rasa-pro 3.14.0.dev20250825__py3-none-any.whl → 3.14.0.dev20250922__py3-none-any.whl

rasa/core/iam_credentials_providers/aws_iam_credentials_providers.py

@@ -0,0 +1,226 @@
+import os
+import threading
+import time
+from typing import Optional, Tuple
+from urllib.parse import ParseResult, urlencode, urlunparse
+
+import boto3
+import redis
+import structlog
+from aws_msk_iam_sasl_signer import MSKAuthTokenProvider
+from botocore.exceptions import BotoCoreError
+from botocore.model import ServiceId
+from botocore.session import get_session
+from botocore.signers import RequestSigner
+from cachetools import TTLCache, cached
+
+from rasa.core.iam_credentials_providers.credentials_provider_protocol import (
+    IAMCredentialsProvider,
+    IAMCredentialsProviderInput,
+    SupportedServiceType,
+    TemporaryCredentials,
+)
+from rasa.shared.exceptions import ConnectionException
+
+structlogger = structlog.get_logger(__name__)
+
+
+class AWSRDSIAMCredentialsProvider(IAMCredentialsProvider):
+    """Generates temporary credentials for AWS RDS using IAM roles."""
+
+    def __init__(self, username: str, host: str, port: int) -> None:
+        """Initializes the provider."""
+        self.username = username
+        self.host = host
+        self.port = port
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS RDS."""
+        structlogger.debug(
+            "rasa.core.aws_rds_iam_credentials_provider.get_credentials",
+            event_info="IAM authentication for AWS RDS enabled. "
+            "Generating temporary auth token...",
+        )
+
+        try:
+            client = boto3.client("rds")
+            auth_token = client.generate_db_auth_token(
+                DBHostname=self.host,
+                Port=self.port,
+                DBUsername=self.username,
+            )
+            structlogger.info(
+                "rasa.core.aws_rds_iam_credentials_provider.generated_credentials",
+                event_info="Successfully generated temporary auth token for AWS RDS.",
+            )
+            return TemporaryCredentials(auth_token=auth_token)
+        except (BotoCoreError, ValueError) as exc:
+            structlogger.error(
+                "rasa.core.aws_rds_iam_credentials_provider.error_generating_credentials",
+                event_info="Failed to generate temporary auth token for AWS RDS.",
+                error=str(exc),
+            )
+            return TemporaryCredentials(auth_token=None)
+
+
+class AWSMSKafkaIAMCredentialsProvider(IAMCredentialsProvider):
+    """Generates temporary credentials for AWS MSK using IAM roles."""
+
+    def __init__(self) -> None:
+        self.region = os.getenv("AWS_DEFAULT_REGION", os.getenv("AWS_REGION"))
+        self._token: Optional[str] = None
+        self._expires_at: float = 0
+        self.refresh_margin_seconds = 60  # Refresh 60 seconds before expiry
+        # ensure thread safety when refreshing token because the
+        # kafka client library we use (confluent-kafka) is multithreaded
+        self.lock = threading.Lock()
+
+    @property
+    def token(self) -> Optional[str]:
+        return self._token
+
+    @token.setter
+    def token(self, value: str) -> None:
+        self._token = value
+
+    @property
+    def expires_at(self) -> float:
+        return self._expires_at
+
+    @expires_at.setter
+    def expires_at(self, value: float) -> None:
+        self._expires_at = value
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS MSK."""
+        with self.lock:
+            current_time = time.time()  # Current time in seconds
+            if (
+                not self.token
+                or current_time >= self.expires_at - self.refresh_margin_seconds
+            ):
+                try:
+                    auth_token, expiry_ms = MSKAuthTokenProvider.generate_auth_token(
+                        self.region
+                    )
+                    structlogger.debug(
+                        "rasa.core.aws_msk_iam_credentials_provider.get_credentials",
+                        event_info="Successfully generated AWS IAM token for "
+                        "Kafka authentication.",
+                    )
+                    self.token = auth_token
+                    self.expires_at = int(expiry_ms) / 1000  # Convert ms to seconds
+                    return TemporaryCredentials(
+                        auth_token=auth_token,
+                        expiration=self.expires_at,
+                    )
+                except Exception as exc:
+                    raise ConnectionException(
+                        f"Failed to generate AWS IAM token "
+                        f"for MSK authentication. Original exception: {exc}"
+                    ) from exc
+            else:
+                structlogger.debug(
+                    "rasa.core.aws_msk_iam_credentials_provider.get_credentials",
+                    event_info="Using cached AWS IAM token for Kafka authentication.",
+                )
+                return TemporaryCredentials(
+                    auth_token=self.token,
+                    expiration=self.expires_at,
+                )
+
+
+class AWSElasticacheRedisIAMCredentialsProvider(redis.CredentialProvider):
+    """Generates temporary credentials for AWS ElastiCache Redis using IAM roles."""
+
+    def __init__(self, username: str, cluster_name: Optional[str] = None) -> None:
+        """Initializes the provider."""
+        self.username = username
+        self.cluster_name = cluster_name
+        self.region = os.getenv("AWS_DEFAULT_REGION", os.getenv("AWS_REGION"))
+        self.session = get_session()
+        self.request_signer = RequestSigner(
+            ServiceId("elasticache"),
+            self.region,
+            "elasticache",
+            "v4",
+            self.session.get_credentials(),
+            self.session.get_component("event_emitter"),
+        )
+
+    # Generated IAM tokens are valid for 15 minutes
+    @cached(cache=TTLCache(maxsize=128, ttl=900))
+    def get_credentials(self) -> Tuple[str, str]:
+        """Generates temporary credentials for AWS ElastiCache Redis.
+
+        Required method implementation by redis-py CredentialProvider parent class.
+        Used internally by redis-py when connecting to Redis.
+        """
+        query_params = {"Action": "connect", "User": self.username}
+        url = urlunparse(
+            ParseResult(
+                scheme="https",
+                netloc=self.cluster_name,
+                path="/",
+                query=urlencode(query_params),
+                params="",
+                fragment="",
+            )
+        )
+        signed_url = self.request_signer.generate_presigned_url(
+            {"method": "GET", "url": url, "body": {}, "headers": {}, "context": {}},
+            operation_name="connect",
+            expires_in=900,
+            region_name=self.region,
+        )
+
+        # RequestSigner only seems to work if the URL has a protocol, but
+        # Elasticache only accepts the URL without a protocol
+        # So strip it off the signed URL before returning
+        return self.username, signed_url.removeprefix("https://")
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS ElastiCache Redis.
+
+        Implemented to comply with the IAMCredentialsProvider rasa-pro interface.
+        Calls the get_credentials method which is used internally by redis-py.
+        """
+        try:
+            username, signed_url = self.get_credentials()
+            structlogger.info(
+                "rasa.core.aws_elasticache_redis_iam_credentials_provider.generated_credentials",
+                event_info="Successfully generated temporary credentials for "
+                "AWS ElastiCache Redis.",
+            )
+            return TemporaryCredentials(username=username, presigned_url=signed_url)
+        except Exception as exc:
+            structlogger.error(
+                "rasa.core.aws_elasticache_redis_iam_credentials_provider.error_generating_credentials",
+                event_info="Failed to generate temporary credentials for "
+                "AWS ElastiCache Redis.",
+                error=str(exc),
+            )
+            return TemporaryCredentials()
+
+
+def create_aws_iam_credentials_provider(
+    provider_input: "IAMCredentialsProviderInput",
+) -> Optional["IAMCredentialsProvider"]:
+    """Factory function to create an AWS IAM credentials provider."""
+    if provider_input.service_name == SupportedServiceType.TRACKER_STORE:
+        return AWSRDSIAMCredentialsProvider(
+            username=provider_input.username,
+            host=provider_input.host,
+            port=provider_input.port,
+        )
+
+    if provider_input.service_name == SupportedServiceType.EVENT_BROKER:
+        return AWSMSKafkaIAMCredentialsProvider()
+
+    if provider_input.service_name == SupportedServiceType.LOCK_STORE:
+        return AWSElasticacheRedisIAMCredentialsProvider(
+            username=provider_input.username,
+            cluster_name=provider_input.cluster_name,
+        )
+
+    return None

