ory-langchain 0.13.9__tar.gz

ory_langchain-0.13.9/.gitignore

@@ -0,0 +1,36 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.env
+.env.local
+
+# Python (uv workspace under python/)
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+build/
+*.pyc
+
+# Debug logs
+*.log
+
+# Harness sandbox dirs
+.sandbox/
+
+# Staged install-surface repo contents (see scripts/sync-install-surfaces.mjs)
+.install-surfaces/
+
+# Local dev environment (local Ory stack + Verdaccio registry)
+.ory-dev/
+
+# Worktrees for changes
+.worktrees/
+.claude/worktrees/
+
+# Gemini CLI extension assets — materialized at install time from
+# @ory/argus templates. The repo source is the canonical templates;
+# these subdirs are generated wherever the install runs.
+packages/gemini-cli/gemini-extension/skills/
+packages/gemini-cli/gemini-extension/commands/

ory_langchain-0.13.9/PKG-INFO

@@ -0,0 +1,66 @@
+Metadata-Version: 2.4
+Name: ory-langchain
+Version: 0.13.9
+Summary: Ory Agent Security for LangChain / LangGraph — per-tool authorization, tracing, and identity propagation via an AgentMiddleware. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: agent,ai,authorization,langchain,langgraph,ory,permissions
+Requires-Python: >=3.10
+Requires-Dist: langchain<2,>=1
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-langchain
+
+Ory Agent Security for [LangChain](https://docs.langchain.com) / LangGraph.
+
+Adds three things to a LangChain agent with one line:
+
+1. **Authorization** — every tool call is checked against Ory Permissions before it runs.
+2. **Tracing** — every invocation is recorded as a structured span (OTLP + NDJSON).
+3. **Identity propagation** — user → agent → sub-agent delegation, recorded in Ory.
+
+## Install
+
+```bash
+pip install ory-langchain
+```
+
+## Use
+
+```python
+from langchain.agents import create_agent
+from ory_langchain import OryMiddleware
+
+agent = create_agent(
+    model,
+    tools=[search, send_email],
+    middleware=[OryMiddleware()],   # gate every tool call through Ory
+)
+```
+
+`OryMiddleware()` reads the shared Ory config at `~/.config/ory-agent-plugins/config.json`,
+so a login performed by any Ory coding-agent harness — or by `ory-argus login` — is reused
+transparently. Configure a project explicitly with `OryMiddleware(project_url=...)`.
+
+### Permission mode
+
+- `observe` (default) — denied tools still run, but a `permission.observe_deny` span is
+  recorded. Use this to see what *would* be blocked before enforcing.
+- `enforce` — denied tools are blocked: the model receives an error `ToolMessage` and the
+  tool never executes. Set `ORY_PERMISSION_MODE=enforce` or run `ory-argus permissions enforce`.
+
+### Tracing only
+
+If you only want observability (no enforcement), use the callback handler instead:
+
+```python
+from ory_langchain import OryCallbackHandler
+
+agent.invoke({"messages": [...]}, config={"callbacks": [OryCallbackHandler()]})
+```
+
+Built on [`ory-argus`](https://pypi.org/project/ory-argus/), the shared Ory Agent Security core.

