strands-compose-chat 0.1.0__py3-none-any.whl

strands_compose_chat/__init__.py

@@ -0,0 +1 @@
+"""Chat Backend API — async ASGI service replacing proxy.py."""

strands_compose_chat/admin/__init__.py

@@ -0,0 +1 @@
+"""Admin panel: sqladmin views and authentication backend."""

strands_compose_chat/admin/auth.py

@@ -0,0 +1,132 @@
+"""sqladmin AuthenticationBackend and shared admin identity resolution.
+
+Two independent identities grant access:
+
+1. A dedicated admin-panel login (``/admin/login``) that authenticates an active
+   local superuser against its password hash. Works regardless of external OIDC
+   configuration so an operator can always reach the panel.
+
+2. The application session cookie, when it belongs to an active superuser.
+   Lets a superuser authenticated via OIDC reach the panel without a second login.
+
+``resolve_admin_user`` is the single source of truth for admin identity resolution,
+shared by both ``AdminAuthBackend`` and the FastAPI ``get_admin_user`` dependency.
+"""
+
+import structlog
+from fastapi import Request, Response
+from fastapi.responses import RedirectResponse
+from sqladmin.authentication import AuthenticationBackend
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ..auth.passwords import dummy_verify, verify_password
+from ..config import Settings
+from ..db.base import AsyncSessionLocal
+from ..db.models import User
+
+logger: structlog.stdlib.BoundLogger = structlog.get_logger(__name__)
+
+_ADMIN_SESSION_KEY = "admin_user_id"
+_USER_SESSION_KEY = "user_id"
+
+
+async def resolve_admin_user(request: Request, db: AsyncSession) -> User | None:
+    """Return the active superuser from either admin session or app session.
+
+    Checks request.session["admin_user_id"] first. If absent or stale, falls
+    back to request.session["user_id"] + is_superuser check. Returns None
+    when neither path yields an active superuser.
+
+    Args:
+        request: The incoming FastAPI/Starlette request.
+        db: Async database session.
+
+    Returns:
+        Active superuser User instance, or None.
+    """
+    admin_user_id = request.session.get(_ADMIN_SESSION_KEY)
+    if admin_user_id:
+        result = await db.execute(select(User).where(User.id == str(admin_user_id)))
+        user = result.scalar_one_or_none()
+        if user and user.is_active and user.is_superuser:
+            return user
+
+    user_id = request.session.get(_USER_SESSION_KEY)
+    if user_id:
+        result = await db.execute(select(User).where(User.id == str(user_id)))
+        user = result.scalar_one_or_none()
+        if user and user.is_active and user.is_superuser:
+            return user
+
+    return None
+
+
+class AdminAuthBackend(AuthenticationBackend):
+    """sqladmin AuthenticationBackend enforcing superuser access."""
+
+    def __init__(self, settings: Settings) -> None:
+        super().__init__(secret_key=settings.SESSION_SECRET_KEY)
+        # Don't install a second SessionMiddleware on the admin sub-app.
+        # Two nested instances share scope["session"]; the inner one emptying it
+        # causes the outer send_wrapper to clear the main session cookie on logout.
+        self.middlewares = []
+        self._settings = settings
+
+    @property
+    def _login_url(self) -> str:
+        return f"{self._settings.URL_PREFIX}/admin/login"
+
+    async def login(self, request: Request) -> bool:
+        """Authenticate an active local superuser from the admin login form.
+
+        ``dummy_verify`` runs when no matching user is found so all failure
+        paths take the same time, preventing username enumeration via timing.
+        """
+        form = await request.form()
+        username = str(form.get("username") or "")
+        password = str(form.get("password") or "")
+
+        user = await self._load_local_superuser(username)
+        if user is None:
+            dummy_verify(self._settings)
+            password_ok = False
+        else:
+            password_ok = verify_password(password, user.password_hash or "", self._settings)
+
+        if user is None or not password_ok:
+            logger.warning("Admin login failed", username=username)
+            return False
+
+        request.session[_ADMIN_SESSION_KEY] = user.id
+        logger.info("Admin login succeeded", user_id=user.id, username=user.username)
+        return True
+
+    async def logout(self, request: Request) -> Response:
+        """Pop only the admin session entry; the application SSO identity is left intact."""
+        request.session.pop(_ADMIN_SESSION_KEY, None)
+        return RedirectResponse(url=self._login_url, status_code=302)
+
+    async def authenticate(self, request: Request) -> Response | bool:
+        """Grant access via the admin session or the app session (superuser only)."""
+        async with AsyncSessionLocal() as db:
+            user = await resolve_admin_user(request, db)
+        return user is not None
+
+    async def _load_local_superuser(self, username: str) -> User | None:
+        """Return an active local superuser by username, or None."""
+        if not username:
+            return None
+
+        async with AsyncSessionLocal() as db:
+            result = await db.execute(
+                select(User).where(
+                    User.username == username,
+                    User.auth_provider == "local",
+                )
+            )
+            user = result.scalar_one_or_none()
+
+        if user is None or not user.is_active or not user.is_superuser:
+            return None
+        return user

