rasa-pro 3.14.0.dev20250901__py3-none-any.whl → 3.14.0rc1__py3-none-any.whl

rasa/core/config/message_procesing_config.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Dict, List
+
+from rasa.shared.utils.yaml import read_config_file
+
+
+class MessageProcessingConfig:
+    def __init__(
+        self,
+        recipe: str,
+        language: str,
+        assistant_id: str,
+        pipeline: List[Dict[str, Any]],
+        policies: List[Dict[str, Any]],
+    ):
+        self.recipe = recipe
+        self.language = language
+        self.assistant_id = assistant_id
+        self.pipeline = pipeline
+        self.policies = policies
+
+    @classmethod
+    def load_from_file(cls, filepath: Path) -> MessageProcessingConfig:
+        credentials_dict = read_config_file(filepath)
+
+        recipe = credentials_dict.get("recipe", "")
+        language = credentials_dict.get("language", "")
+        assistant_id = credentials_dict.get("assistant_id", "")
+        pipeline = credentials_dict.get("pipeline", [])
+        policies = credentials_dict.get("policies", [])
+
+        return cls(recipe, language, assistant_id, pipeline, policies)

rasa/core/constants.py

@@ -31,6 +31,10 @@ BEARER_TOKEN_PREFIX = "Bearer "
 # The lowest priority is intended to be used by machine learning policies.
 DEFAULT_POLICY_PRIORITY = 1
 
+DEFAULT_SUB_AGENTS = "sub_agents"
+
+MCP_SERVERS_KEY = "mcp_servers"
+
 # The priority of intent-prediction policies.
 # This should be below all rule based policies but higher than ML
 # based policies. This enables a loop inside ensemble where if none
@@ -112,3 +116,10 @@ ACTIVE_FLOW_METADATA_KEY = "active_flow"
 STEP_ID_METADATA_KEY = "step_id"
 KEY_IS_CALM_SYSTEM = "is_calm_system"
 KEY_IS_COEXISTENCE_ASSISTANT = "is_coexistence_assistant"
+
+IAM_CLOUD_PROVIDER_ENV_VAR_NAME = "IAM_CLOUD_PROVIDER"
+SQL_TRACKER_STORE_SSL_MODE_ENV_VAR_NAME = "SQL_TRACKER_STORE_SSL_MODE"
+SQL_TRACKER_STORE_SSL_ROOT_CERTIFICATE_ENV_VAR_NAME = (
+    "SQL_TRACKER_STORE_SSL_ROOT_CERTIFICATE"
+)
+AWS_ELASTICACHE_CLUSTER_NAME_ENV_VAR_NAME = "AWS_ELASTICACHE_CLUSTER_NAME"