ory_langchain-0.13.9/README.md

@@ -0,0 +1,51 @@
+# ory-langchain
+
+Ory Agent Security for [LangChain](https://docs.langchain.com) / LangGraph.
+
+Adds three things to a LangChain agent with one line:
+
+1. **Authorization** — every tool call is checked against Ory Permissions before it runs.
+2. **Tracing** — every invocation is recorded as a structured span (OTLP + NDJSON).
+3. **Identity propagation** — user → agent → sub-agent delegation, recorded in Ory.
+
+## Install
+
+```bash
+pip install ory-langchain
+```
+
+## Use
+
+```python
+from langchain.agents import create_agent
+from ory_langchain import OryMiddleware
+
+agent = create_agent(
+    model,
+    tools=[search, send_email],
+    middleware=[OryMiddleware()],   # gate every tool call through Ory
+)
+```
+
+`OryMiddleware()` reads the shared Ory config at `~/.config/ory-agent-plugins/config.json`,
+so a login performed by any Ory coding-agent harness — or by `ory-argus login` — is reused
+transparently. Configure a project explicitly with `OryMiddleware(project_url=...)`.
+
+### Permission mode
+
+- `observe` (default) — denied tools still run, but a `permission.observe_deny` span is
+  recorded. Use this to see what *would* be blocked before enforcing.
+- `enforce` — denied tools are blocked: the model receives an error `ToolMessage` and the
+  tool never executes. Set `ORY_PERMISSION_MODE=enforce` or run `ory-argus permissions enforce`.
+
+### Tracing only
+
+If you only want observability (no enforcement), use the callback handler instead:
+
+```python
+from ory_langchain import OryCallbackHandler
+
+agent.invoke({"messages": [...]}, config={"callbacks": [OryCallbackHandler()]})
+```
+
+Built on [`ory-argus`](https://pypi.org/project/ory-argus/), the shared Ory Agent Security core.

ory_langchain-0.13.9/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "ory-langchain"
+version = "0.13.9"
+description = "Ory Agent Security for LangChain / LangGraph — per-tool authorization, tracing, and identity propagation via an AgentMiddleware. Built on ory-argus."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "Ory" }]
+keywords = ["ory", "langchain", "langgraph", "authorization", "agent", "ai", "permissions"]
+dependencies = [
+    "ory-argus>=0.8,<1",
+    "langchain>=1,<2",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ory_langchain"]

ory_langchain-0.13.9/src/ory_langchain/__init__.py

@@ -0,0 +1,23 @@
+"""Ory Agent Security for LangChain / LangGraph.
+
+Drop ``OryMiddleware`` into a LangChain agent to gate every tool call through Ory
+Permissions, trace every invocation, and propagate user → agent → sub-agent identity::
+
+    from langchain.agents import create_agent
+    from ory_langchain import OryMiddleware
+
+    agent = create_agent(model, tools=tools, middleware=[OryMiddleware()])
+
+By default ``OryMiddleware()`` reads the shared Ory config
+(``~/.config/ory-agent-plugins/config.json``), so a login performed by any Ory harness or
+the ``ory-argus`` CLI is reused automatically.
+"""
+
+from __future__ import annotations
+
+from .callbacks import OryCallbackHandler
+from .middleware import OryMiddleware
+
+__version__ = "0.13.9"
+
+__all__ = ["OryMiddleware", "OryCallbackHandler", "__version__"]

ory_langchain-0.13.9/src/ory_langchain/callbacks.py

@@ -0,0 +1,47 @@
+"""Trace-only LangChain callback handler.
+
+``OryCallbackHandler`` is a ``BaseCallbackHandler`` that records ``tool.invoke`` /
+``tool.complete`` spans for observability. It does **not** authorize — callbacks can't veto
+a tool call in LangChain. Use it when you only want tracing; use :class:`OryMiddleware` when
+you want enforcement (which also traces). Don't install both for the same agent, or tool
+calls will be traced twice.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ory_argus import OryAgentClient
+
+_HARNESS = "langchain"
+
+
+def _import_base():
+    from langchain_core.callbacks import BaseCallbackHandler
+
+    return BaseCallbackHandler
+
+
+class OryCallbackHandler(_import_base()):  # type: ignore[misc]
+    """Records trace spans for tool starts/ends (observation only)."""
+
+    def __init__(self, client: OryAgentClient | None = None) -> None:
+        super().__init__()
+        self._client = client or OryAgentClient.from_env(_HARNESS)
+
+    def on_tool_start(self, serialized: dict, input_str: str, **kwargs: Any) -> None:
+        name = (serialized or {}).get("name", "unknown")
+        self._client.tracer.record(
+            "tool.invoke", "ok", attributes={"toolName": name, "source": "callback"}
+        )
+
+    def on_tool_end(self, output: Any, **kwargs: Any) -> None:
+        self._client.tracer.record("tool.complete", "ok", attributes={"source": "callback"})
+
+    def on_tool_error(self, error: BaseException, **kwargs: Any) -> None:
+        self._client.tracer.record(
+            "tool.fail", "error", attributes={"source": "callback", "error": str(error)}
+        )
+
+
+__all__ = ["OryCallbackHandler"]

