solace-agent-mesh 1.7.1__py3-none-any.whl → 1.13.2__py3-none-any.whl

solace_agent_mesh/gateway/http_sse/routers/artifacts.py

@@ -1,6 +1,7 @@
 """
 FastAPI router for managing session-specific artifacts via REST endpoints.
 """
+from __future__ import annotations
 
 import logging
 from collections.abc import Callable
@@ -42,6 +43,7 @@ from ....common.utils.embeds import (
 )
 from ....common.utils.embeds.types import ResolutionMode
 from ....common.utils.mime_helpers import is_text_based_mime_type
+from ....common.utils.templates import resolve_template_blocks_in_string
 from ..dependencies import (
     get_project_service_optional,
     ValidatedUserConfig,
@@ -71,6 +73,7 @@ if TYPE_CHECKING:
 
 log = logging.getLogger(__name__)
 
+LOAD_FILE_CHUNK_SIZE = 1024 * 1024  # 1MB chunks
 
 class ArtifactUploadResponse(BaseModel):
     """Response model for artifact upload with camelCase fields."""
@@ -205,6 +208,7 @@ async def upload_artifact_with_session(
 
     # Handle session creation logic (matching chat API pattern)
     effective_session_id = None
+    is_new_session = False  # Track if we created a new session
 
     # Use session ID from request body (matching sessionId pattern in session APIs)
     if sessionId and sessionId.strip():
@@ -213,6 +217,7 @@ async def upload_artifact_with_session(
     else:
         # Create new session when no sessionId provided (like chat does for new conversations)
         effective_session_id = session_manager.create_new_session_id(request)
+        is_new_session = True  # Mark that we created this session
         log.info(
             "%sCreated new session for file upload: %s",
             log_prefix,
@@ -271,7 +276,8 @@ async def upload_artifact_with_session(
         )
 
     # Validate session (now that we have an effective_session_id)
-    if not validate_session(effective_session_id, user_id):
+    # Skip validation if we just created the session to avoid race conditions
+    if not is_new_session and not validate_session(effective_session_id, user_id):
         log.warning(
             "%sSession validation failed for session: %s",
             log_prefix,
@@ -290,8 +296,78 @@ async def upload_artifact_with_session(
     )
 
     try:
-        # Read and validate file content
-        content_bytes = await upload_file.read()
+        # ===== VALIDATE FILE SIZE BEFORE READING =====
+        max_upload_size = component.get_config("gateway_max_upload_size_bytes")
+        
+        # Check Content-Length header first (if available)
+        content_length = request.headers.get("content-length")
+        if content_length:
+            try:
+                file_size = int(content_length)
+                
+                if file_size > max_upload_size:
+                    error_msg = (
+                        f"File upload rejected: size {file_size:,} bytes "
+                        f"exceeds maximum {max_upload_size:,} bytes "
+                        f"({file_size / (1024*1024):.2f} MB > {max_upload_size / (1024*1024):.2f} MB)"
+                    )
+                    log.warning("%s %s", log_prefix, error_msg)
+                    
+                    raise HTTPException(
+                        status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+                        detail=error_msg  # Use string instead of dict
+                    )
+            except ValueError:
+                log.warning("%s Invalid Content-Length header: %s", log_prefix, content_length)
+        
+        # Validate file size by streaming through WITHOUT accumulating chunks in memory
+        chunk_size = LOAD_FILE_CHUNK_SIZE
+        total_bytes_read = 0
+
+        try:
+            # Step 1: Validate size by reading chunks (discard data, just count bytes)
+            while True:
+                chunk = await upload_file.read(chunk_size)
+                if not chunk:
+                    break  # End of file
+
+                total_bytes_read += len(chunk)
+
+                # Validate size during reading (fail fast)
+                if total_bytes_read > max_upload_size:
+                    error_msg = (
+                        f"File '{upload_file.filename}' rejected: size exceeds maximum {max_upload_size:,} bytes "
+                        f"(read {total_bytes_read:,} bytes so far, "
+                        f"{total_bytes_read / (1024*1024):.2f} MB > {max_upload_size / (1024*1024):.2f} MB)"
+                    )
+                    log.warning("%s %s", log_prefix, error_msg)
+
+                    raise HTTPException(
+                        status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+                        detail=error_msg
+                    )
+
+            # Step 2: Size is valid - reset to beginning
+            await upload_file.seek(0)
+
+            # Step 3: Read all content at once
+            content_bytes = await upload_file.read()
+
+            log.debug(
+                "%s File validated (%d bytes) and loaded into memory",
+                log_prefix,
+                total_bytes_read
+            )
+            
+        except HTTPException:
+            # Re-raise HTTP exceptions (size limit exceeded)
+            raise
+        except Exception as read_error:
+            log.exception("%s Error reading uploaded file: %s", log_prefix, read_error)
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to read uploaded file"
+            )
 
