rasa-pro 3.13.12__py3-none-any.whl → 3.14.0__py3-none-any.whl

rasa/shared/agents/auth/auth_strategy/agent_auth_strategy.py

@@ -0,0 +1,52 @@
+from abc import ABC, abstractmethod
+from typing import Any, AsyncGenerator, Dict
+
+import httpx
+
+from rasa.shared.agents.auth.types import AgentAuthType
+from rasa.shared.utils.io import resolve_environment_variables
+
+
+class AgentAuthStrategy(ABC, httpx.Auth):
+    """Base class for authentication strategies."""
+
+    @classmethod
+    @abstractmethod
+    def from_config(cls, config: Dict[str, Any]) -> "AgentAuthStrategy":
+        """Create an authentication strategy instance from a config dictionary."""
+        ...
+
+    @property
+    @abstractmethod
+    def auth_type(self) -> AgentAuthType:
+        """Return the type of the authentication strategy."""
+        ...
+
+    @abstractmethod
+    async def get_headers(self) -> Dict[str, str]:
+        """Get authentication headers for requests.
+
+        Returns:
+            Dictionary containing authentication headers.
+        """
+        ...
+
+    async def async_auth_flow(
+        self, request: httpx.Request
+    ) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        """Get authentication headers for requests.
+
+        Returns:
+            Async generator of requests with authentication headers.
+        """
+        # Get authentication headers.
+        auth_headers = await self.get_headers()
+
+        # Resolve environment variables in authentication headers.
+        resolved_auth_headers = resolve_environment_variables(auth_headers)
+
+        # Update request headers with resolved authentication headers.
+        request.headers.update(resolved_auth_headers)
+
+        # Yield request with resolved authentication headers.
+        yield request

rasa/shared/agents/auth/auth_strategy/api_key_auth_strategy.py

@@ -0,0 +1,42 @@
+"""API Key authentication strategy implementation."""
+
+from typing import Any, Dict
+
+from rasa.shared.agents.auth.auth_strategy import AgentAuthStrategy
+from rasa.shared.agents.auth.constants import (
+    CONFIG_API_KEY_KEY,
+    CONFIG_HEADER_FORMAT_KEY,
+    CONFIG_HEADER_NAME_KEY,
+)
+from rasa.shared.agents.auth.types import AgentAuthType
+
+
+class APIKeyAuthStrategy(AgentAuthStrategy):
+    """API Key authentication strategy implementation."""
+
+    def __init__(
+        self,
+        api_key: str,
+        header_name: str = "Authorization",
+        header_format: str = "Bearer {key}",
+    ):
+        self.api_key = api_key
+        self.header_name = header_name
+        self.header_format = header_format
+
+    @classmethod
+    def from_config(cls, config: Dict[str, Any]) -> "APIKeyAuthStrategy":
+        api_key = config.get(CONFIG_API_KEY_KEY)
+        header_name = config.get(CONFIG_HEADER_NAME_KEY, "Authorization")
+        header_format = config.get(CONFIG_HEADER_FORMAT_KEY, "Bearer {key}")
+        if not api_key:
+            raise ValueError("API key is required for API KEY authentication")
+        return APIKeyAuthStrategy(api_key, header_name, header_format)
+
+    @property
+    def auth_type(self) -> AgentAuthType:
+        return AgentAuthType.API_KEY
+
+    async def get_headers(self) -> Dict[str, str]:
+        """Return API key authentication headers."""
+        return {self.header_name: self.header_format.format(key=self.api_key)}

rasa/shared/agents/auth/auth_strategy/bearer_token_auth_strategy.py

@@ -0,0 +1,28 @@
+"""Bearer Token authentication strategy implementation."""
+
+from typing import Any, Dict
+
+from rasa.shared.agents.auth.auth_strategy import AgentAuthStrategy
+from rasa.shared.agents.auth.constants import CONFIG_TOKEN_KEY
+from rasa.shared.agents.auth.types import AgentAuthType
+
+
+class BearerTokenAuthStrategy(AgentAuthStrategy):
+    """Bearer Token authentication strategy implementation."""
+
+    def __init__(self, token: str):
+        self._token = token
+
+    @classmethod
+    def from_config(cls, config: Dict[str, Any]) -> "BearerTokenAuthStrategy":
+        token = config.get(CONFIG_TOKEN_KEY)
+        if not token:
+            raise ValueError("Access token is required for Bearer Token authentication")
+        return BearerTokenAuthStrategy(token)
+
+    @property
+    def auth_type(self) -> AgentAuthType:
+        return AgentAuthType.BEARER_TOKEN
+
+    async def get_headers(self) -> Dict[str, str]:
+        return {"Authorization": f"Bearer {self._token}"}