rasa/core/iam_credentials_providers/aws_iam_credentials_providers.py

@@ -0,0 +1,226 @@
+import os
+import threading
+import time
+from typing import Optional, Tuple
+from urllib.parse import ParseResult, urlencode, urlunparse
+
+import boto3
+import redis
+import structlog
+from aws_msk_iam_sasl_signer import MSKAuthTokenProvider
+from botocore.exceptions import BotoCoreError
+from botocore.model import ServiceId
+from botocore.session import get_session
+from botocore.signers import RequestSigner
+from cachetools import TTLCache, cached
+
+from rasa.core.iam_credentials_providers.credentials_provider_protocol import (
+    IAMCredentialsProvider,
+    IAMCredentialsProviderInput,
+    SupportedServiceType,
+    TemporaryCredentials,
+)
+from rasa.shared.exceptions import ConnectionException
+
+structlogger = structlog.get_logger(__name__)
+
+
+class AWSRDSIAMCredentialsProvider(IAMCredentialsProvider):
+    """Generates temporary credentials for AWS RDS using IAM roles."""
+
+    def __init__(self, username: str, host: str, port: int) -> None:
+        """Initializes the provider."""
+        self.username = username
+        self.host = host
+        self.port = port
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS RDS."""
+        structlogger.debug(
+            "rasa.core.aws_rds_iam_credentials_provider.get_credentials",
+            event_info="IAM authentication for AWS RDS enabled. "
+            "Generating temporary auth token...",
+        )
+
+        try:
+            client = boto3.client("rds")
+            auth_token = client.generate_db_auth_token(
+                DBHostname=self.host,
+                Port=self.port,
+                DBUsername=self.username,
+            )
+            structlogger.info(
+                "rasa.core.aws_rds_iam_credentials_provider.generated_credentials",
+                event_info="Successfully generated temporary auth token for AWS RDS.",
+            )
+            return TemporaryCredentials(auth_token=auth_token)
+        except (BotoCoreError, ValueError) as exc:
+            structlogger.error(
+                "rasa.core.aws_rds_iam_credentials_provider.error_generating_credentials",
+                event_info="Failed to generate temporary auth token for AWS RDS.",
+                error=str(exc),
+            )
+            return TemporaryCredentials(auth_token=None)
+
+
+class AWSMSKafkaIAMCredentialsProvider(IAMCredentialsProvider):
+    """Generates temporary credentials for AWS MSK using IAM roles."""
+
+    def __init__(self) -> None:
+        self.region = os.getenv("AWS_DEFAULT_REGION", os.getenv("AWS_REGION"))
+        self._token: Optional[str] = None
+        self._expires_at: float = 0
+        self.refresh_margin_seconds = 60  # Refresh 60 seconds before expiry
+        # ensure thread safety when refreshing token because the
+        # kafka client library we use (confluent-kafka) is multithreaded
+        self.lock = threading.Lock()
+
+    @property
+    def token(self) -> Optional[str]:
+        return self._token
+
+    @token.setter
+    def token(self, value: str) -> None:
+        self._token = value
+
+    @property
+    def expires_at(self) -> float:
+        return self._expires_at
+
+    @expires_at.setter
+    def expires_at(self, value: float) -> None:
+        self._expires_at = value
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS MSK."""
+        with self.lock:
+            current_time = time.time()  # Current time in seconds
+            if (
+                not self.token
+                or current_time >= self.expires_at - self.refresh_margin_seconds
+            ):
+                try:
+                    auth_token, expiry_ms = MSKAuthTokenProvider.generate_auth_token(
+                        self.region
+                    )
+                    structlogger.debug(
+                        "rasa.core.aws_msk_iam_credentials_provider.get_credentials",
+                        event_info="Successfully generated AWS IAM token for "
+                        "Kafka authentication.",
+                    )
+                    self.token = auth_token
+                    self.expires_at = int(expiry_ms) / 1000  # Convert ms to seconds
+                    return TemporaryCredentials(
+                        auth_token=auth_token,
+                        expiration=self.expires_at,
+                    )
+                except Exception as exc:
+                    raise ConnectionException(
+                        f"Failed to generate AWS IAM token "
+                        f"for MSK authentication. Original exception: {exc}"
+                    ) from exc
+            else:
+                structlogger.debug(
+                    "rasa.core.aws_msk_iam_credentials_provider.get_credentials",
+                    event_info="Using cached AWS IAM token for Kafka authentication.",
+                )
+                return TemporaryCredentials(
+                    auth_token=self.token,
+                    expiration=self.expires_at,
+                )
+
+
+class AWSElasticacheRedisIAMCredentialsProvider(redis.CredentialProvider):
+    """Generates temporary credentials for AWS ElastiCache Redis using IAM roles."""
+
+    def __init__(self, username: str, cluster_name: Optional[str] = None) -> None:
+        """Initializes the provider."""
+        self.username = username
+        self.cluster_name = cluster_name
+        self.region = os.getenv("AWS_DEFAULT_REGION", os.getenv("AWS_REGION"))
+        self.session = get_session()
+        self.request_signer = RequestSigner(
+            ServiceId("elasticache"),
+            self.region,
+            "elasticache",
+            "v4",
+            self.session.get_credentials(),
+            self.session.get_component("event_emitter"),
+        )
+
+    # Generated IAM tokens are valid for 15 minutes
+    @cached(cache=TTLCache(maxsize=128, ttl=900))
+    def get_credentials(self) -> Tuple[str, str]:
+        """Generates temporary credentials for AWS ElastiCache Redis.
+
+        Required method implementation by redis-py CredentialProvider parent class.
+        Used internally by redis-py when connecting to Redis.
+        """
+        query_params = {"Action": "connect", "User": self.username}
+        url = urlunparse(
+            ParseResult(
+                scheme="https",
+                netloc=self.cluster_name,
+                path="/",
+                query=urlencode(query_params),
+                params="",
+                fragment="",
+            )
+        )
+        signed_url = self.request_signer.generate_presigned_url(
+            {"method": "GET", "url": url, "body": {}, "headers": {}, "context": {}},
+            operation_name="connect",
+            expires_in=900,
+            region_name=self.region,
+        )
+
+        # RequestSigner only seems to work if the URL has a protocol, but
+        # Elasticache only accepts the URL without a protocol
+        # So strip it off the signed URL before returning
+        return self.username, signed_url.removeprefix("https://")
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials for AWS ElastiCache Redis.
+
+        Implemented to comply with the IAMCredentialsProvider rasa-pro interface.
+        Calls the get_credentials method which is used internally by redis-py.
+        """
+        try:
+            username, signed_url = self.get_credentials()
+            structlogger.info(
+                "rasa.core.aws_elasticache_redis_iam_credentials_provider.generated_credentials",
+                event_info="Successfully generated temporary credentials for "
+                "AWS ElastiCache Redis.",
+            )
+            return TemporaryCredentials(username=username, presigned_url=signed_url)
+        except Exception as exc:
+            structlogger.error(
+                "rasa.core.aws_elasticache_redis_iam_credentials_provider.error_generating_credentials",
+                event_info="Failed to generate temporary credentials for "
+                "AWS ElastiCache Redis.",
+                error=str(exc),
+            )
+            return TemporaryCredentials()
+
+
+def create_aws_iam_credentials_provider(
+    provider_input: "IAMCredentialsProviderInput",
+) -> Optional["IAMCredentialsProvider"]:
+    """Factory function to create an AWS IAM credentials provider."""
+    if provider_input.service_name == SupportedServiceType.TRACKER_STORE:
+        return AWSRDSIAMCredentialsProvider(
+            username=provider_input.username,
+            host=provider_input.host,
+            port=provider_input.port,
+        )
+
+    if provider_input.service_name == SupportedServiceType.EVENT_BROKER:
+        return AWSMSKafkaIAMCredentialsProvider()
+
+    if provider_input.service_name == SupportedServiceType.LOCK_STORE:
+        return AWSElasticacheRedisIAMCredentialsProvider(
+            username=provider_input.username,
+            cluster_name=provider_input.cluster_name,
+        )
+
+    return None

