py

@@ -0,0 +1,55 @@
+import asyncio
+import websockets
+import json
+import base64
+import os
+
+WS_URL = "ws://172.19.0.2:6789"
+FILE_PATH = "test.txt"  # change if needed
+
+
+async def send_file():
+    if not os.path.exists(FILE_PATH):
+        print("File not found:", FILE_PATH)
+        return
+
+    with open(FILE_PATH, "rb") as f:
+        file_bytes = f.read()
+
+    payload = {
+        "type": "file",
+        "fileName": os.path.basename(FILE_PATH),
+        "data": base64.b64encode(file_bytes).decode("utf-8")
+    }
+
+    async with websockets.connect(WS_URL) as ws:
+        print("📡 Connected (file mode)")
+        await ws.send(json.dumps(payload))
+        print("📤 File sent — closing connection")
+
+        # Small delay helps ensure packet is flushed before close
+        await asyncio.sleep(0.1)
+        await ws.close()
+
+
+async def send_text():
+    payload = {
+        "type": "text",
+        "message": "Hello from WebSocket client 👋"
+    }
+
+    async with websockets.connect(WS_URL) as ws:
+        print("📡 Connected (text mode)")
+        await ws.send(json.dumps(payload))
+        print("💬 Message sent — closing connection")
+
+        await asyncio.sleep(0.1)
+        await ws.close()
+
+
+async def main():
+    await send_text()
+    # await send_file()  # uncomment if you want file test too
+
+
+asyncio.run(main())

services/file/src/core/config.py

@@ -0,0 +1,90 @@
+import os
+import boto3
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from dotenv import load_dotenv
+from services.common.logging import configure_service_logging, install_request_logging
+from services.common.tracing import install_route_tracing
+
+load_dotenv()
+load_dotenv("services/file/.env")
+
+logger = configure_service_logging("file")
+
+from ..routes.files import root_router as root_file_router
+from ..routes.files import router as file_router
+from ..routes.cad_conversion import router as cad_conversion_router
+from ..routes.presigned import router as presigned_url_router
+
+# ============================
+# ENVIRONMENT VARIABLES
+# ============================
+
+# S3 Configuration
+AWS_ACCESS_KEY_ID = os.getenv("AWS_ACCESS_KEY_ID") or os.getenv("ACCESS_KEY_ID")
+AWS_SECRET_ACCESS_KEY = os.getenv("AWS_SECRET_ACCESS_KEY") or os.getenv("SECRET_ACCESS_KEY")
+AWS_REGION = os.getenv("AWS_REGION", os.getenv("REGION", "ap-south-1"))
+S3_BUCKET = os.getenv("AWS_S3_BUCKET") or os.getenv("S3_BUCKET")
+S3_BACKUP_BUCKET = os.getenv("AWS_S3_BACKUP_BUCKET") or os.getenv("S3_BACKUP_BUCKET")
+
+# WebSocket/Forward Configuration
+FORWARD_URL = os.getenv("WEBSOCKET_URL") or os.getenv("FORWARD_URL") or ""
+FORWARD_TIMEOUT = int(os.getenv("WEBSOCKET_TIMEOUT", "10"))
+FORWARD_ENABLED = bool(FORWARD_URL and FORWARD_URL.strip())
+
+# Validate required config
+if not S3_BUCKET:
+    logger.warning("S3_BUCKET is not set. Set AWS_S3_BUCKET or S3_BUCKET env var.")
+
+# ============================
+# S3 CLIENT INITIALIZATION
+# ============================
+
+s3_client_kwargs = {"region_name": AWS_REGION}
+if AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY:
+    s3_client_kwargs.update({
+        "aws_access_key_id": AWS_ACCESS_KEY_ID,
+        "aws_secret_access_key": AWS_SECRET_ACCESS_KEY,
+    })
+
+s3_client = boto3.client("s3", **s3_client_kwargs)
+
+# Log configuration
+logger.info(f"Forward URL: {FORWARD_URL}")
+logger.info(f"Forward Enabled: {FORWARD_ENABLED}")
+logger.info(f"Forward Timeout: {FORWARD_TIMEOUT}s")
+logger.info(f"S3 Bucket: {S3_BUCKET}")
+logger.info(f"S3 Backup Bucket: {S3_BACKUP_BUCKET or (S3_BUCKET + '-backup' if S3_BUCKET else 'N/A')}")
+
+# ============================
+# FASTAPI APP INITIALIZATION
+# ============================
+
+app = FastAPI(
+    title="Document Upload API with Backup",
+    description="FastAPI application for Azure Container Apps",
+    version="1.0.0"
+)
+install_request_logging(app, "file")
+install_route_tracing(app, "file")
+
+# ============================
+# MIDDLEWARE
+# ============================
+
+# CORS middleware
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],  # Configure this for production
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# -------------------------------------------------
+# Routers
+# -------------------------------------------------
+app.include_router(file_router)
+app.include_router(root_file_router)
+app.include_router(cad_conversion_router)
+app.include_router(presigned_url_router)