ory_langchain-0.13.9/src/ory_langchain/middleware.py

@@ -0,0 +1,137 @@
+"""Ory Agent Security middleware for LangChain / LangGraph.
+
+``OryMiddleware`` is a LangChain v1 ``AgentMiddleware`` that intercepts **every** tool call
+via ``wrap_tool_call`` — the canonical before+after extension point. On the first call it
+runs the Ory session gates (user + agent auth, user→agent delegation); on each call it
+authorizes the tool against Ory Permissions and records trace spans:
+
+  - **allow / observe / fail-open / interactive** → call the wrapped ``handler`` (tool runs)
+    and record ``tool.complete``.
+  - **deny (enforce mode)** → return a ``ToolMessage`` with ``status="error"`` *without*
+    invoking the handler, so the tool never executes and the model sees the denial.
+
+All heavy lifting lives in ``ory_argus`` (the shared core); this module is the thin
+LangChain translation.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from ory_argus import (
+    OryAgentClient,
+    complete,
+    gate,
+    register_subagent,
+    session_start,
+)
+
+if TYPE_CHECKING:
+    from langchain_core.messages import ToolMessage
+
+_HARNESS = "langchain"
+
+
+def _import_middleware_base():
+    try:
+        from langchain.agents.middleware import AgentMiddleware
+
+        return AgentMiddleware
+    except Exception as err:  # pragma: no cover - import guard
+        raise ImportError(
+            "ory-langchain requires langchain>=1. Install it with `pip install ory-langchain` "
+            "(which pulls langchain) or `pip install 'langchain>=1,<2'`."
+        ) from err
+
+
+def _block_message(tool_call: dict, reason: str) -> ToolMessage:
+    from langchain_core.messages import ToolMessage
+
+    return ToolMessage(
+        content=reason,
+        tool_call_id=str(tool_call.get("id") or ""),
+        name=tool_call.get("name"),
+        status="error",
+    )
+
+
+class OryMiddleware(_import_middleware_base()):  # type: ignore[misc]
+    """LangChain middleware that gates every tool call through Ory.
+
+    Args:
+        client: An ``OryAgentClient``. Defaults to ``OryAgentClient.from_env("langchain")``
+            (reads the shared config — reuses a TS-harness login transparently).
+        project_url: Override the Ory project URL for the session gates.
+        can_block: Whether a denied tool is hard-blocked. ``True`` (default) returns an
+            error ``ToolMessage`` in enforce mode; the alert span records ``blocked``.
+        subagent_tools: Tool names that spawn a sub-agent (e.g. LangGraph handoffs). When a
+            gated tool is in this set, a sub-agent identity + agent→subagent delegation
+            tuple is recorded (best-effort, audit-only).
+    """
+
+    def __init__(
+        self,
+        *,
+        client: OryAgentClient | None = None,
+        project_url: str | None = None,
+        can_block: bool = True,
+        subagent_tools: set[str] | None = None,
+    ) -> None:
+        super().__init__()
+        self._client = client or OryAgentClient.from_env(_HARNESS)
+        self._project_url = project_url
+        self._can_block = can_block
+        self._subagent_tools = subagent_tools or set()
+        self._session_started = False
+
+    # ─── session ─────────────────────────────────────────────────────
+    def _ensure_session(self) -> None:
+        if self._session_started:
+            return
+        self._session_started = True
+        try:
+            session_start(self._client, harness=_HARNESS, project_url=self._project_url)
+        except Exception as err:  # noqa: BLE001 — session gate must never break the agent
+            self._client.logger.warn("session_start.failed", {"message": str(err)})
+
+    # ─── core gate (shared by sync + async paths) ────────────────────
+    def _gate_then(self, request: Any):
+        """Returns ``(block_message_or_None, tool_name, tool_call)``."""
+        self._ensure_session()
+        tool_call = getattr(request, "tool_call", None) or {}
+        tool_name = tool_call.get("name") or getattr(getattr(request, "tool", None), "name", "unknown")
+        args = tool_call.get("args")
+
+        if tool_name in self._subagent_tools:
+            try:
+                register_subagent(
+                    self._client, harness=_HARNESS, sub_agent_type=tool_name, project_url=self._project_url
+                )
+            except Exception as err:  # noqa: BLE001
+                self._client.logger.warn("subagent.register.failed", {"tool": tool_name, "message": str(err)})
+
+        result = gate(
+            self._client, harness=_HARNESS, tool_name=tool_name, tool_args=args, can_block=self._can_block
+        )
+        if result.blocked:
+            return _block_message(tool_call, result.denial_message or "Ory: permission denied"), tool_name, tool_call
+        return None, tool_name, tool_call
+
+    def wrap_tool_call(self, request, handler):  # type: ignore[override]
+        block, tool_name, _tc = self._gate_then(request)
+        if block is not None:
+            return block
+        response = handler(request)
+        complete(self._client, tool_name=tool_name)
+        return response
+
+    async def awrap_tool_call(self, request, handler):  # type: ignore[override]
+        block, tool_name, _tc = self._gate_then(request)
+        if block is not None:
+            return block
+        response = await handler(request)
+        complete(self._client, tool_name=tool_name)
+        return response
+
+
+__all__ = ["OryMiddleware"]