rasa/core/iam_credentials_providers/credentials_provider_protocol.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import os
+from enum import Enum
+from typing import Optional, Protocol, runtime_checkable
+
+import structlog
+from pydantic import BaseModel
+
+from rasa.core.constants import IAM_CLOUD_PROVIDER_ENV_VAR_NAME
+
+structlogger = structlog.get_logger(__name__)
+
+
+class TemporaryCredentials(BaseModel):
+    """Dataclass storing temporary credentials."""
+
+    auth_token: Optional[str] = None
+    expiration: Optional[float] = None
+    username: Optional[str] = None
+    presigned_url: Optional[str] = None
+
+
+@runtime_checkable
+class IAMCredentialsProvider(Protocol):
+    """Interface for generating temporary credentials using IAM roles."""
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials using IAM roles."""
+        ...
+
+
+class IAMCredentialsProviderType(Enum):
+    """Enum for supported IAM credentials provider types."""
+
+    AWS = "aws"
+
+
+class SupportedServiceType(Enum):
+    """Enum for supported services using IAM credentials providers."""
+
+    TRACKER_STORE = "tracker_store"
+    EVENT_BROKER = "event_broker"
+    LOCK_STORE = "lock_store"
+
+
+class IAMCredentialsProviderInput(BaseModel):
+    """Input data for creating an IAM credentials provider."""
+
+    service_name: SupportedServiceType
+    username: Optional[str] = None
+    host: Optional[str] = None
+    port: Optional[int] = None
+    cluster_name: Optional[str] = None
+
+
+def create_iam_credentials_provider(
+    provider_input: IAMCredentialsProviderInput,
+) -> Optional[IAMCredentialsProvider]:
+    """Factory function to create an IAM credentials provider.
+
+    Args:
+        provider_input: Input data for creating an IAM credentials provider.
+
+    Returns:
+        An instance of the specified IAM credentials provider or
+        None if the type is unsupported.
+    """
+    iam_cloud_provider = os.getenv(IAM_CLOUD_PROVIDER_ENV_VAR_NAME)
+
+    if iam_cloud_provider is None:
+        return None
+
+    try:
+        provider_type = IAMCredentialsProviderType(iam_cloud_provider.lower())
+    except ValueError:
+        structlogger.warning(
+            "rasa.core.iam_credentials_provider.create_iam_credentials_provider.unsupported_provider",
+            event_info=f"Unsupported IAM cloud provider: {iam_cloud_provider}",
+        )
+        return None
+
+    if provider_type == IAMCredentialsProviderType.AWS:
+        from rasa.core.iam_credentials_providers.aws_iam_credentials_providers import (
+            create_aws_iam_credentials_provider,
+        )
+
+        return create_aws_iam_credentials_provider(provider_input)
+
+    return None

