trustgraph-base 2.6.15__tar.gz → 2.7.0__tar.gz

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustgraph-base
-Version: 2.6.15
+Version: 2.7.0
 Summary: TrustGraph provides a means to run a pipeline of flexible AI processing components in a flexible means to achieve a processing pipeline.
 Author-email: "trustgraph.ai" <security@trustgraph.ai>
 Project-URL: Homepage, https://github.com/trustgraph-ai/trustgraph

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph/base/__init__.py

@@ -46,4 +46,5 @@ from . reranker_client import RerankerClientSpec
 from . reranker_service import RerankerService
 from . row_embeddings_query_client import RowEmbeddingsQueryClientSpec
 from . collection_config_handler import CollectionConfigHandler
+from . audit_publisher import AuditPublisher
 

trustgraph_base-2.7.0/trustgraph/base/audit_publisher.py

@@ -0,0 +1,42 @@
+
+import json
+import logging
+from datetime import datetime, timezone
+from uuid import uuid4
+
+from . producer import Producer
+from . metrics import ProducerMetrics
+from trustgraph.schema import AuditEvent, audit_events_queue
+
+logger = logging.getLogger(__name__)
+
+
+class AuditPublisher:
+
+    def __init__(self, backend, component_name, processor_id=None):
+        self.component_name = component_name
+        self.producer = Producer(
+            backend=backend,
+            topic=audit_events_queue,
+            schema=AuditEvent,
+            metrics=ProducerMetrics(
+                processor=processor_id or component_name,
+                flow=None,
+                name="audit-events",
+            ),
+        )
+
+    async def emit(self, event_type, payload):
+        event = AuditEvent(
+            schema_version=1,
+            event_id=str(uuid4()),
+            event_type=event_type,
+            timestamp=datetime.now(timezone.utc).isoformat(),
+            producer=self.component_name,
+            payload_json=json.dumps(payload),
+        )
+
+        try:
+            await self.producer.send(event)
+        except Exception as e:
+            logger.warning(f"Failed to emit audit event: {e}")

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph/base/iam_client.py

@@ -62,7 +62,8 @@ class IamClient(RequestResponse):
         )
         return resp.user
 
-    async def authenticate_anonymous(self, timeout=IAM_TIMEOUT):
+    async def authenticate_anonymous(self, timeout=IAM_TIMEOUT,
+                                     request_id="", client_ip=""):
         """Request anonymous access from the IAM regime.
 
         Returns ``(user_id, default_workspace, roles)`` if the regime
@@ -70,6 +71,8 @@ class IamClient(RequestResponse):
         error type ``auth-failed`` if it does not."""
         resp = await self._request(
             operation="authenticate-anonymous",
+            request_id=request_id,
+            client_ip=client_ip,
             timeout=timeout,
         )
         return (
@@ -78,7 +81,8 @@ class IamClient(RequestResponse):
             list(resp.resolved_roles),
         )
 
-    async def resolve_api_key(self, api_key, timeout=IAM_TIMEOUT):
+    async def resolve_api_key(self, api_key, timeout=IAM_TIMEOUT,
+                              request_id="", client_ip=""):
         """Resolve a plaintext API key to its identity triple.
 
         Returns ``(user_id, default_workspace, roles)`` or raises
@@ -87,6 +91,8 @@ class IamClient(RequestResponse):
         resp = await self._request(
             operation="resolve-api-key",
             api_key=api_key,
+            request_id=request_id,
+            client_ip=client_ip,
             timeout=timeout,
         )
         return (
@@ -96,7 +102,8 @@ class IamClient(RequestResponse):
         )
 
     async def authorise(self, identity_handle, capability,
-                        resource, parameters, timeout=IAM_TIMEOUT):
+                        resource, parameters, timeout=IAM_TIMEOUT,
+                        request_id="", client_ip=""):
         """Ask the IAM regime whether ``identity_handle`` may perform
         ``capability`` on ``resource`` given ``parameters``.
 