ory_langchain-0.13.9/tests/test_e2e.py

@@ -0,0 +1,77 @@
+"""Live end-to-end test for OryMiddleware against a real local Ory stack.
+
+Opt-in: skipped unless ``ORY_E2E=1`` and ``ORY_USER_SUBJECT_ID`` are set, so the normal
+``pytest`` run (and CI) never needs Docker.
+
+**Scope — deliberately minimal, no overlap with `test_middleware.py`.**
+`test_middleware.py` stubs the permission check (via the `ory_argus` mock kit) to exercise
+the adapter's full decision matrix hermetically: allow / observe / enforce-blocks /
+fail-open / interactive pass-through / session-once. Those branches are pure translation
+logic and are *not* re-checked here.
+
+This test asserts only what a stub cannot: that the **real** check wiring — namespace,
+relation (`use`), and subject form (SubjectSet `User:<id>`) — actually matches the tuples in
+a live Keto, so a granted catalog tool is genuinely allowed and an un-tupled tool is
+genuinely denied. One enforce-mode scenario covers both a real allow and a real deny.
+
+Run::
+
+    pnpm local:up   # seeds a user + `use` tuples; prints the env below
+    ORY_E2E=1 ORY_PROJECT_URL=http://localhost:4000 ORY_USER_SUBJECT_NAMESPACE=User \\
+      ORY_USER_SUBJECT_ID=<seeded-id> \\
+      uv run --extra dev pytest ory-langchain/tests/test_e2e.py
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+
+_LIVE = os.environ.get("ORY_E2E") == "1" and bool(os.environ.get("ORY_USER_SUBJECT_ID"))
+pytestmark = pytest.mark.skipif(
+    not _LIVE, reason="live Ory stack required; set ORY_E2E=1 + the seeded ORY_USER_* env"
+)
+
+# Imported lazily-safe: langchain is a dependency of this package and is installed in the
+# workspace venv, so these resolve during collection even when the test is skipped.
+from langchain_core.messages import ToolMessage  # noqa: E402
+from langgraph.prebuilt.tool_node import ToolCallRequest  # noqa: E402
+
+from ory_argus import OryAgentClient  # noqa: E402
+from ory_langchain import OryMiddleware  # noqa: E402
+
+# A tool the seed grants `use` on (in the AgentTools catalog); override per environment.
+GRANTED = os.environ.get("ORY_E2E_GRANTED_TOOL", "Read")
+UNGRANTED = "ory_e2e_unauthorized_tool"
+
+
+def _request(name: str) -> ToolCallRequest:
+    return ToolCallRequest(
+        tool_call={"name": name, "args": {}, "id": f"call-{name}", "type": "tool_call"},
+        tool=None, state={}, runtime=None,
+    )
+
+
+def _handler(_request):
+    return ToolMessage(content="RAN", tool_call_id="x")
+
+
+def test_enforce_allows_granted_blocks_ungranted(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    client = OryAgentClient.from_env("langchain")
+    mw = OryMiddleware(client=client)
+
+    granted = mw.wrap_tool_call(_request(GRANTED), _handler)
+    ungranted = mw.wrap_tool_call(_request(UNGRANTED), _handler)
+
+    # Granted catalog tool is allowed by a real Keto tuple → the handler ran.
+    assert getattr(granted, "content", None) == "RAN"
+    # Un-tupled tool is denied by real Keto → blocked; the handler never ran.
+    assert getattr(ungranted, "status", None) == "error"
+    assert "permission denied" in str(ungranted.content).lower()
+
+    # Both outcomes came from real permission.check calls — one allowed, one denied.
+    check_statuses = {s.status for s in client.tracer.spans() if s.event == "permission.check"}
+    assert "ok" in check_statuses, "expected a real ALLOW from live Keto"
+    assert "denied" in check_statuses, "expected a real DENY from live Keto"