rasa/core/lock_store.py

@@ -4,7 +4,7 @@ import asyncio
 import json
 import os
 from contextlib import asynccontextmanager
-from typing import Any, AsyncGenerator, Dict, Literal, Optional, Text, Union
+from typing import Any, AsyncGenerator, Dict, List, Literal, Optional, Text, Union
 
 import structlog
 from pydantic import (
@@ -12,12 +12,18 @@ from pydantic import (
     BaseModel,
     Field,
     NonNegativeInt,
+    ValidationError,
     model_validator,
 )
 
 import rasa.shared.utils.common
-from rasa.core.constants import DEFAULT_LOCK_LIFETIME
+from rasa.core.constants import DEFAULT_LOCK_LIFETIME, IAM_CLOUD_PROVIDER_ENV_VAR_NAME
 from rasa.core.lock import TicketLock
+from rasa.core.redis_connection_factory import (
+    DeploymentMode,
+    RedisConfig,
+    RedisConnectionFactory,
+)
 from rasa.shared.exceptions import ConnectionException, RasaException
 from rasa.shared.utils.io import raise_deprecation_warning
 from rasa.utils.endpoints import EndpointConfig
@@ -221,7 +227,7 @@ class LockStore:
 
 
 class RedisLockStoreConfig(BaseModel):
-    host: Union[AnyUrl, Literal["localhost"]] = Field(
+    host: Union[AnyUrl, Literal["localhost"], str] = Field(
         default="localhost", description="The host of the redis server."
     )
     port: NonNegativeInt = Field(
@@ -269,6 +275,18 @@ class RedisLockStoreConfig(BaseModel):
         "will be raised in case Redis doesn't respond "
         "within `socket_timeout` seconds.",
     )
+    deployment_mode: DeploymentMode = Field(
+        default=DeploymentMode.STANDARD,
+        description="Redis deployment mode: 'standard', 'cluster', or 'sentinel'",
+    )
+    endpoints: Optional[List[str]] = Field(
+        default=None,
+        description="List of endpoints for cluster/sentinel mode in 'host:port' format",
+    )
+    sentinel_service: Optional[str] = Field(
+        default=None,
+        description="Sentinel service name",
+    )
 
     @model_validator(mode="before")
     @classmethod
@@ -290,7 +308,9 @@ class RedisLockStoreConfig(BaseModel):
 
