rasa-pro 3.14.0.dev6__py3-none-any.whl → 3.14.0.dev8__py3-none-any.whl

rasa/builder/auth.py

@@ -0,0 +1,176 @@
+"""Authentication utilities for bot builder service."""
+
+from datetime import datetime, timedelta, timezone
+from functools import wraps
+from typing import Any, Awaitable, Callable, Dict, Optional, Tuple
+
+import jwt
+import structlog
+from jwt import PyJWKClient
+from pydantic import BaseModel
+from sanic import response
+from sanic.request import Request
+from sanic.response import HTTPResponse
+
+from rasa.builder.config import (
+    AUTH0_CLIENT_ID,
+    AUTH0_ISSUER,
+    AUTH_REQUIRED_AFTER_MINUTES,
+    JWKS_URL,
+)
+from rasa.builder.models import ApiErrorResponse
+from rasa.builder.project_info import ProjectInfo
+
+HEADER_USER_ID = "X-User-Id"
+
+structlogger = structlog.get_logger()
+
+RouteHandler = Callable[..., Awaitable[HTTPResponse]]
+ProtectedDecorator = Callable[[RouteHandler], RouteHandler]
+
+
+def verify_auth0_token(token: str) -> Dict[str, Any]:
+    """Verify JWT token from Auth0.
+
+    Args:
+        token: JWT token string
+
+    Returns:
+        Dict containing the token payload
+
+    Raises:
+        Exception: If token verification fails
+    """
+    jwk_client = PyJWKClient(JWKS_URL)
+    signing_key = jwk_client.get_signing_key_from_jwt(token)
+
+    payload = jwt.decode(
+        token,
+        signing_key.key,
+        algorithms=["RS256"],
+        audience=AUTH0_CLIENT_ID,
+        issuer=AUTH0_ISSUER,
+    )
+    return payload
+
+
+class Auth0TokenVerificationResult(BaseModel):
+    payload: Optional[Dict[str, Any]]
+    error_message: Optional[str]
+
+
+def extract_and_verify_auth0_token(
+    auth_header: str,
+) -> Auth0TokenVerificationResult:
+    """Extract and verify JWT token from Authorization header.
+
+    Args:
+        auth_header: Authorization header value
+
+    Returns:
+        Auth0TokenVerificationResult: Contains payload and error_message.
+    """
+    # Check Authorization header format
+    if not auth_header.startswith("Bearer "):
+        return Auth0TokenVerificationResult(
+            payload=None, error_message="Missing or invalid Authorization header"
+        )
+
+    # Extract token
+    token = auth_header.split(" ")[1]
+
+    # Verify token
+    try:
+        payload = verify_auth0_token(token)
+        return Auth0TokenVerificationResult(payload=payload, error_message=None)
+    except Exception as e:
+        return Auth0TokenVerificationResult(
+            payload=None, error_message=f"Invalid token: {e!s}"
+        )
+
+
+def is_auth_required_now(
+    *, always_required: bool = False, project_info: Optional[ProjectInfo] = None
+) -> bool:
+    """Return whether authentication is required right now based on config.
+
+    - If always_required is True, returns True
+    - Else, returns True iff current UTC time >= first_used + configured delta
+    """
+    if always_required:
+        return True
+    now = datetime.now(timezone.utc)
+
+    if project_info is None:
+        return False
+
+    first_used = project_info.first_used_dt()
+    if first_used is None:
+        return False
+
+    delta = timedelta(minutes=AUTH_REQUIRED_AFTER_MINUTES)
+    auth_required_start = (first_used + delta).astimezone(timezone.utc)
+    return now >= auth_required_start
+
+
+def _check_and_attach_auth(request: Any) -> Tuple[bool, Optional[str]]:
+    """Validate Authorization header. On success, store payload on request.ctx."""
+    auth_header = request.headers.get("Authorization", "")
+    verification_result = extract_and_verify_auth0_token(auth_header)
+    if verification_result.error_message is not None:
+        return False, verification_result.error_message
+
+    # Attach payload for downstream consumers
+    try:
+        request.ctx.auth_payload = verification_result.payload
+    except Exception:
+        # If ctx is not available for some reason, ignore silently
+        pass
+    return True, None
+
+
+def protected(*, always_required: bool = False) -> ProtectedDecorator:
+    """Decorator to protect routes with conditional authentication.
+
+    Authentication rules:
+    - If always_required=True: token is always required
+    - Else: token is required only after RASA_AUTH_AFTER timestamp
+
+    On failure returns a 401 with a JSON error body.
+    """
+
+    def decorator(f: RouteHandler) -> RouteHandler:
+        @wraps(f)
+        async def decorated_function(
+            request: Request, *args: Any, **kwargs: Any
+        ) -> HTTPResponse:
+            # Global bypass: allow turning off auth entirely
+            if not getattr(request.app.config, "USE_AUTHENTICATION", True):
+                return await f(request, *args, **kwargs)
+
+            project_info: Optional[ProjectInfo] = None
+            try:
+                project_info = request.app.ctx.project_generator.project_info
+            except Exception:
+                project_info = None
+
+            if is_auth_required_now(
+                always_required=always_required, project_info=project_info
+            ):
+                ok, err = _check_and_attach_auth(request)
+                if not ok:
+                    structlogger.error(
+                        "builder.auth.token_verification_failed", error=err
+                    )
+                    return response.json(
+                        ApiErrorResponse(
+                            error=err,
+                            details={"expected": "Bearer <valid_token>"},
+                        ).model_dump(),
+                        status=401,
+                    )
+            return await f(request, *args, **kwargs)
+
+        return decorated_function
+
+    return decorator