strands_compose_chat/admin/templates/dashboard.html

@@ -0,0 +1,18 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="app-base" content="{{ url_prefix }}">
+    <link rel="icon" type="image/svg+xml" href="{{ url_prefix }}/static/favicon.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Admin Dashboard</title>
+    <link rel="stylesheet" href="{{ url_prefix }}/static/css/index.css" />
+    <link rel="stylesheet" href="{{ url_prefix }}/static/css/contexts.css" />
+    <link rel="stylesheet" href="{{ url_prefix }}/static/css/components.css" />
+    <link rel="stylesheet" href="{{ url_prefix }}/static/css/admin.css" />
+    <script type="module" src="{{ url_prefix }}/static/js/admin.js"></script>
+  </head>
+  <body style="margin:0">
+    <div id="admin-root"></div>
+  </body>
+</html>

strands_compose_chat/admin/templates/sqladmin/index.html

@@ -0,0 +1,45 @@
+{% extends "sqladmin/layout.html" %}
+
+{% block head %}
+<style>
+  /* Remove the page-header container */
+  .page-wrapper > .container-fluid:first-child {
+    display: none;
+  }
+  /* Strip padding from body/row so iframe fills everything */
+  .page-body {
+    padding: 0 !important;
+    overflow: hidden;
+    margin: 0;
+    height: 100vh;
+  }
+  .page-body > .container-fluid {
+    height: 100%;
+    padding: 0;
+    max-width: 100%;
+  }
+  .page-body > .container-fluid > .row {
+    height: 100%;
+    margin: 0;
+  }
+
+  .iframe-admin {
+    width: 100%;
+    height: 100vh;
+    border: none;
+    margin: 0;
+    padding: 0;
+  }
+</style>
+{% endblock %}
+
+{% block content_header %}{% endblock %}
+
+{% block content %}
+<iframe
+  src="{{ admin.base_url }}/dashboard"
+  class="iframe-admin"
+  title="Admin Dashboard"
+  id="admin-app-iframe"
+></iframe>
+{% endblock %}