@@ -111,6 +118,8 @@ class IamClient(RequestResponse):
             capability=capability,
             resource_json=json.dumps(resource or {}, sort_keys=True),
             parameters_json=json.dumps(parameters or {}, sort_keys=True),
+            request_id=request_id,
+            client_ip=client_ip,
             timeout=timeout,
         )
         return resp.decision_allow, resp.decision_ttl_seconds
@@ -186,7 +195,7 @@ class IamClient(RequestResponse):
         )
 
     async def login(self, username, password, workspace="",
-                    timeout=IAM_TIMEOUT):
+                    timeout=IAM_TIMEOUT, request_id="", client_ip=""):
         """Validate credentials and return ``(jwt, expires_iso)``.
         ``workspace`` is optional; defaults at the server to the
         OSS default workspace."""
@@ -195,6 +204,8 @@ class IamClient(RequestResponse):
             workspace=workspace,
             username=username,
             password=password,
+            request_id=request_id,
+            client_ip=client_ip,
             timeout=timeout,
         )
         return resp.jwt, resp.jwt_expires

trustgraph_base-2.7.0/trustgraph/base_version.py

@@ -0,0 +1 @@
+__version__ = "2.7.0"

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph/schema/services/__init__.py

@@ -16,4 +16,5 @@ from .collection import *
 from .storage import *
 from .tool_service import *
 from .sparql_query import *
-from .reranker import *
+from .reranker import *
+from .audit import *

trustgraph_base-2.7.0/trustgraph/schema/services/audit.py

@@ -0,0 +1,27 @@
+
+from dataclasses import dataclass, field
+
+from ..core.topic import queue
+
+############################################################################
+
+# Audit events — see docs/tech-specs/audit-events.md for the full spec.
+#
+# Transport: notify-class pub/sub (fire-and-forget, per-subscriber
+# delivery).  Producers are the API gateway and the IAM service.
+# Consumers are optional enterprise components.
+
+
+@dataclass
+class AuditEvent:
+    schema_version: int = 1
+    event_id: str = ""
+    event_type: str = ""
+    timestamp: str = ""
+    producer: str = ""
+    payload_json: str = ""
+
+
+audit_events_queue = queue('audit-events', cls='notify')
+
+############################################################################

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph/schema/services/iam.py

@@ -121,6 +121,10 @@ class IamRequest:
     group: GroupInput | None = None
     grant: GrantInput | None = None
 
+    # ---- Audit context (informational, echoed into audit events) ----
+    request_id: str = ""
+    client_ip: str = ""
+
     # ---- authorise / authorise-many inputs ----
     # Capability string from the vocabulary in capabilities.md.
     capability: str = ""

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph_base.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustgraph-base
-Version: 2.6.15
+Version: 2.7.0
 Summary: TrustGraph provides a means to run a pipeline of flexible AI processing components in a flexible means to achieve a processing pipeline.
 Author-email: "trustgraph.ai" <security@trustgraph.ai>
 Project-URL: Homepage, https://github.com/trustgraph-ai/trustgraph

{trustgraph_base-2.6.15 → trustgraph_base-2.7.0}/trustgraph_base.egg-info/SOURCES.txt

@@ -25,6 +25,7 @@ trustgraph/base/__init__.py
 trustgraph/base/agent_client.py
 trustgraph/base/agent_service.py
 trustgraph/base/async_processor.py
+trustgraph/base/audit_publisher.py
 trustgraph/base/backend.py
 trustgraph/base/cassandra_config.py
 trustgraph/base/chunking_service.py
@@ -161,6 +162,7 @@ trustgraph/schema/knowledge/rows.py
 trustgraph/schema/knowledge/structured.py
 trustgraph/schema/services/__init__.py
 trustgraph/schema/services/agent.py
+trustgraph/schema/services/audit.py
 trustgraph/schema/services/collection.py
 trustgraph/schema/services/config.py
 trustgraph/schema/services/diagnosis.py

trustgraph_base-2.6.15/trustgraph/base_version.py

@@ -1 +0,0 @@
-__version__ = "2.6.15"