rasa/builder/config.py

@@ -0,0 +1,92 @@
+"""Configuration module for the prompt-to-bot service."""
+
+import os
+from typing import Any, Dict
+
+from rasa.shared.utils.yaml import read_yaml
+
+# OpenAI Configuration
+OPENAI_MODEL = os.getenv("OPENAI_MODEL", "gpt-4.1-2025-04-14")
+OPENAI_TEMPERATURE = float(os.getenv("OPENAI_TEMPERATURE", "0.7"))
+OPENAI_VECTOR_STORE_ID = os.getenv(
+    "OPENAI_VECTOR_STORE_ID", "vs_685123376e288191a005b6b144d3026f"
+)
+OPENAI_MAX_VECTOR_RESULTS = int(os.getenv("OPENAI_MAX_VECTOR_RESULTS", "10"))
+OPENAI_TIMEOUT = int(os.getenv("OPENAI_TIMEOUT", "30"))
+
+# Server Configuration
+BUILDER_SERVER_HOST = os.getenv("SERVER_HOST", "0.0.0.0")
+BUILDER_SERVER_PORT = int(os.getenv("SERVER_PORT", "5050"))
+MAX_RETRIES = int(os.getenv("MAX_RETRIES", "5"))
+MAX_LOG_ENTRIES = int(os.getenv("MAX_LOG_ENTRIES", "30"))
+HELLO_RASA_PROJECT_ID = os.getenv("HELLO_RASA_PROJECT_ID")
+
+# Copilot Signature Configuration
+# Setting the secret turns on signing on the server-side.
+COPILOT_HISTORY_SIGNING_SECRET = os.getenv("COPILOT_HISTORY_SIGNING_SECRET")
+
+# CORS Configuration
+_cors_origins_env = os.getenv("CORS_ORIGINS", "*")
+CORS_ORIGINS = _cors_origins_env.split(",") if _cors_origins_env != "*" else ["*"]
+
+# Validation Configuration
+VALIDATION_FAIL_ON_WARNINGS = (
+    os.getenv("VALIDATION_FAIL_ON_WARNINGS", "false").lower() == "true"
+)
+VALIDATION_MAX_HISTORY = None  # Could be configured if needed
+
+# Copilot Response Handler Configuration
+COPILOT_CONTROLLED_RESPONSE_MAX_TOKENS = 20
+COPILOT_HANDLER_ROLLING_BUFFER_SIZE = 20
+COPILOT_ASSISTANT_TRACKER_MAX_TURNS = 10
+COPILOT_DOCUMENTATION_SEARCH_QUERY_HISTORY_MESSAGES = 5
+
+# Guardrail Configuration
+LAKERA_BASE_URL = os.getenv("LAKERA_BASE_URL", "https://api.lakera.ai/v2").rstrip("/")
+ASSISTANT_HISTORY_GUARDRAIL_PROJECT_ID = "project-5442154580"
+COPILOT_HISTORY_GUARDRAIL_PROJECT_ID = "project-4637497223"
+
+# Guardrails blocking configuration
+GUARDRAILS_ENABLE_BLOCKING_RAW = os.getenv("GUARDRAILS_ENABLE_BLOCKING", "false")
+GUARDRAILS_ENABLE_BLOCKING = GUARDRAILS_ENABLE_BLOCKING_RAW.strip().lower() == "true"
+GUARDRAILS_USER_MAX_STRIKES = int(os.getenv("GUARDRAILS_USER_MAX_STRIKES", "3"))
+GUARDRAILS_PROJECT_MAX_STRIKES = int(os.getenv("GUARDRAILS_PROJECT_MAX_STRIKES", "5"))
+GUARDRAILS_BLOCK_DURATION_SECONDS = int(
+    os.getenv("GUARDRAILS_BLOCK_DURATION_SECONDS", "0")
+)  # 0 means indefinite
+
+# Auth0 Configuration
+AUTH0_DOMAIN = "login.hello.rasa.ai"
+AUTH0_CLIENT_ID = "Gq5RdRwp174OFIfTz6Re9TZUseYDXUYE"
+AUTH0_ISSUER = f"https://{AUTH0_DOMAIN}/"
+JWKS_URL = f"{AUTH0_ISSUER}.well-known/jwks.json"
+
+# Inkeep Configuration
+INKEEP_BASE_URL = os.getenv("INKEEP_BASE_URL", "https://api.inkeep.com/v1").rstrip("/")
+
+# LLM Proxy Configuration
+HELLO_LLM_PROXY_BASE_URL = os.getenv("HELLO_LLM_PROXY_BASE_URL")
+RASA_PRO_LICENSE = os.getenv("RASA_PRO_LICENSE")
+
+# Compute proxy-aware base URLs
+if HELLO_LLM_PROXY_BASE_URL:
+    _proxy = HELLO_LLM_PROXY_BASE_URL.rstrip("/")
+    INKEEP_BASE_URL = f"{_proxy}/documentation"
+    LAKERA_BASE_URL = f"{_proxy}/guardrails"
+
+
+# Number of minutes after FIRST_USED when authentication becomes required
+# across routes (except when auth is globally disabled on the server).
+# Default kept small for development; adjust as needed.
+AUTH_REQUIRED_AFTER_MINUTES = int(os.getenv("AUTH_REQUIRED_AFTER_MINUTES", "480"))
+
+
+def get_default_credentials() -> Dict[str, Any]:
+    """Get default credentials configuration."""
+    default_credentials_yaml = """
+    studio_chat:
+      user_message_evt: "user_message"
+      bot_message_evt: "bot_message"
+      session_persistence: true
+    """
+    return read_yaml(default_credentials_yaml)