         mime_type = upload_file.content_type or "application/octet-stream"
         filename_clean = filename.strip()
@@ -323,6 +399,8 @@ async def upload_artifact_with_session(
 
             if error_type in ["invalid_filename", "empty_file"]:
                 status_code = status.HTTP_400_BAD_REQUEST
+            elif error_type == "file_too_large":
+                status_code = status.HTTP_413_REQUEST_ENTITY_TOO_LARGE
             else:
                 status_code = status.HTTP_500_INTERNAL_SERVER_ERROR
 
@@ -631,12 +709,26 @@ async def get_latest_artifact(
                     max_depth=component.gateway_recursive_embed_depth,
                     max_total_size=component.gateway_max_artifact_resolve_size_bytes,
                 )
-                data_bytes = resolved_content_string.encode("utf-8")
                 log.info(
                     "%s Recursive embed resolution complete. New size: %d bytes.",
                     log_prefix,
-                    len(data_bytes),
+                    len(resolved_content_string),
+                )
+
+                # Also resolve any template blocks in the artifact
+                resolved_content_string = await resolve_template_blocks_in_string(
+                    text=resolved_content_string,
+                    artifact_service=artifact_service,
+                    session_context=context_for_resolver["session_context"],
+                    log_identifier=f"{log_prefix}[TemplateResolve]",
+                )
+                log.info(
+                    "%s Template block resolution complete. Final size: %d bytes.",
+                    log_prefix,
+                    len(resolved_content_string),
                 )
+
+                data_bytes = resolved_content_string.encode("utf-8")
             except UnicodeDecodeError as ude:
                 log.warning(
                     "%s Failed to decode artifact for recursive resolution: %s. Serving original content.",
@@ -812,12 +904,26 @@ async def get_specific_artifact_version(
                     max_depth=component.gateway_recursive_embed_depth,
                     max_total_size=component.gateway_max_artifact_resolve_size_bytes,
                 )
-                data_bytes = resolved_content_string.encode("utf-8")
                 log.info(
                     "%s Recursive embed resolution complete. New size: %d bytes.",
                     log_prefix,
-                    len(data_bytes),
+                    len(resolved_content_string),
                 )
+
+                # Also resolve any template blocks in the artifact
+                resolved_content_string = await resolve_template_blocks_in_string(
+                    text=resolved_content_string,
+                    artifact_service=artifact_service,
+                    session_context=context_for_resolver["session_context"],
+                    log_identifier=f"{log_prefix}[TemplateResolve]",
+                )
+                log.info(
+                    "%s Template block resolution complete. Final size: %d bytes.",
+                    log_prefix,
+                    len(resolved_content_string),
+                )
+
+                data_bytes = resolved_content_string.encode("utf-8")
             except UnicodeDecodeError as ude:
                 log.warning(
                     "%s Failed to decode artifact for recursive resolution: %s. Serving original content.",

solace_agent_mesh/gateway/http_sse/routers/auth.py

@@ -1,12 +1,11 @@
 """
 Router for handling authentication-related endpoints.
 """
+from __future__ import annotations
 
 import logging
 import secrets
-from urllib.parse import urlencode
 
-import httpx
 from fastapi import (
     APIRouter,
     Depends,
@@ -14,7 +13,7 @@ from fastapi import (
     Request as FastAPIRequest,
     Response,
 )
-from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.responses import HTMLResponse
 
