ory-agent-framework 0.11.1__py3-none-any.whl

ory_agent_framework/__init__.py

@@ -0,0 +1,18 @@
+"""Ory Agent Security for the Microsoft Agent Framework.
+
+    from ory_agent_framework import ory_function_middleware
+
+    agent = chat_client.create_agent(
+        instructions="…",
+        tools=[search, send_email],
+        middleware=[ory_function_middleware()],
+    )
+"""
+
+from __future__ import annotations
+
+from .middleware import guarded_process, ory_function_middleware
+
+__version__ = "0.11.1"
+
+__all__ = ["ory_function_middleware", "guarded_process", "__version__"]

ory_agent_framework/middleware.py

@@ -0,0 +1,85 @@
+"""Ory Agent Security for the Microsoft Agent Framework.
+
+The Agent Framework's per-tool interceptor is **function middleware** — ``process(context,
+next)``. ``ory_function_middleware()`` authorizes each function/tool call against Ory
+Permissions, traces it, and (on first call) runs the Ory session gates:
+
+  - allow / observe / fail-open / interactive → call ``next`` (the function runs) and record
+    ``tool.complete``.
+  - deny (enforce) → set ``context.result`` to the denial and ``context.terminate = True``
+    *without* calling ``next``, so the function never runs.
+
+Gate logic lives in ``ory_argus``. ``agent_framework`` is imported lazily, so importing this
+module never requires it.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ory_argus import GateResult, OryAgentClient, complete, gate, session_start
+
+HARNESS = "agent-framework"
+
+
+def _extract(context: Any) -> tuple[str, Any]:
+    fn = getattr(context, "function", None)
+    name = (
+        getattr(fn, "name", None)
+        or getattr(context, "function_name", None)
+        or getattr(context, "name", None)
+        or "unknown"
+    )
+    args = getattr(context, "arguments", None) or getattr(context, "args", None)
+    return name, args
+
+
+async def guarded_process(
+    client: OryAgentClient,
+    context: Any,
+    call_next: Any,
+    *,
+    can_block: bool = True,
+    project_url: str | None = None,
+    _session_state: dict | None = None,
+) -> Any:
+    """SDK-free guarded middleware body — testable with a fake context + next."""
+    state = _session_state if _session_state is not None else {}
+    if not state.get("started"):
+        state["started"] = True
+        try:
+            session_start(client, harness=HARNESS, project_url=project_url)
+        except Exception as err:  # noqa: BLE001
+            client.logger.warn("session_start.failed", {"message": str(err)})
+
+    name, args = _extract(context)
+    result: GateResult = gate(client, harness=HARNESS, tool_name=name, tool_args=args, can_block=can_block)
+    if result.blocked:
+        # Short-circuit: set the result and terminate without calling next.
+        context.result = result.denial_message or "Ory: permission denied"
+        try:
+            context.terminate = True
+        except Exception:  # noqa: BLE001 — some contexts may not expose terminate
+            pass
+        return None
+    out = await call_next(context)
+    complete(client, tool_name=name)
+    return out
+
+
+def ory_function_middleware(
+    *, client: OryAgentClient | None = None, can_block: bool = True, project_url: str | None = None
+):
+    """Return a function-middleware callable ``async (context, next)`` gated through Ory."""
+    c = client or OryAgentClient.from_env(HARNESS)
+    state: dict = {}
+
+    async def _middleware(context: Any, call_next: Any) -> Any:
+        return await guarded_process(
+            c, context, call_next, can_block=can_block, project_url=project_url, _session_state=state
+        )
+
+    return _middleware
+
+
+__all__ = ["HARNESS", "guarded_process", "ory_function_middleware"]

ory_agent_framework-0.11.1.dist-info/METADATA

@@ -0,0 +1,43 @@
+Metadata-Version: 2.4
+Name: ory-agent-framework
+Version: 0.11.1
+Summary: Ory Agent Security for the Microsoft Agent Framework — per-tool authorization, tracing, and identity propagation via function middleware. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: agent,agent-framework,ai,authorization,autogen,microsoft,ory
+Requires-Python: >=3.10
+Requires-Dist: agent-framework>=0.0.0a1
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-agent-framework
+
+Ory Agent Security for the [Microsoft Agent Framework](https://learn.microsoft.com/agent-framework/)
+(the successor to AutoGen + Semantic Kernel).
+
+Gates every function/tool call through Ory Permissions via **function middleware**, traces
+invocations, and propagates the user → agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-agent-framework
+```
+
+```python
+from ory_agent_framework import ory_function_middleware
+
+agent = chat_client.create_agent(
+    instructions="…",
+    tools=[search, send_email],
+    middleware=[ory_function_middleware()],
+)
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied call sets the result to the
+denial and terminates without invoking the function. In **observe** mode (default) the
+function runs and a `permission.observe_deny` span is recorded.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.

ory_agent_framework-0.11.1.dist-info/RECORD

@@ -0,0 +1,5 @@
+ory_agent_framework/__init__.py,sha256=5nxXV5hmdAXCipVki2BJlBlBKUvFkc_RAdWRMsdB6ZY,478
+ory_agent_framework/middleware.py,sha256=i421Mrp5OfH-MvZPpcwdwen1vNNCjAOk1hJcaRIUVWA,3069
+ory_agent_framework-0.11.1.dist-info/METADATA,sha256=7guKUU2E1kCGTJcp2MMnzpEl5iTHjngLmrFElRHXmUk,1541
+ory_agent_framework-0.11.1.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+ory_agent_framework-0.11.1.dist-info/RECORD,,

ory_agent_framework-0.11.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any