strands_compose_chat/admin/templates/sqladmin/layout.html

@@ -0,0 +1,132 @@
+{% extends "sqladmin_original/layout.html" %}
+
+{% block head %}
+{{ super() }}
+<script>
+  (function () {
+    var stored = sessionStorage.getItem("strands_chat_color_mode");
+    var theme = stored === "dark" || stored === "light"
+      ? stored
+      : window.matchMedia("(prefers-color-scheme: dark)").matches
+        ? "dark"
+        : "light";
+    document.documentElement.setAttribute("data-bs-theme", theme);
+  })();
+</script>
+<style>
+  /*
+   * Select2 dark mode overrides.
+   *
+   * Select2 renders its own DOM and hardcodes light colours — it does not
+   * respond to Bootstrap's data-bs-theme.  These rules re-skin every Select2
+   * surface to match Tabler's dark palette when data-bs-theme="dark" is on
+   */
+
+  /* Selection box — single and multiple */
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--single,
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--multiple {
+    background-color: #1f2937;
+    border-color: #374151;
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--single .select2-selection__rendered {
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--single .select2-selection__placeholder {
+    color: #9ca3af;
+  }
+
+  /* Dropdown arrow */
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--single .select2-selection__arrow b {
+    border-color: #9ca3af transparent transparent transparent;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default.select2-container--open .select2-selection--single .select2-selection__arrow b {
+    border-color: transparent transparent #9ca3af transparent;
+  }
+
+  /* Selected choice tags (multiple) */
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--multiple .select2-selection__choice {
+    background-color: #374151;
+    border-color: #4b5563;
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--multiple .select2-selection__choice__remove {
+    color: #9ca3af;
+    border-color: #4b5563;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-selection--multiple .select2-selection__choice__remove:hover {
+    background-color: #4b5563;
+    color: #f9fafb;
+  }
+
+  /* Inline search input inside the multiselect box */
+  [data-bs-theme="dark"] .select2-container--default .select2-search--inline .select2-search__field {
+    color: #e5e7eb;
+    background: transparent;
+  }
+
+  /* Dropdown panel */
+  [data-bs-theme="dark"] .select2-dropdown {
+    background-color: #1f2937;
+    border-color: #374151;
+    color: #e5e7eb;
+  }
+
+  /* Search box inside the dropdown */
+  [data-bs-theme="dark"] .select2-container--default .select2-search--dropdown .select2-search__field {
+    background-color: #111827;
+    border-color: #374151;
+    color: #e5e7eb;
+  }
+
+  /* Result options in the dropdown list */
+  [data-bs-theme="dark"] .select2-container--default .select2-results__option {
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-results__option[aria-selected="true"] {
+    background-color: #374151;
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-results__option--highlighted[aria-selected] {
+    background-color: #1d4ed8;
+    color: #ffffff;
+  }
+
+  [data-bs-theme="dark"] .select2-container--default .select2-results__option[aria-disabled="true"] {
+    color: #6b7280;
+  }
+
+  /* Focus ring on the multiple container */
+  [data-bs-theme="dark"] .select2-container--default.select2-container--focus .select2-selection--multiple {
+    border-color: #3b82f6;
+  }
+
+  [data-bs-theme="dark"] .btn-light {
+    background-color: #1f2937;
+    border-color: #374151;
+    color: #e5e7eb;
+  }
+
+  [data-bs-theme="dark"] .btn-light:hover,
+  [data-bs-theme="dark"] .btn-light:focus,
+  [data-bs-theme="dark"] .btn-light:active,
+  [data-bs-theme="dark"] .btn-light.show {
+    background-color: #374151;
+    border-color: #4b5563;
+    color: #f9fafb;
+  }
+
+  [data-bs-theme="dark"] .btn-light:disabled {
+    background-color: #1f2937;
+    border-color: #374151;
+    color: #6b7280;
+  }
+</style>
+{% endblock %}

strands_compose_chat/admin/views/__init__.py

@@ -0,0 +1,23 @@
+"""Admin ModelView definitions, one class per file."""
+
+from .agent import AgentAdmin
+from .api_key import ApiKeyAdmin
+from .chat_message import ChatMessageAdmin
+from .chat_session import ChatSessionAdmin
+from .dashboard import DashboardView
+from .group import GroupAdmin
+from .model_pricing import ModelPricingAdmin
+from .token_usage import TokenUsageAdmin
+from .user import UserAdmin
+
+__all__ = [
+    "AgentAdmin",
+    "ApiKeyAdmin",
+    "ChatMessageAdmin",
+    "ChatSessionAdmin",
+    "DashboardView",
+    "GroupAdmin",
+    "ModelPricingAdmin",
+    "TokenUsageAdmin",
+    "UserAdmin",
+]