rasa/shared/agents/auth/auth_strategy/oauth2_auth_strategy.py

@@ -0,0 +1,170 @@
+"""OAuth2 authentication strategy client credentials flow implementation."""
+
+import asyncio
+import time
+from typing import Any, AsyncGenerator, Dict, Optional
+
+import httpx
+
+from rasa.shared.agents.auth.auth_strategy import AgentAuthStrategy
+from rasa.shared.agents.auth.constants import (
+    CONFIG_AUDIENCE_KEY,
+    CONFIG_CLIENT_ID_KEY,
+    CONFIG_CLIENT_SECRET_KEY,
+    CONFIG_OAUTH_KEY,
+    CONFIG_SCOPE_KEY,
+    CONFIG_TIMEOUT_KEY,
+    CONFIG_TOKEN_URL_KEY,
+)
+from rasa.shared.agents.auth.types import AgentAuthType
+from rasa.shared.utils.io import resolve_environment_variables
+
+KEY_ACCESS_TOKEN = "access_token"
+KEY_CLIENT_CREDENTIALS = "client_credentials"
+KEY_EXPIRES_IN = "expires_in"
+
+
+class OAuth2AuthStrategy(AgentAuthStrategy):
+    """Client Credentials Flow authentication strategy."""
+
+    DEFAULT_ACCESS_TOKEN_TIMEOUT = 5
+    DEFAULT_ACCESS_TOKEN_EXPIRES_IN_SECONDS = 3600
+    DEFAULT_BUFFER_TIME_SECONDS = 10
+
+    def __init__(
+        self,
+        token_url: str,
+        client_id: str,
+        client_secret: str,
+        audience: Optional[str] = None,
+        scope: Optional[str] = None,
+        timeout: Optional[int] = None,
+    ):
+        self.token_url = token_url
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.audience = audience
+        self.scope = scope
+        self.timeout = timeout or self.DEFAULT_ACCESS_TOKEN_TIMEOUT
+
+        # Only client credentials flow is supported for server to server communication.
+        self._grant_type = KEY_CLIENT_CREDENTIALS
+
+        # Initialize defaults.
+        self._access_token: Optional[str] = None
+        self._expires_at: Optional[float] = None
+
+        # Initialize lock for concurrent access to the refresh the access token.
+        self._refresh_lock = asyncio.Lock()
+
+    @classmethod
+    def from_config(cls, config: Dict[str, Any]) -> "OAuth2AuthStrategy":
+        """Create OAuth2AuthStrategy from configuration dictionary."""
+        # Extract OAuth2 config from nested "oauth" key if present
+        oauth_config = config.get(CONFIG_OAUTH_KEY, config)
+        if not oauth_config:
+            raise ValueError("OAuth2 configuration is required")
+
+        token_url = oauth_config.get(CONFIG_TOKEN_URL_KEY)
+        client_id = oauth_config.get(CONFIG_CLIENT_ID_KEY)
+        client_secret = oauth_config.get(CONFIG_CLIENT_SECRET_KEY)
+        audience = oauth_config.get(CONFIG_AUDIENCE_KEY)
+        scope = oauth_config.get(CONFIG_SCOPE_KEY)
+        timeout = (
+            oauth_config.get(CONFIG_TIMEOUT_KEY) or cls.DEFAULT_ACCESS_TOKEN_TIMEOUT
+        )
+
+        if not token_url:
+            raise ValueError("Token URL is required for OAuth2 authentication")
+        if not client_id:
+            raise ValueError("Client ID is required for OAuth2 authentication")
+        if not client_secret:
+            raise ValueError("Client secret is required for OAuth2 authentication")
+
+        return cls(
+            token_url=token_url,
+            client_id=client_id,
+            client_secret=client_secret,
+            audience=audience,
+            scope=scope,
+            timeout=timeout,
+        )
+
+    @property
+    def auth_type(self) -> AgentAuthType:
+        return AgentAuthType.OAUTH2
+
+    async def get_headers(self) -> Dict[str, str]:
+        """Return OAuth2 authentication headers."""
+        # Acquire lock to prevent concurrent access to the refresh the access token.
+        async with self._refresh_lock:
+            # Refresh if missing or expired
+            if not self._access_token or self._is_expired():
+                await self._refresh_access_token()
+            if not self._access_token:
+                raise ValueError("Failed to obtain access token")
+        return {"Authorization": f"Bearer {self._access_token}"}
+
+    def _is_expired(self) -> bool:
+        """Check if access token is expired."""
+        # Adding a buffer time to the expiration time to avoid race conditions.
+        return (
+            not self._expires_at
+            or self._expires_at <= time.time() + self.DEFAULT_BUFFER_TIME_SECONDS
+        )
+
+    async def _refresh_access_token(self) -> None:
+        """Fetch a new access token using client credentials flow."""
+        # Prepare data and headers
+        headers = {"Content-Type": "application/x-www-form-urlencoded"}
+        data = {
+            "grant_type": self._grant_type,
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+        }
+        if self.scope:
+            data["scope"] = self.scope
+        if self.audience:
+            data["audience"] = self.audience
+
+        # Resolve environment variables in data.
+        resolved_data = resolve_environment_variables(data)
+
+        # Fetch access token
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                resp = await client.post(
+                    self.token_url, data=resolved_data, headers=headers
+                )
+                resp.raise_for_status()
+                token_data = resp.json()
+        except httpx.HTTPStatusError as e:
+            raise e
+        except httpx.RequestError as e:
+            raise ValueError(f"OAuth2 token request failed - {e}") from e
+        except Exception as e:
+            raise ValueError(
+                f"Unexpected error during OAuth2 token request - {e}"
+            ) from e
+
+        # Validate token data
+        if KEY_ACCESS_TOKEN not in token_data:
+            raise ValueError(f"No `{KEY_ACCESS_TOKEN}` in OAuth2 response")
+
+        # Set access token and expires at
+        self._access_token = token_data[KEY_ACCESS_TOKEN]
+        self._expires_at = time.time() + token_data.get(
+            KEY_EXPIRES_IN, self.DEFAULT_ACCESS_TOKEN_EXPIRES_IN_SECONDS
+        )
+
+    async def async_auth_flow(
+        self, request: httpx.Request
+    ) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        """Inject Authorization header into outgoing requests.
+
+        Returns:
+            Async generator of requests with Authorization header.
+        """
+        auth_headers = await self.get_headers()
+        request.headers.update(auth_headers)
+        yield request