 from ...http_sse.dependencies import get_api_config, get_sac_component
 
@@ -30,20 +29,16 @@ async def initiate_login(
     """
     Initiates the login flow by redirecting to the external authorization service.
     """
-    external_auth_url = config.get("external_auth_service_url", "http://localhost:8080")
-    callback_url = config.get(
-        "external_auth_callback_uri", "http://localhost:8000/api/v1/auth/callback"
-    )
-
-    params = {
-        "provider": config.get("external_auth_provider", "azure"),
-        "redirect_uri": callback_url,
-    }
-
-    login_url = f"{external_auth_url}/login?{urlencode(params)}"
-    log.info(f"Redirecting to external authorization service: {login_url}")
+    try:
+        from solace_agent_mesh_enterprise.gateway.auth import handle_login_initiation
 
-    return RedirectResponse(url=login_url)
+        return await handle_login_initiation(request, config)
+    except ImportError:
+        raise HTTPException(
+            status_code=501,
+            detail="OAuth authentication requires enterprise package. "
+            "Install: pip install solace-agent-mesh-enterprise",
+        )
 
 
 @router.get("/csrf-token")
@@ -76,86 +71,64 @@ async def auth_callback(
     """
     Handles the callback from the OIDC provider by calling an external exchange service.
     """
-    code = request.query_params.get("code")
-
-    if not code:
-        raise HTTPException(status_code=400, detail="Missing authorization code")
-
-    external_auth_url = config.get("external_auth_service_url", "http://localhost:8080")
-    exchange_url = f"{external_auth_url}/exchange-code"
-    redirect_uri = config.get(
-        "external_auth_callback_uri", "http://localhost:8000/api/v1/auth/callback"
-    )
-
-    async with httpx.AsyncClient() as client:
-        try:
-            response = await client.post(
-                exchange_url,
-                json={
-                    "code": code,
-                    "provider": config.get("external_auth_provider", "azure"),
-                    "redirect_uri": redirect_uri,
-                },
-                timeout=20.0,
-            )
-            response.raise_for_status()
-            token_data = response.json()
-        except httpx.HTTPStatusError as e:
-            log.error(f"Failed to exchange code: {e.response.text}")
-            raise HTTPException(
-                status_code=e.response.status_code,
-                detail=f"Failed to exchange code: {e.response.text}",
-            )
-        except Exception as e:
-            log.error(f"Error during code exchange: {e}")
-            raise HTTPException(status_code=500, detail="Error during code exchange")
-
-    access_token = token_data.get("access_token")
-    refresh_token = token_data.get("refresh_token")
+    try:
+        from solace_agent_mesh_enterprise.gateway.auth import handle_auth_callback
 
-    if not access_token:
+        return await handle_auth_callback(
+            request, config, component
+        )
+    except ImportError:
         raise HTTPException(
-            status_code=400, detail="Access token not in response from exchange service"
+            status_code=501,
+            detail="OAuth authentication requires enterprise package. "
+            "Install: pip install solace-agent-mesh-enterprise",
         )
 
-    request.session["access_token"] = access_token
-    if refresh_token:
-        request.session["refresh_token"] = refresh_token
-    log.debug("Tokens stored directly in session.")
 