     @model_validator(mode="after")
     def verify_username_password(self) -> RedisLockStoreConfig:
-        if bool(self.username) ^ bool(self.password):
+        if os.getenv(IAM_CLOUD_PROVIDER_ENV_VAR_NAME) is None and (
+            bool(self.username) ^ bool(self.password)
+        ):
             raise ValueError(
                 f"Expected username and password. "
                 f"Found: username: {'<has value>' if self.username else '<N/A>'}, "
@@ -298,9 +318,6 @@ class RedisLockStoreConfig(BaseModel):
             )
         return self
 
-    def to_strict_redis(self) -> Dict[str, Any]:
-        return self.model_dump(by_alias=True, exclude={"key_prefix"})
-
 
 class RedisLockStore(LockStore):
     """Redis store for ticket locks."""
@@ -314,10 +331,26 @@ class RedisLockStore(LockStore):
         Args:
             config: Redis lock store configuration.
         """
-        import redis
-
         self.config = config
-        self.red = redis.StrictRedis(**self.config.to_strict_redis())
+        try:
+            redis_config = RedisConfig(
+                host=str(self.config.host),
+                port=self.config.port,
+                db=self.config.db,
+                username=self.config.username,
+                password=self.config.password,
+                use_ssl=self.config.use_ssl,
+                ssl_keyfile=self.config.ssl_keyfile,
+                ssl_certfile=self.config.ssl_certfile,
+                ssl_ca_certs=self.config.ssl_ca_certs,
+                deployment_mode=self.config.deployment_mode.value,
+                endpoints=self.config.endpoints,
+                sentinel_service=self.config.sentinel_service,
+                socket_timeout=self.config.socket_timeout,
+            )
+            self.red = RedisConnectionFactory.create_connection(redis_config)
+        except ValidationError as e:
+            raise RasaException(f"Invalid Redis configuration: {e}")
 
         self.key_prefix = DEFAULT_REDIS_LOCK_STORE_KEY_PREFIX
         if self.config.key_prefix:
@@ -349,6 +382,9 @@ class RedisLockStore(LockStore):
         """Retrieves lock (see parent docstring for more information)."""
         serialised_lock = self.red.get(self.key_prefix + conversation_id)
         if serialised_lock:
+            # Handle bytes to string conversion for JSON parsing
+            if isinstance(serialised_lock, bytes):
+                serialised_lock = serialised_lock.decode("utf-8")
             return TicketLock.from_dict(json.loads(serialised_lock))
 
         return None

rasa/core/nlg/generator.py

@@ -2,7 +2,6 @@ from typing import Any, Dict, List, Optional, Text, Union
 
 import structlog
 from jinja2 import Template
-from pypred import Predicate
 
 import rasa.shared.utils.common
 import rasa.shared.utils.io
@@ -12,6 +11,7 @@ from rasa.shared.constants import CHANNEL, RESPONSE_CONDITION
 from rasa.shared.core.domain import Domain
 from rasa.shared.core.trackers import DialogueStateTracker
 from rasa.utils.endpoints import EndpointConfig
+from rasa.utils.pypred import Predicate
 
 structlogger = structlog.get_logger()
 

rasa/core/policies/enterprise_search_policy.py

@@ -781,7 +781,7 @@ class EnterpriseSearchPolicy(LLMHealthCheckMixin, EmbeddingsHealthCheckMixin, Po
         if not os.path.exists(docs_folder) or not os.path.isdir(docs_folder):
             error_message = (
                 f"Document source directory does not exist or is not a "
-                f"directory: '{docs_folder}'. "
+                f"directory: '{os.path.abspath(docs_folder)}'. "
                 "Please specify a valid path to the documents source directory in the "
                 "vector_store configuration."
             )
@@ -1130,8 +1130,7 @@ class EnterpriseSearchPolicy(LLMHealthCheckMixin, EmbeddingsHealthCheckMixin, Po
         embeddings_config: Dict[Text, Any],
         log_source_method: str,
     ) -> None:
-        """
-        Perform the health checks using resolved LLM and embeddings configurations.
+        """Perform the health checks using resolved LLM and embeddings configurations.
         Resolved means the configuration is either:
         - A reference to a model group that has already been expanded into
           its corresponding configuration using the information from
@@ -1160,8 +1159,7 @@ class EnterpriseSearchPolicy(LLMHealthCheckMixin, EmbeddingsHealthCheckMixin, Po
 
     @classmethod
     def get_system_default_prompt_based_on_config(cls, config: Dict[str, Any]) -> str:
-        """
-        Resolves the default prompt template for Enterprise Search Policy based on
+        """Resolves the default prompt template for Enterprise Search Policy based on
         the component's configuration.
 