rasa/shared/agents/auth/constants.py

@@ -0,0 +1,13 @@
+CONFIG_API_KEY_KEY = "api_key"
+CONFIG_TOKEN_KEY = "token"
+CONFIG_OAUTH_KEY = "oauth"
+CONFIG_HEADER_NAME_KEY = "header_name"
+CONFIG_HEADER_FORMAT_KEY = "header_format"
+CONFIG_CLIENT_ID_KEY = "client_id"
+CONFIG_CLIENT_SECRET_KEY = "client_secret"
+CONFIG_TOKEN_URL_KEY = "token_url"
+CONFIG_SCOPE_KEY = "scope"
+CONFIG_AUDIENCE_KEY = "audience"
+CONFIG_GRANT_TYPE_KEY = "grant_type"
+CONFIG_TIMEOUT_KEY = "timeout"
+CONFIG_MODULE_KEY = "module"

rasa/shared/agents/auth/types.py

@@ -0,0 +1,12 @@
+"""Fundamental types for authentication protocols."""
+
+from enum import Enum
+
+
+class AgentAuthType(Enum):
+    """An Enum class that represents the supported authentication protocol types."""
+
+    API_KEY = "api_key"
+    OAUTH2 = "oauth2"
+    BEARER_TOKEN = "bearer_token"
+    CUSTOM = "custom"