services/file/src/core/keycloak.py

@@ -0,0 +1,152 @@
+import os
+import time
+from dotenv import load_dotenv
+import requests
+import redis
+from typing import Dict
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from jose import jwt, JWTError
+
+load_dotenv()
+
+# -------------------------------------------------------------------
+# Environment
+# -------------------------------------------------------------------
+KEYCLOAK_ISSUER = os.environ["KEYCLOAK_ISSUER"]
+KEYCLOAK_AUDIENCE = os.environ["KEYCLOAK_AUDIENCE"]
+KC_CLIENT_ID = os.environ["KC_CLIENT_ID"]
+KC_CLIENT_SECRET = os.environ["KC_CLIENT_SECRET"]
+
+# Use separate URL for JWKS fetching (container-to-container)
+KEYCLOAK_INTERNAL_URL = os.getenv("KEYCLOAK_INTERNAL_URL", "http://keycloak:8080")
+VERIFY_SSL = os.getenv("VERIFY_SSL", "true").lower() == "true"
+
+# -------------------------------------------------------------------
+# Security
+# -------------------------------------------------------------------
+security = HTTPBearer(auto_error=True)
+
+# -------------------------------------------------------------------
+# Redis (Replay Detection)
+# -------------------------------------------------------------------
+redis_client = redis.Redis(
+    host=os.getenv("REDIS_HOST", "localhost"),
+    port=6379,
+    decode_responses=True,
+)
+
+# -------------------------------------------------------------------
+# JWKS Cache
+# -------------------------------------------------------------------
+# Use internal URL for fetching JWKS, but keep original issuer for validation
+JWKS_URL = f"{KEYCLOAK_INTERNAL_URL}/realms/asset_manager/protocol/openid-connect/certs"
+JWKS_CACHE_TTL = 3600  # 1 hour
+
+_jwks_cache = {"keys": None, "expires": 0}
+
+
+def get_jwks():
+    now = time.time()
+    if _jwks_cache["keys"] is None or now > _jwks_cache["expires"]:
+        resp = requests.get(JWKS_URL, timeout=5, verify=VERIFY_SSL)
+        resp.raise_for_status()
+        _jwks_cache["keys"] = resp.json()["keys"]
+        _jwks_cache["expires"] = now + JWKS_CACHE_TTL
+    return _jwks_cache["keys"]
+
+# -------------------------------------------------------------------
+# JWT Verification
+# -------------------------------------------------------------------
+def verify_jwt(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+) -> Dict:
+    token = credentials.credentials
+
+    try:
+        headers = jwt.get_unverified_header(token)
+        kid = headers["kid"]
+    except JWTError:
+        raise HTTPException(status_code=401, detail="Invalid JWT header")
+
+    for key in get_jwks():
+        if key["kid"] == kid:
+            try:
+                claims = jwt.decode(
+                    token,
+                    key,
+                    algorithms=["RS256"],
+                    issuer=KEYCLOAK_ISSUER,
+                    options={
+                        "verify_signature": True,
+                        "verify_aud": False,
+                        "verify_exp": True,
+                        "verify_iss": False,
+                    }
+                )
+
+                # Enforce client identity explicitly
+                if claims.get("azp") != KC_CLIENT_ID:
+                    raise HTTPException(
+                        status_code=401,
+                        detail="Invalid authorized party (azp)",
+                    )
+
+                return claims
+
+            except JWTError as e:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail=f"JWT validation failed: {str(e)}",
+                )
+
+    raise HTTPException(status_code=401, detail="Unknown signing key")
+
+# -------------------------------------------------------------------
+# Token Introspection (Revocation)
+# -------------------------------------------------------------------
+def introspect_token(token: str) -> bool:
+    resp = requests.post(
+        f"{KEYCLOAK_INTERNAL_URL}/realms/asset_manager/protocol/openid-connect/token/introspect",
+        data={"token": token},
+        auth=(KC_CLIENT_ID, KC_CLIENT_SECRET),
+        timeout=5,
+        verify=VERIFY_SSL,
+    )
+    resp.raise_for_status()
+    return resp.json().get("active", False)
+
+def require_active_token(
+    claims: Dict = Depends(verify_jwt),
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+) -> Dict:
+    token = credentials.credentials
+
+    # Enforce revocation only for sensitive scopes
+    if "high-risk" in claims.get("scope", ""):
+        if not introspect_token(token):
+            raise HTTPException(status_code=401, detail="Token revoked")
+
+    return claims
+
+# -------------------------------------------------------------------
+# Token Replay Detection
+# -------------------------------------------------------------------
+def detect_replay(jti: str, ttl: int = 300):
+    key = f"jti:{jti}"
+
+    if redis_client.exists(key):
+        raise HTTPException(status_code=401, detail="Token replay detected")
+
+    redis_client.setex(key, ttl, "used")
+
+def anti_replay_guard(
+    claims: Dict = Depends(require_active_token),
+) -> Dict:
+    jti = claims.get("jti")
+    if not jti:
+        raise HTTPException(status_code=401, detail="Missing jti in token")
+
+    detect_replay(jti)
+    return claims

services/file/src/core/logging_config.py

@@ -0,0 +1,9 @@
+import logging
+
+from services.common.logging import configure_service_logging
+
+
+def setup_logging() -> logging.Logger:
+    return configure_service_logging("file")
+
+logger = setup_logging()

services/file/src/core/security.py

@@ -0,0 +1,33 @@
+from fastapi import Depends, Header, HTTPException, status, Request
+
+from .keycloak import anti_replay_guard
+from .keycloak import verify_jwt
+
+async def require_mtls(request: Request):
+    print("x-ssl-client-verify =", request.headers.get("x-ssl-client-verify"))
+    print("x-ssl-client-dn =", request.headers.get("x-ssl-client-dn"))
+
+    if request.headers.get("x-ssl-client-verify") != "SUCCESS":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="mTLS required",
+        )
+
+
+async def require_auth_context(
+    request: Request,
+    claims: dict = Depends(anti_replay_guard),  # JWT + introspection + replay
+):
+    """
+    Unified security layer.
+
+    - Via Kong  → JWT only
+    - Direct    → mTLS + JWT
+    """
+
+    via_kong = request.headers.get("x-kong-request-id") is not None
+
+    if not via_kong:
+        await require_mtls(request)
+
+    return claims