         - The old prompt is selected when both citation and relevancy check are either
@@ -1192,8 +1190,7 @@ class EnterpriseSearchPolicy(LLMHealthCheckMixin, EmbeddingsHealthCheckMixin, Po
         relevancy_check_enabled: bool,
         citation_enabled: bool,
     ) -> str:
-        """
-        Returns the appropriate default prompt template based on the feature flags.
+        """Returns the appropriate default prompt template based on the feature flags.
 
         The selection follows this priority:
         1. If relevancy check is enabled, return the prompt that includes both relevancy

rasa/core/policies/flows/flow_executor.py

@@ -4,7 +4,6 @@ from typing import Any, Dict, List, Optional, Text
 
 import structlog
 from jinja2 import Template
-from pypred import Predicate
 from structlog.contextvars import (
     bound_contextvars,
 )
@@ -92,6 +91,7 @@ from rasa.shared.core.slots import Slot, SlotRejection
 from rasa.shared.core.trackers import (
     DialogueStateTracker,
 )
+from rasa.utils.pypred import Predicate
 
 structlogger = structlog.get_logger()
 
@@ -740,7 +740,14 @@ def _run_action_step(
             # do not log about non-existing validation actions of collect steps
             utter_action_name = render_template_variables("{{context.utter}}", context)
             if utter_action_name not in available_actions:
-                structlogger.warning("flow.step.run.action.unknown", action=action_name)
+                structlogger.warning(
+                    "flow.step.run.action.unknown",
+                    action=action_name,
+                    event_info=(
+                        f"The action '{action_name}' is not defined in the domain but "
+                        f"getting triggered by the flow '{step.flow_id}'."
+                    ),
+                )
         return ContinueFlowWithNextStep(events=initial_events)
 
 

rasa/core/processor.py

@@ -72,6 +72,7 @@ from rasa.shared.core.constants import (
     ACTION_CORRECT_FLOW_SLOT,
     ACTION_EXTRACT_SLOTS,
     ACTION_LISTEN_NAME,
+    ACTION_METADATA_EXECUTION_TIME,
     ACTION_SESSION_START_NAME,
     FOLLOWUP_ACTION,
     SESSION_START_METADATA_SLOT,
@@ -207,6 +208,7 @@ class MessageProcessor:
     ) -> Optional[List[Dict[Text, Any]]]:
         """Handle a single message with this processor."""
         # preprocess message if necessary
+        self.time_turn_start = time.time()
         tracker = await self.log_message(message, should_save_tracker=False)
 
         if self.model_metadata.training_type == TrainingType.NLU:
@@ -1154,6 +1156,7 @@ class MessageProcessor:
         should_predict_another_action = True
 
         tracker = await self.run_command_processor(tracker)
+        self.time_command_processor = time.time()
 
         # action loop. predicts actions until we hit action listen
         while should_predict_another_action and self._should_handle_message(tracker):
@@ -1403,6 +1406,34 @@ class MessageProcessor:
         plugin_manager().hook.after_action_executed(tracker=tracker)
         return self.should_predict_another_action(action.name())
 
+    def _add_metadata_if_action_listen(
+        self, action: Action, prediction: PolicyPrediction
+    ) -> None:
+        """Adds execution times to the ActionExecuted event metadata."""
+        if not hasattr(self, "time_turn_start"):
+            return
+
+        if not hasattr(self, "time_command_processor"):
+            return
+
+        if not action.name() == ACTION_LISTEN_NAME:
+            return
+
+        if prediction.action_metadata is None:
+            prediction.action_metadata = {}
+
+        # calculate execution times
+        execution_time_prediction_loop = (
+            time.time() - self.time_command_processor
+        ) * 1000
+        execution_time_command_processor = (
+            self.time_command_processor - self.time_turn_start
+        ) * 1000
+        prediction.action_metadata[ACTION_METADATA_EXECUTION_TIME] = {
+            "command_processor": execution_time_command_processor,
+            "prediction_loop": execution_time_prediction_loop,
+        }
+
     def _log_action_and_events_on_tracker(
         self,
         tracker: DialogueStateTracker,
@@ -1448,6 +1479,7 @@ class MessageProcessor:
         tracker.update_with_events(prediction.events)
 
         # log the action and its produced events
+        self._add_metadata_if_action_listen(action, prediction)
         tracker.update(
             action.event_for_successful_execution(
                 prediction, was_successful, error_message