rasa/shared/agents/auth/utils.py

@@ -0,0 +1,85 @@
+"""Utilities for agent authentication and secret validation."""
+
+import re
+from typing import Any, Dict
+
+from rasa.exceptions import ValidationError
+from rasa.shared.agents.auth.constants import (
+    CONFIG_API_KEY_KEY,
+    CONFIG_CLIENT_SECRET_KEY,
+    CONFIG_OAUTH_KEY,
+    CONFIG_TOKEN_KEY,
+)
+from rasa.shared.constants import SECRET_DATA_FORMAT_PATTERN
+
+AUTH_SECRETS = [CONFIG_API_KEY_KEY, CONFIG_TOKEN_KEY, CONFIG_CLIENT_SECRET_KEY]
+
+
+def _is_valid_secret_data_format(value: str) -> bool:
+    """Check if a value is in the correct environment variable format.
+
+    Args:
+        value: The value to check
+
+    Returns:
+        True if the value is in format "${env_var}", False otherwise
+    """
+    if not isinstance(value, str):
+        return False
+
+    # Use the common regex pattern for environment variable validation
+    return bool(re.match(SECRET_DATA_FORMAT_PATTERN, value))
+
+
+def _validate_secret_value(value: Any, key: str, context: str) -> None:
+    """Generic function to validate a single secret value.
+
+    Args:
+        value: The value to validate
+        key: The key name for error messages
+        context: Context for error messages
+            (e.g., "agent 'my_agent'", "MCP server 'my_server'")
+    """
+    if isinstance(value, str):
+        if not _is_valid_secret_data_format(value):
+            raise ValidationError(
+                code="validation.sensitive_key_string_value_must_be_set_as_env_var",
+                event_info=(
+                    f"You defined the '{key}' in {context} as a string. The '{key}' "
+                    f"must be set as an environment variable. Please update your "
+                    f"config."
+                ),
+                key=key,
+            )
+    else:
+        raise ValidationError(
+            code="validation.sensitive_key_must_be_set_as_env_var",
+            event_info=(
+                f"You should define the '{key}' in {context} using the environment "
+                f"variable syntax - ${{ENV_VARIABLE_NAME}}. Please update your config."
+            ),
+            key=key,
+        )
+
+
+def validate_secrets_in_params(
+    params: Dict[str, Any], context_name: str = "configuration"
+) -> None:
+    """Validate that secrets in params are in environment variable format.
+
+    Args:
+        params: The parameters dictionary to validate
+        context_name: Name of the context for error messages
+            (e.g., "agent", "MCP server")
+    """
+    for key, value in params.items():
+        if key in AUTH_SECRETS:
+            _validate_secret_value(value, key, context_name)
+        elif key == CONFIG_OAUTH_KEY and isinstance(value, dict):
+            # Handle oauth object specifically - we know it contains client_secret
+            if CONFIG_CLIENT_SECRET_KEY in value:
+                _validate_secret_value(
+                    value[CONFIG_CLIENT_SECRET_KEY],
+                    CONFIG_CLIENT_SECRET_KEY,
+                    context_name,
+                )

rasa/shared/agents/utils.py

@@ -0,0 +1,35 @@
+from typing import Optional
+
+from rasa.agents.core.types import AgentIdentifier, ProtocolType
+from rasa.core.available_agents import AgentConfig, ProtocolConfig
+from rasa.shared.core.flows.steps import CallFlowStep
+
+
+def make_agent_identifier(
+    agent_name: str, protocol_type: ProtocolType
+) -> AgentIdentifier:
+    """Make an agent identifier."""
+    return AgentIdentifier(agent_name, protocol_type)
+
+
+def get_protocol_type(
+    step: CallFlowStep, agent_config: Optional[AgentConfig]
+) -> ProtocolType:
+    """Get the protocol type for an agent.
+
+    Args:
+        step: The step that is calling the agent.
+        agent_config: The agent configuration.
+
+    Returns:
+        The protocol type for the agent.
+    """
+    if step.exit_if:
+        protocol_type = ProtocolType.MCP_TASK
+    else:
+        protocol_type = (
+            ProtocolType.A2A
+            if agent_config and agent_config.agent.protocol == ProtocolConfig.A2A
+            else ProtocolType.MCP_OPEN
+        )
+    return protocol_type

rasa/shared/constants.py

@@ -249,6 +249,9 @@ _VALIDATE_ENVIRONMENT_MISSING_KEYS_KEY = "missing_keys"
 LLM_API_HEALTH_CHECK_ENV_VAR = "LLM_API_HEALTH_CHECK"
 LLM_API_HEALTH_CHECK_DEFAULT_VALUE = "false"
 
+MCP_API_HEALTH_CHECK_ENV_VAR = "MCP_API_HEALTH_CHECK"
+MCP_API_HEALTH_CHECK_DEFAULT_VALUE = "false"
+
 AWS_REGION_NAME_CONFIG_KEY = "aws_region_name"
 AWS_ACCESS_KEY_ID_CONFIG_KEY = "aws_access_key_id"
 AWS_SECRET_ACCESS_KEY_CONFIG_KEY = "aws_secret_access_key"
@@ -345,6 +348,8 @@ PAYLOAD = "payload"
 # Used for LLM command generation
 ROLE_USER = "user"
 ROLE_SYSTEM = "system"
+ROLE_ASSISTANT = "assistant"
+ROLE_TOOL = "tool"
 