ory_langchain-0.13.9/tests/test_middleware.py

@@ -0,0 +1,175 @@
+"""Hermetic tests for the LangChain OryMiddleware.
+
+Covers the SDK-native surfaces only: the enforce-deny veto shape (a ``ToolMessage`` with
+``status="error"``), request-shape extraction from a real ``ToolCallRequest``, and the
+package-specific paths (session-once, callback handler, interactive pass-through). The full
+permission decision matrix is core-owned (``ory-argus/tests/test_adapters.py``);
+``test_gate_matrix`` re-drives it through this middleware via ``run_gate_matrix`` as the
+reference for the opt-in pattern.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+pytest.importorskip("langchain")
+
+from langchain_core.messages import ToolMessage  # noqa: E402
+from langgraph.prebuilt.tool_node import ToolCallRequest  # noqa: E402
+
+from ory_argus.agent_auth import AgentCredentials  # noqa: E402
+from ory_argus.client import PrincipalIdentity  # noqa: E402
+from ory_argus.testing import (  # noqa: E402
+    GateCase,
+    create_mock_client,
+    get_trace_spans,
+    run_gate_matrix,
+    stub_permission_allowed,
+    stub_permission_denied,
+    stub_relationship_ok,
+)
+from ory_argus.user_login import UserLoginDecision  # noqa: E402
+from ory_langchain import OryCallbackHandler, OryMiddleware  # noqa: E402
+
+
+@pytest.fixture(autouse=True)
+def _isolate(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    for var in ("ORY_PERMISSION_MODE", "ORY_PERMISSION_NAMESPACE", "ORY_INTERACTIVE_TOOLS"):
+        monkeypatch.delenv(var, raising=False)
+
+
+def make_request(name="search", args=None, call_id="call-1"):
+    return ToolCallRequest(
+        tool_call={"name": name, "args": args or {}, "id": call_id, "type": "tool_call"},
+        tool=None,
+        state={},
+        runtime=None,
+    )
+
+
+def make_middleware(client, **kw):
+    mw = OryMiddleware(client=client, **kw)
+    mw._session_started = True  # skip session gate network in unit tests
+    return mw
+
+
+def _handler_returns(msg):
+    def handler(request):
+        return msg
+
+    return handler
+
+
+def test_allow_extracts_tool_name_and_runs_handler():
+    client = create_mock_client()
+    client.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    stub_permission_allowed(client)
+    mw = make_middleware(client)
+
+    sentinel = ToolMessage(content="ok", tool_call_id="call-1")
+    out = mw.wrap_tool_call(make_request("search"), _handler_returns(sentinel))
+    assert out is sentinel
+    invoke = get_trace_spans(client, "tool.invoke")
+    assert invoke and invoke[0].attributes["allowed"] is True
+    # Tool name pulled from the ToolCallRequest's tool_call dict.
+    assert invoke[0].attributes["toolName"] == "search"
+    assert get_trace_spans(client, "tool.complete")
+
+
+def test_enforce_blocks_without_running_handler(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    client = create_mock_client()
+    client.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    stub_permission_denied(client)
+    mw = make_middleware(client)
+    ran = {}
+
+    def handler(request):
+        ran["yes"] = True
+        return ToolMessage(content="should not run", tool_call_id="call-9")
+
+    out = mw.wrap_tool_call(make_request("rm", call_id="call-9"), handler)
+    assert "yes" not in ran  # handler never invoked
