xpander-sdk 2.0.225__py3-none-any.whl → 2.0.227__py3-none-any.whl

xpander_sdk/modules/agents/sub_modules/agent.py

@@ -175,6 +175,8 @@ class Agent(XPanderSharedModel):
             use_oidc_pre_auth: Optional[bool] = False
             pre_auth_audiences: Optional[List[str]] = []
             use_oidc_pre_auth_token_for_llm: Optional[bool] = False
+            oidc_pre_auth_token_mcp_audience: Optional[bool] = False
+            oidc_pre_auth_token_llm_audience: Optional[str] = None
 
         Example:
             >>> agent = Agent(id="agent123", name="Example Agent")
@@ -226,6 +228,8 @@ class Agent(XPanderSharedModel):
     use_oidc_pre_auth: Optional[bool] = False
     pre_auth_audiences: Optional[List[str]] = []
     use_oidc_pre_auth_token_for_llm: Optional[bool] = False
+    oidc_pre_auth_token_llm_audience: Optional[str] = None
+    oidc_pre_auth_token_mcp_audience: Optional[str] = None
 
     _connection_string: Optional[DatabaseConnectionString] = None
 
@@ -421,6 +425,7 @@ class Agent(XPanderSharedModel):
         additional_context: Optional[str] = None,
         instructions_override: Optional[str] = None,
         test_run_node_id: Optional[str] = None,
+        user_oidc_token: Optional[str] = None,
         expected_output: Optional[str] = None,
         mcp_servers: Optional[List[MCPServerDetails]] = [],
         triggering_agent_id: Optional[str] = None,
@@ -448,6 +453,7 @@ class Agent(XPanderSharedModel):
             additional_context (Optional[str]): Additional context to be passed to the agent.
             instructions_override (Optional[str]): Additional instructions to be appended to the agent's system prompt.
             test_run_node_id (Optional[str]): Internal test purpose workflow node id to execute.
+            user_oidc_token (Optional[str]): OIDC Token to be used for pre-auth.
             expected_output (Optional[str]): Expected output of the execution.
             mcp_servers (Optional[List[MCPServerDetails]]): Optional list of mcp servers to use.
             triggering_agent_id (Optional[str]): Optional triggering agent id.
@@ -485,6 +491,7 @@ class Agent(XPanderSharedModel):
                     "additional_context": additional_context,
                     "instructions_override": instructions_override,
                     "test_run_node_id": test_run_node_id,
+                    "user_oidc_token": user_oidc_token,
                     "expected_output": expected_output,
                     "mcp_servers": [server.model_dump() for server in mcp_servers],
                     "triggering_agent_id": triggering_agent_id,

xpander_sdk/modules/backend/frameworks/agno.py

@@ -43,7 +43,7 @@ async def build_agent_args(
     is_async: Optional[bool] = True,
     auth_events_callback: Optional[Callable] = None,
 ) -> Dict[str, Any]:
-    model = _load_llm_model(agent=xpander_agent, override=override)
+    model = _load_llm_model(agent=xpander_agent, override=override, task=task)
     args: Dict[str, Any] = {
         "id": xpander_agent.id,
         "store_events": True
@@ -576,7 +576,7 @@ def _configure_deep_planning_guidance(args: Dict[str, Any], agent: Agent, task:
         plan_str = task.deep_planning.model_dump_json() if task.deep_planning and task.deep_planning.enabled and len(task.deep_planning.tasks) != 0 else "No execution plan, please generate"
         args["additional_context"] += f" \n Current execution plan: {plan_str}"
 
-def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> Any:
+def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}, task: Optional[Task] = None) -> Any:
     """
     Load and configure the appropriate LLM model based on the agent's provider configuration.
 