 # Used for key values in ValidateSlotPatternFlowStackFrame
 REFILL_UTTER = "refill_utter"
@@ -359,3 +364,9 @@ FAQ_INPUT_DATA_QUESTION_LINE_PREFIX = "Q:"
 FAQ_INPUT_DATA_ANSWER_LINE_PREFIX = "A:"
 FAQ_DOCUMENT_ENTRY_SEPARATOR = "\n\n"
 FAQ_DOCUMENT_LINE_SEPARATOR = "\n"
+
+# Constants for the MCP server
+KEY_TOOL_CALLS = "tool_calls"
+
+# Regex pattern for secrets data validation
+SECRET_DATA_FORMAT_PATTERN = r"\${(\w+)}"

rasa/shared/core/constants.py

@@ -30,6 +30,7 @@ LOOP_NAME = "name"
 ACTION_LISTEN_NAME = "action_listen"
 ACTION_RESTART_NAME = "action_restart"
 ACTION_SEND_TEXT_NAME = "action_send_text"
+ACTION_AGENT_REQUEST_USER_INPUT_NAME = "action_agent_request_user_input"
 ACTION_SESSION_START_NAME = "action_session_start"
 ACTION_DEFAULT_FALLBACK_NAME = "action_default_fallback"
 ACTION_DEACTIVATE_LOOP_NAME = "action_deactivate_loop"
@@ -53,9 +54,17 @@ ACTION_RESET_ROUTING = "action_reset_routing"
 ACTION_HANGUP = "action_hangup"
 ACTION_REPEAT_BOT_MESSAGES = "action_repeat_bot_messages"
 
+# pattern continue interrupted flows
+ACTION_CONTINUE_INTERRUPTED_FLOW = "action_continue_interrupted_flow"
+ACTION_CANCEL_INTERRUPTED_FLOWS = "action_cancel_interrupted_flows"
+
+
 ACTION_METADATA_EXECUTION_SUCCESS = "execution_success"
 ACTION_METADATA_EXECUTION_ERROR_MESSAGE = "execution_error_message"
+ACTION_METADATA_EXECUTION_TIME = "execution_times"
 
+ACTION_METADATA_MESSAGE_KEY = "message"
+ACTION_METADATA_TEXT_KEY = "text"
 
 DEFAULT_ACTION_NAMES = [
     ACTION_LISTEN_NAME,
@@ -70,6 +79,7 @@ DEFAULT_ACTION_NAMES = [
     ACTION_UNLIKELY_INTENT_NAME,
     ACTION_BACK_NAME,
     ACTION_SEND_TEXT_NAME,
+    ACTION_AGENT_REQUEST_USER_INPUT_NAME,
     RULE_SNIPPET_ACTION_NAME,
     ACTION_EXTRACT_SLOTS,
     ACTION_CANCEL_FLOW,
@@ -82,6 +92,8 @@ DEFAULT_ACTION_NAMES = [
     ACTION_RESET_ROUTING,
     ACTION_HANGUP,
     ACTION_REPEAT_BOT_MESSAGES,
+    ACTION_CONTINUE_INTERRUPTED_FLOW,
+    ACTION_CANCEL_INTERRUPTED_FLOWS,
 ]
 
 ACTION_SHOULD_SEND_DOMAIN = "send_domain"
@@ -114,10 +126,11 @@ FLOW_SLOT_NAMES = [FLOW_HASHES_SLOT]
 
 # slots for audio timeout
 GLOBAL_SILENCE_TIMEOUT_KEY = "global_silence_timeout"
+SILENCE_TIMEOUT_CHANNEL_KEY = "silence_timeout"
 SILENCE_TIMEOUT_SLOT = "silence_timeout"
 SLOT_CONSECUTIVE_SILENCE_TIMEOUTS = "consecutive_silence_timeouts"
 GLOBAL_SILENCE_TIMEOUT_DEFAULT_VALUE = 7.0
-SILENCE_SLOTS = [SILENCE_TIMEOUT_SLOT, SLOT_CONSECUTIVE_SILENCE_TIMEOUTS]
+SILENCE_SLOTS = {SILENCE_TIMEOUT_SLOT, SLOT_CONSECUTIVE_SILENCE_TIMEOUTS}
 # slots for knowledge base
 SLOT_LISTED_ITEMS = "knowledge_base_listed_objects"
 SLOT_LAST_OBJECT = "knowledge_base_last_object"
@@ -136,6 +149,9 @@ DEFAULT_SLOT_NAMES = {
     FLOW_HASHES_SLOT,
 }
 
+SLOTS_EXCLUDED_FOR_AGENT = (
+    SILENCE_SLOTS | DEFAULT_SLOT_NAMES | KNOWLEDGE_BASE_SLOT_NAMES
+)
 
 SLOT_MAPPINGS = "mappings"
 MAPPING_CONDITIONS = "conditions"