strands_compose_chat/admin/views/agent.py

@@ -0,0 +1,234 @@
+"""Admin view for the Agent model."""
+
+import re
+from typing import Any
+from urllib.parse import urlparse
+
+from markupsafe import Markup
+from wtforms import SelectField, TextAreaField
+from wtforms.validators import DataRequired
+
+from ...db.models import Agent
+from ...deps import get_settings
+from .base import BaseModelView, _badge
+
+
+def _format_description(model: Any, _prop: Any) -> str:
+    """Truncate agent description to 60 characters in the list view."""
+    desc: str = getattr(model, "description", "") or ""
+    return desc[:60] + "…" if len(desc) > 60 else desc
+
+
+def _format_agent_kind(model: Any, _prop: Any) -> Markup:
+    """Render agent_kind as a coloured badge."""
+    kind: str = getattr(model, "agent_kind", "") or ""
+    colour_map = {
+        "agentcore_runtime": "#6f42c1",
+        "local": "#0d6efd",
+    }
+    label_map = {
+        "agentcore_runtime": "AgentCore",
+        "local": "Local",
+    }
+    return _badge(label_map.get(kind, kind or "—"), colour_map.get(kind, "#6c757d"))
+
+
+class SuggestedQuestionsField(TextAreaField):
+    """WTForms field that stores a JSON list of strings as newline-separated text.
+
+    The textarea shows one question per line. On submit the value is split on
+    newlines, stripped, and empty lines are discarded before being stored as a
+    JSON array. On load a ``list`` from the DB JSON column is joined back to
+    newline-separated text so the textarea is pre-populated correctly.
+    """
+
+    def process_formdata(self, valuelist: list[str]) -> None:
+        if valuelist:
+            lines = [line.strip() for line in valuelist[0].splitlines()]
+            self.data = [line for line in lines if line]
+        else:
+            self.data = None
+
+    def _value(self) -> str:
+        if isinstance(self.data, list):
+            return "\n".join(self.data)
+        return self.data or ""
+
+
+class AgentAdmin(BaseModelView, model=Agent):
+    """Admin view for the agents table.
+
+    Soft-delete is used instead of hard delete to preserve chat_sessions
+    foreign-key references: ``delete_model`` sets ``enabled=False``.
+
+    ``agent_kind`` is rendered as a dropdown. Kind-specific fields carry
+    description hints so the admin user knows which apply to which type.
+    ``suggested_questions`` is a newline-separated textarea that serialises
+    to a JSON array on the model.
+    """
+
+    name = "Agent"
+    name_plural = "Agents"
+    icon = "fa-solid fa-robot"
+
+    column_list = [
+        Agent.name,
+        Agent.description,
+        Agent.access_groups,
+        Agent.enabled,
+        Agent.multimodal,
+        Agent.agent_kind,
+        Agent.created_at,
+        Agent.updated_at,
+    ]
+    column_details_list = [
+        Agent.name,
+        Agent.description,
+        Agent.access_groups,
+        Agent.enabled,
+        Agent.multimodal,
+        Agent.agent_kind,
+        Agent.agent_runtime_arn,
+        Agent.region,
+        Agent.endpoint_url,
+        Agent.suggested_questions,
+        Agent.created_at,
+        Agent.updated_at,
+    ]
+    form_columns = [
+        Agent.name,
+        Agent.description,
+        Agent.access_groups,
+        Agent.enabled,
+        Agent.multimodal,
+        Agent.agent_kind,
+        Agent.agent_runtime_arn,
+        Agent.region,
+        Agent.endpoint_url,
+        Agent.suggested_questions,
+    ]
+
+    column_searchable_list = [Agent.name, Agent.id]
+    column_default_sort = [(Agent.name, False)]
+
+    form_defaults = {"enabled": True, "multimodal": False}
+
+    # access_groups renders as badge list via BaseModelView.get_list_value / get_detail_value
+    _badge_relation_props = {"access_groups": "#d79750"}
+
+    column_formatters = {  # type: ignore[assignment]
+        Agent.description: _format_description,
+        Agent.agent_kind: _format_agent_kind,
+    }
+    column_formatters_detail = {  # type: ignore[assignment]
+        Agent.description: _format_description,
+        Agent.agent_kind: _format_agent_kind,
+    }
+
+    form_overrides = {
+        "agent_kind": SelectField,
+        "description": TextAreaField,
+        "suggested_questions": SuggestedQuestionsField,