+    # Native veto shape: an error ToolMessage carrying the original tool_call_id.
+    assert isinstance(out, ToolMessage)
+    assert out.status == "error"
+    assert out.tool_call_id == "call-9"
+    assert "permission denied" in out.content
+    block = get_trace_spans(client, "tool.block")[0]
+    assert block.attributes["blocked"] is True
+
+
+def test_gate_matrix():
+    """Full decision matrix, opted in via the core helper (reference for the pattern)."""
+
+    def make(client):
+        mw = make_middleware(client)
+        ran = {}
+
+        def handler(request):
+            ran["yes"] = True
+            return ToolMessage(content="ran", tool_call_id="call-1")
+
+        return GateCase(
+            invoke=lambda: mw.wrap_tool_call(make_request("target"), handler),
+            tool_ran=lambda: ran.get("yes", False),
+            vetoed=lambda out: isinstance(out, ToolMessage) and out.status == "error",
+        )
+
+    run_gate_matrix(make, harness="langchain")
+
+
+def test_interactive_tool_passes_through(monkeypatch):
+    monkeypatch.setenv("ORY_INTERACTIVE_TOOLS", "AskUser")
+    client = create_mock_client()
+    mw = make_middleware(client)
+    out = mw.wrap_tool_call(make_request("AskUser"), _handler_returns(ToolMessage(content="asked", tool_call_id="call-1")))
+    assert out.content == "asked"
+    assert get_trace_spans(client, "user.interaction")
+
+
+def test_session_start_runs_once():
+    client = create_mock_client()
+    stub_relationship_ok(client)
+    stub_permission_allowed(client)
+    calls = {"n": 0}
+
+    def fake_user_login(c, **kw):
+        calls["n"] += 1
+        c.set_user_principal(PrincipalIdentity(subject="user:alice", token="t"))
+        return UserLoginDecision(True, "ok", "ok", subject="user:alice")
+
+    def fake_agent_gate(c, **kw):
+        c.set_agent_principal(PrincipalIdentity(subject="agent:cid", token="a"))
+        return AgentCredentials(kind="dynamic", subject="agent:cid", token="a", reason="ok")
+
+    mw = OryMiddleware(client=client)  # session gate NOT pre-marked here
+    from ory_argus import adapters
+
+    orig = adapters.session_start
+    try:
+        adapters.session_start = lambda c, **kw: orig(c, user_login=fake_user_login, agent_gate=fake_agent_gate, **{k: v for k, v in kw.items() if k not in ("user_login", "agent_gate")})
+        # also patch the name imported into middleware module
+        import ory_langchain.middleware as m
+        m.session_start = adapters.session_start
+        r1 = mw.wrap_tool_call(make_request("search"), _handler_returns(ToolMessage(content="1", tool_call_id="c1")))
+        r2 = mw.wrap_tool_call(make_request("search"), _handler_returns(ToolMessage(content="2", tool_call_id="c2")))
+    finally:
+        adapters.session_start = orig
+        import ory_langchain.middleware as m
+        m.session_start = orig
+
+    assert r1.content == "1" and r2.content == "2"
+    assert calls["n"] == 1  # session gates ran exactly once
+    assert get_trace_spans(client, "relationship.create")
+
+
+def test_callback_handler_traces():
+    client = create_mock_client()
+    cb = OryCallbackHandler(client=client)
+    cb.on_tool_start({"name": "search"}, "query")
+    cb.on_tool_end("result")
+    invoke = get_trace_spans(client, "tool.invoke")[0]
+    assert invoke.attributes["source"] == "callback"
+    assert get_trace_spans(client, "tool.complete")