rasa/core/iam_credentials_providers/credentials_provider_protocol.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import os
+from enum import Enum
+from typing import Optional, Protocol, runtime_checkable
+
+import structlog
+from pydantic import BaseModel
+
+from rasa.core.constants import IAM_CLOUD_PROVIDER_ENV_VAR_NAME
+
+structlogger = structlog.get_logger(__name__)
+
+
+class TemporaryCredentials(BaseModel):
+    """Dataclass storing temporary credentials."""
+
+    auth_token: Optional[str] = None
+    expiration: Optional[float] = None
+    username: Optional[str] = None
+    presigned_url: Optional[str] = None
+
+
+@runtime_checkable
+class IAMCredentialsProvider(Protocol):
+    """Interface for generating temporary credentials using IAM roles."""
+
+    def get_temporary_credentials(self) -> TemporaryCredentials:
+        """Generates temporary credentials using IAM roles."""
+        ...
+
+
+class IAMCredentialsProviderType(Enum):
+    """Enum for supported IAM credentials provider types."""
+
+    AWS = "aws"
+
+
+class SupportedServiceType(Enum):
+    """Enum for supported services using IAM credentials providers."""
+
+    TRACKER_STORE = "tracker_store"
+    EVENT_BROKER = "event_broker"
+    LOCK_STORE = "lock_store"
+
+
+class IAMCredentialsProviderInput(BaseModel):
+    """Input data for creating an IAM credentials provider."""
+
+    service_name: SupportedServiceType
+    username: Optional[str] = None
+    host: Optional[str] = None
+    port: Optional[int] = None
+    cluster_name: Optional[str] = None
+
+
+def create_iam_credentials_provider(
+    provider_input: IAMCredentialsProviderInput,
+) -> Optional[IAMCredentialsProvider]:
+    """Factory function to create an IAM credentials provider.
+
+    Args:
+        provider_input: Input data for creating an IAM credentials provider.
+
+    Returns:
+        An instance of the specified IAM credentials provider or
+        None if the type is unsupported.
+    """
+    iam_cloud_provider = os.getenv(IAM_CLOUD_PROVIDER_ENV_VAR_NAME)
+
+    if iam_cloud_provider is None:
+        return None
+
+    try:
+        provider_type = IAMCredentialsProviderType(iam_cloud_provider.lower())
+    except ValueError:
+        structlogger.warning(
+            "rasa.core.iam_credentials_provider.create_iam_credentials_provider.unsupported_provider",
+            event_info=f"Unsupported IAM cloud provider: {iam_cloud_provider}",
+        )
+        return None
+
+    if provider_type == IAMCredentialsProviderType.AWS:
+        from rasa.core.iam_credentials_providers.aws_iam_credentials_providers import (
+            create_aws_iam_credentials_provider,
+        )
+
+        return create_aws_iam_credentials_provider(provider_input)
+
+    return None