+    }
+    form_args = {
+        "agent_kind": {
+            "choices": [
+                ("agentcore_runtime", "Agentcore Runtime"),
+                ("local", "Local"),
+            ]
+        },
+        "description": {
+            "label": "Description",
+            "validators": [DataRequired()],
+            "description": "Shown above the chat composer on the welcome page. Use newlines for multiple lines.",
+            "render_kw": {
+                "rows": 4,
+                "placeholder": "This agent can help you with...",
+                "class": "form-control w-100",
+                "style": "width:100%!important;box-sizing:border-box;resize:vertical",
+            },
+        },
+        "agent_runtime_arn": {
+            "description": "Required for Agentcore Runtime agents only.",
+        },
+        "region": {
+            "description": "Required for Agentcore Runtime agents only.",
+        },
+        "endpoint_url": {
+            "description": "Required for Local agents only.",
+        },
+        "suggested_questions": {
+            "label": "Suggested Questions",
+            "description": "One question per line. Shown as quick-start prompts on the welcome page.",
+            "render_kw": {
+                "rows": 4,
+                "placeholder": "What can you help me with?\nSummarise the latest changes",
+                "class": "form-control w-100",
+                "style": "width:100%!important;box-sizing:border-box;resize:vertical",
+            },
+        },
+    }
+
+    form_ajax_refs = {
+        "access_groups": {
+            "fields": ("name",),
+            "order_by": "name",
+        }
+    }
+
+    async def on_model_delete(self, model: Any, request: Any) -> None:
+        """Soft-delete: set enabled=False instead of deleting the row."""
+        model.enabled = False
+
+    async def on_model_change(self, data: dict, model: Any, is_created: bool, request: Any) -> None:
+        """Validate kind-specific required fields.
+
+        In dev, ``http://`` is allowed only for localhost/127.0.0.1/*.local endpoints.
+        In prod, ``https://`` is enforced on all local-kind agents.
+        """
+        kind = data.get("agent_kind") or getattr(model, "agent_kind", None)
+
+        if kind == "agentcore_runtime":
+            arn = (data.get("agent_runtime_arn") or "").strip()
+            region = (data.get("region") or "").strip()
+            missing = []
+            if not arn:
+                missing.append("Agent Runtime ARN")
+            if not region:
+                missing.append("Region")
+            if missing:
+                raise ValueError(f"Agentcore Runtime agents require: {', '.join(missing)}.")
+
+        if kind == "local":
+            endpoint_url = (data.get("endpoint_url") or "").strip()
+            if not endpoint_url:
+                raise ValueError("Local agents require an Endpoint URL.")
+            app_env = get_settings().APP_ENV
+            parsed = urlparse(endpoint_url)
+            scheme = parsed.scheme.lower()
+            host = parsed.hostname or ""
+            if scheme != "https":
+                if app_env == "prod":
+                    raise ValueError(
+                        f"endpoint_url scheme must be 'https' in prod; got {endpoint_url!r}"
+                    )
+                if scheme != "http" or (
+                    host not in {"localhost", "127.0.0.1"}
+                    and not re.match(r"^[a-zA-Z0-9\-]+\.local$", host)
+                ):
+                    raise ValueError(
+                        f"endpoint_url with http:// is only allowed for localhost, 127.0.0.1, "
+                        f"or *.local hosts in dev; got host={host!r}"
+                    )
+
+    async def delete_model(self, request: Any, pk: Any) -> None:
+        """Override hard-delete with a soft-delete (enabled=False)."""
+        from sqlalchemy import select  # noqa: PLC0415
+
+        async with self.session_maker() as session:
+            stmt = select(Agent).where(Agent.id == pk)
+            result = await session.execute(stmt)
+            agent = result.scalar_one_or_none()
+            if agent is not None:
+                agent.enabled = False
+                await session.commit()