ory_langchain-0.13.9/tests/test_realsdk.py

@@ -0,0 +1,66 @@
+"""Real-SDK test: drive the middleware with a real LangChain ``ToolCallRequest``.
+
+LangChain is a dependency of this package and is installed in the workspace venv, so this
+runs in the normal suite too. Complements ``test_middleware.py`` (which builds the request by
+hand) by asserting the real ``ToolCallRequest`` shape extracts correctly and that a deny
+produces a real ``ToolMessage`` veto. The permission decision is stubbed (no backend).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+pytest.importorskip("langchain")
+
+from langchain_core.messages import ToolMessage  # noqa: E402
+from langgraph.prebuilt.tool_node import ToolCallRequest  # noqa: E402
+
+from ory_argus.adapters import GateResult  # noqa: E402
+from ory_argus.permissions import PermissionDecision  # noqa: E402
+from ory_argus.testing import create_mock_client  # noqa: E402
+from ory_langchain import OryMiddleware  # noqa: E402
+from ory_langchain import middleware as m  # noqa: E402
+
+
+def _request(name):
+    return ToolCallRequest(
+        tool_call={"name": name, "args": {"x": 1}, "id": "c", "type": "tool_call"},
+        tool=None, state={}, runtime=None,
+    )
+
+
+def _handler(_request):
+    return ToolMessage(content="RAN", tool_call_id="x")
+
+
+def _stub_gate(monkeypatch, *, blocked, captured=None):
+    monkeypatch.setattr(m, "session_start", lambda *a, **k: None)
+
+    def fake_gate(client, **kw):
+        if captured is not None:
+            captured["tool_name"] = kw.get("tool_name")
+        return GateResult(
+            proceed=not blocked, blocked=blocked,
+            decision=PermissionDecision(kind="deny" if blocked else "allow"),
+            subject="User:t", namespace="AgentTools",
+            denial_message="Ory: permission denied" if blocked else None,
+        )
+
+    monkeypatch.setattr(m, "gate", fake_gate)
+
+
+def test_real_request_extraction_and_deny(monkeypatch):
+    captured = {}
+    _stub_gate(monkeypatch, blocked=True, captured=captured)
+    mw = OryMiddleware(client=create_mock_client(harness="langchain"))
+    out = mw.wrap_tool_call(_request("MyRealTool"), _handler)
+    assert captured["tool_name"] == "MyRealTool"  # extracted from the real ToolCallRequest
+    assert isinstance(out, ToolMessage) and out.status == "error"
+    assert "permission denied" in out.content
+
+
+def test_real_request_runs_on_allow(monkeypatch):
+    _stub_gate(monkeypatch, blocked=False)
+    mw = OryMiddleware(client=create_mock_client(harness="langchain"))
+    out = mw.wrap_tool_call(_request("MyRealTool"), _handler)
+    assert isinstance(out, ToolMessage) and out.content == "RAN"