rasa/core/lock_store.py

@@ -4,7 +4,7 @@ import asyncio
 import json
 import os
 from contextlib import asynccontextmanager
-from typing import Any, AsyncGenerator, Dict, Literal, Optional, Text, Union
+from typing import Any, AsyncGenerator, Dict, List, Literal, Optional, Text, Union
 
 import structlog
 from pydantic import (
@@ -12,12 +12,18 @@ from pydantic import (
     BaseModel,
     Field,
     NonNegativeInt,
+    ValidationError,
     model_validator,
 )
 
 import rasa.shared.utils.common
-from rasa.core.constants import DEFAULT_LOCK_LIFETIME
+from rasa.core.constants import DEFAULT_LOCK_LIFETIME, IAM_CLOUD_PROVIDER_ENV_VAR_NAME
 from rasa.core.lock import TicketLock
+from rasa.core.redis_connection_factory import (
+    DeploymentMode,
+    RedisConfig,
+    RedisConnectionFactory,
+)
 from rasa.shared.exceptions import ConnectionException, RasaException
 from rasa.shared.utils.io import raise_deprecation_warning
 from rasa.utils.endpoints import EndpointConfig
@@ -221,7 +227,7 @@ class LockStore:
 
 
 class RedisLockStoreConfig(BaseModel):
-    host: Union[AnyUrl, Literal["localhost"]] = Field(
+    host: Union[AnyUrl, Literal["localhost"], str] = Field(
         default="localhost", description="The host of the redis server."
     )
     port: NonNegativeInt = Field(
@@ -269,6 +275,18 @@ class RedisLockStoreConfig(BaseModel):
         "will be raised in case Redis doesn't respond "
         "within `socket_timeout` seconds.",
     )
+    deployment_mode: DeploymentMode = Field(
+        default=DeploymentMode.STANDARD,
+        description="Redis deployment mode: 'standard', 'cluster', or 'sentinel'",
+    )
+    endpoints: Optional[List[str]] = Field(
+        default=None,
+        description="List of endpoints for cluster/sentinel mode in 'host:port' format",
+    )
+    sentinel_service: Optional[str] = Field(
+        default=None,
+        description="Sentinel service name",
+    )
 
     @model_validator(mode="before")
     @classmethod
@@ -290,7 +308,9 @@ class RedisLockStoreConfig(BaseModel):
 
     @model_validator(mode="after")
     def verify_username_password(self) -> RedisLockStoreConfig:
-        if bool(self.username) ^ bool(self.password):
+        if os.getenv(IAM_CLOUD_PROVIDER_ENV_VAR_NAME) is None and (
+            bool(self.username) ^ bool(self.password)
+        ):
             raise ValueError(
                 f"Expected username and password. "
                 f"Found: username: {'<has value>' if self.username else '<N/A>'}, "
@@ -298,9 +318,6 @@ class RedisLockStoreConfig(BaseModel):
             )
         return self
 