+@router.post("/auth/logout")
+async def logout(request: FastAPIRequest, response: Response):
+    """
+    Logout endpoint - clears server-side session and access token.
+    
+    This endpoint:
+    - Clears the access_token from the session storage
+    - Clears all session data
+    - Returns success even if already logged out (idempotent)
+    
+    The session cookie will be invalidated, requiring re-authentication
+    on the next request.
+    """
     try:
-        async with httpx.AsyncClient() as client:
-            user_info_response = await client.get(
-                f"{external_auth_url}/user_info",
-                params={"provider": config.get("external_auth_provider", "azure")},
-                headers={"Authorization": f"Bearer {access_token}"},
-            )
-            user_info_response.raise_for_status()
-            user_info = user_info_response.json()
-
-            user_id = user_info.get("email", "authenticated_user")
-            if user_id:
-                session_manager = component.get_session_manager()
-                session_manager.store_user_id(request, user_id)
-            else:
-                log.warning("Could not find 'email' in user info response.")
-
-    except httpx.HTTPStatusError as e:
-        log.error(f"Failed to get user info: {e.response.text}")
-
+        # Clear access token from session storage
+        if hasattr(request, 'session') and 'access_token' in request.session:
+            del request.session['access_token']
+            log.debug("Cleared access_token from session")
+        
+        # Clear refresh token if present
+        if hasattr(request, 'session') and 'refresh_token' in request.session:
+            del request.session['refresh_token']
+            log.debug("Cleared refresh_token from session")
+        
+        # Clear all other session data
+        if hasattr(request, 'session'):
+            request.session.clear()
+            log.debug("Cleared all session data")
+        
+        # Clear the session cookie from response to FE cannot use
+        response.delete_cookie(
+            key="session",  # Starlette's default session cookie name
+            path="/",
+            samesite="lax"
+        )
+        log.debug("Deleted session cookie")
+        
+        log.info("User logged out successfully")
+        return {"success": True, "message": "Logged out successfully"}
+    
     except Exception as e:
-        log.error(f"Error getting user info: {e}")
-
-    frontend_base_url = config.get("frontend_redirect_url", "http://localhost:3000")
-
-    hash_params = {"access_token": access_token}
-    if refresh_token:
-        hash_params["refresh_token"] = refresh_token
-
-    hash_fragment = urlencode(hash_params)
-
-    frontend_redirect_url = f"{frontend_base_url}/auth-callback.html#{hash_fragment}"
-    return RedirectResponse(url=frontend_redirect_url)
+        log.error(f"Error during logout: {e}")
+        # Still return success - logout should be idempotent
+        return {"success": True, "message": "Logged out successfully"}
 
 
 @router.post("/auth/refresh")
@@ -167,53 +140,17 @@ async def refresh_token(
     """
     Refreshes an access token using the external authorization service.
     """
-    data = await request.json()
-    refresh_token = data.get("refresh_token")
-    if not refresh_token:
-        raise HTTPException(status_code=400, detail="Missing refresh_token")
-
-    external_auth_url = config.get("external_auth_service_url", "http://localhost:8080")
-    refresh_url = f"{external_auth_url}/refresh_token"
-
-    async with httpx.AsyncClient() as client:
-        try:
-            response = await client.post(
-                refresh_url,
-                json={
-                    "refresh_token": refresh_token,
-                    "provider": config.get("external_auth_provider", "azure"),
-                },
-                timeout=20.0,
-            )
-            response.raise_for_status()
-            token_data = response.json()
-        except httpx.HTTPStatusError as e:
-            log.error(f"Failed to refresh token: {e.response.text}")
-            raise HTTPException(
-                status_code=e.response.status_code,
-                detail=f"Failed to refresh token: {e.response.text}",
-            )
-        except Exception as e:
-            log.error(f"Error during token refresh: {e}")
-            raise HTTPException(status_code=500, detail="Error during token refresh")
-
-    access_token = token_data.get("access_token")
-    new_refresh_token = token_data.get("refresh_token")
+    try:
+        from solace_agent_mesh_enterprise.gateway.auth import handle_token_refresh
 
-    if not access_token:
+        return await handle_token_refresh(request, config, component)
+    except ImportError:
         raise HTTPException(
-            status_code=400, detail="Access token not in response from refresh service"
+            status_code=501,
+            detail="OAuth authentication requires enterprise package. "
+            "Install: pip install solace-agent-mesh-enterprise",
         )
 
-    session_manager = component.get_session_manager()
-    session_manager.store_auth_tokens(request, access_token, new_refresh_token)
-    log.info("Successfully refreshed and updated tokens in session.")
-
-    return {
-        "access_token": access_token,
-        "refresh_token": new_refresh_token,
-    }
-
 
 @router.get("/auth/tool/callback")
 async def auth_tool_callback(