rasa/builder/copilot/constants.py

@@ -0,0 +1,31 @@
+from typing import Literal
+
+# A dot-path for importlib to the copilot prompt
+COPILOT_PROMPTS_DIR = "builder.copilot.prompts"
+COPILOT_PROMPTS_FILE = "copilot_system_prompt.jinja2"
+COPILOT_LAST_USER_MESSAGE_CONTEXT_PROMPT_FILE = (
+    "latest_user_message_context_prompt.jinja2"
+)
+
+# A dot-path for importlib to the rasa internal messages templates
+COPILOT_MESSAGE_TEMPLATES_DIR = "builder.copilot.templated_messages"
+RASA_INTERNAL_MESSAGES_TEMPLATES_FILE = "copilot_internal_messages_templates.yml"
+COPILOT_HANDLER_RESPONSES_FILE = "copilot_templated_responses.yml"
+
+# OpenAI roles copilot utilizes - Use literal types to avoid type errors with OpenAI
+ROLE_USER: Literal["user"] = "user"
+ROLE_SYSTEM: Literal["system"] = "system"
+ROLE_ASSISTANT: Literal["assistant"] = "assistant"
+
+# Rasa Copilot role - Added to avoid confusion with the assistant role on the frontend.
+ROLE_COPILOT: Literal["copilot"] = "copilot"
+
+# Rasa internal role - Used to indicate that the message is from the Rasa internal
+# system components.
+ROLE_COPILOT_INTERNAL: Literal["copilot_internal"] = "copilot_internal"
+
+# Copilot Telemetry
+COPILOT_SEGMENT_WRITE_KEY_ENV_VAR = "COPILOT_SEGMENT_WRITE_KEY"
+
+# Copilot signing
+SIGNATURE_VERSION_V1 = "v1"