-    def to_strict_redis(self) -> Dict[str, Any]:
-        return self.model_dump(by_alias=True, exclude={"key_prefix"})
-
 
 class RedisLockStore(LockStore):
     """Redis store for ticket locks."""
@@ -314,10 +331,26 @@ class RedisLockStore(LockStore):
         Args:
             config: Redis lock store configuration.
         """
-        import redis
-
         self.config = config
-        self.red = redis.StrictRedis(**self.config.to_strict_redis())
+        try:
+            redis_config = RedisConfig(
+                host=str(self.config.host),
+                port=self.config.port,
+                db=self.config.db,
+                username=self.config.username,
+                password=self.config.password,
+                use_ssl=self.config.use_ssl,
+                ssl_keyfile=self.config.ssl_keyfile,
+                ssl_certfile=self.config.ssl_certfile,
+                ssl_ca_certs=self.config.ssl_ca_certs,
+                deployment_mode=self.config.deployment_mode.value,
+                endpoints=self.config.endpoints,
+                sentinel_service=self.config.sentinel_service,
+                socket_timeout=self.config.socket_timeout,
+            )
+            self.red = RedisConnectionFactory.create_connection(redis_config)
+        except ValidationError as e:
+            raise RasaException(f"Invalid Redis configuration: {e}")
 
         self.key_prefix = DEFAULT_REDIS_LOCK_STORE_KEY_PREFIX
         if self.config.key_prefix:
@@ -349,6 +382,9 @@ class RedisLockStore(LockStore):
         """Retrieves lock (see parent docstring for more information)."""
         serialised_lock = self.red.get(self.key_prefix + conversation_id)
         if serialised_lock:
+            # Handle bytes to string conversion for JSON parsing
+            if isinstance(serialised_lock, bytes):
+                serialised_lock = serialised_lock.decode("utf-8")
             return TicketLock.from_dict(json.loads(serialised_lock))
 
         return None

rasa/core/nlg/generator.py

@@ -2,7 +2,6 @@ from typing import Any, Dict, List, Optional, Text, Union
 
 import structlog
 from jinja2 import Template
-from pypred import Predicate
 
 import rasa.shared.utils.common
 import rasa.shared.utils.io
@@ -12,6 +11,7 @@ from rasa.shared.constants import CHANNEL, RESPONSE_CONDITION
 from rasa.shared.core.domain import Domain
 from rasa.shared.core.trackers import DialogueStateTracker
 from rasa.utils.endpoints import EndpointConfig
+from rasa.utils.pypred import Predicate
 
 structlogger = structlog.get_logger()
 

rasa/core/policies/enterprise_search_policy.py

@@ -12,7 +12,7 @@ from jinja2 import Template
 from pydantic import ValidationError
 
 import rasa.shared.utils.io
-from rasa.core.available_endpoints import AvailableEndpoints
+from rasa.core.config.available_endpoints import AvailableEndpoints
 from rasa.core.constants import (
     UTTER_SOURCE_METADATA_KEY,
 )
@@ -63,6 +63,8 @@ from rasa.shared.constants import (
 )
 from rasa.shared.core.constants import (
     ACTION_CANCEL_FLOW,
+    ACTION_METADATA_MESSAGE_KEY,
+    ACTION_METADATA_TEXT_KEY,
     ACTION_SEND_TEXT_NAME,
     DEFAULT_SLOT_NAMES,
 )
@@ -585,8 +587,8 @@ class EnterpriseSearchPolicy(LLMHealthCheckMixin, EmbeddingsHealthCheckMixin, Po
             return self._create_prediction_internal_error(domain, tracker)
 
         action_metadata = {
-            "message": {
-                "text": response,
+            ACTION_METADATA_MESSAGE_KEY: {
+                ACTION_METADATA_TEXT_KEY: response,
                 SEARCH_RESULTS_METADATA_KEY: [
                     result.text for result in documents.results
                 ],

rasa/core/policies/flow_policy.py

@@ -137,8 +137,8 @@ class FlowPolicy(Policy):
 
         # create executor and predict next action
         try:
-            prediction = flow_executor.advance_flows(
-                tracker, domain.action_names_or_texts, flows
+            prediction = await flow_executor.advance_flows(
+                tracker, domain.action_names_or_texts, flows, domain.slots
             )
             return self._create_prediction_result(
                 prediction.action_name,
@@ -164,8 +164,8 @@ class FlowPolicy(Policy):
             # we retry, with the internal error frame on the stack
             events = tracker.create_stack_updated_events(updated_stack)
             tracker.update_with_events(events)
-            prediction = flow_executor.advance_flows(
-                tracker, domain.action_names_or_texts, flows
+            prediction = await flow_executor.advance_flows(
+                tracker, domain.action_names_or_texts, flows, domain.slots
             )
             collected_events = events + (prediction.events or [])
             return self._create_prediction_result(