@@ -613,6 +613,12 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
     has_custom_llm_key = (
         True if agent.llm_credentials and agent.llm_credentials.value else False
     )
+    
+    oidc_llm_token = None
+    
+    # OIDC pre-auth token claim by audience
+    if agent and agent.pre_auth_audiences and agent.use_oidc_pre_auth_token_for_llm and agent.oidc_pre_auth_token_llm_audience and task and task.user_tokens and isinstance(task.user_tokens, dict) and "oidc_tokens" in task.user_tokens and isinstance(task.user_tokens["oidc_tokens"], dict):
+        oidc_llm_token = task.user_tokens["oidc_tokens"].get(agent.oidc_pre_auth_token_llm_audience, None)
 
     def get_llm_key(env_var_name: str) -> Optional[str]:
         """
@@ -624,6 +630,11 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
         Returns:
             Optional[str]: The resolved API key or None if not available.
         """
+        
+        # return oidc claimed api key
+        if oidc_llm_token:
+            return oidc_llm_token
+        
         env_llm_key = getenv(env_var_name)
 
         # If no custom key available, use environment variable
@@ -641,6 +652,9 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
     
     llm_extra_headers = {}
     
+    if oidc_llm_token:
+        llm_extra_headers["x-oidc-token"] = oidc_llm_token
+    
     # Get organization default LLM extra headers
     api_client = APIClient(configuration=agent.configuration)
     org_default_llm_headers = run_sync(
@@ -975,27 +989,35 @@ async def _resolve_agent_tools(agent: Agent, task: Optional[Task] = None, auth_e
                 else StreamableHTTPClientParams
             )
             
-            # handle mcp auth
-            if mcp.auth_type == MCPServerAuthType.OAuth2:
-                if not task:
-                    raise ValueError("MCP server with OAuth authentication detected but task not sent")
-                
-                # check if we have user tokens for this mcp
-                graph_item = next((gi for gi in agent.graph.items if gi.type == AgentGraphItemType.MCP and gi.settings and gi.settings.mcp_settings and gi.settings.mcp_settings.url and gi.settings.mcp_settings.url == mcp.url), None)
-                if graph_item and task.user_tokens and isinstance(task.user_tokens, dict) and graph_item.id in task.user_tokens:
-                    mcp.api_key = task.user_tokens[graph_item.id]
-                else:
-                    if not task.input.user or not task.input.user.id:
-                        raise ValueError("MCP server with OAuth authentication detected but user id not set on the task (task.input.user.id)")
+            oidc_mcp_token = None
+            # OIDC pre-auth token claim by audience
+            if agent and agent.pre_auth_audiences and agent.oidc_pre_auth_token_mcp_audience and task and task.user_tokens and isinstance(task.user_tokens, dict) and "oidc_tokens" in task.user_tokens and isinstance(task.user_tokens["oidc_tokens"], dict):
+                oidc_mcp_token = task.user_tokens["oidc_tokens"].get(agent.oidc_pre_auth_token_mcp_audience, None)
+                if oidc_mcp_token and oidc_mcp_token != "__none__":
+                    mcp.api_key = oidc_mcp_token
+            
+            if not oidc_mcp_token:
+                # handle mcp auth
+                if mcp.auth_type == MCPServerAuthType.OAuth2:
+                    if not task:
+                        raise ValueError("MCP server with OAuth authentication detected but task not sent")
                     
-                    auth_result: MCPOAuthGetTokenResponse = await authenticate_mcp_server(mcp_server=mcp,task=task,user_id=task.input.user.id, auth_events_callback=auth_events_callback)
-                    if auth_result and auth_result.data and isinstance(auth_result.data, MCPOAuthGetTokenGenericResponse) and auth_result.data.message:
-                        raise ValueError(f"MCP authentication failed: {auth_result.data.message}")
-                    if not auth_result:
-                        raise ValueError("MCP Server authentication failed")
-                    if auth_result.type != MCPOAuthResponseType.TOKEN_READY:
-                        raise ValueError("MCP Server authentication timeout")
-                    mcp.api_key = auth_result.data.access_token
+                    # check if we have user tokens for this mcp
+                    graph_item = next((gi for gi in agent.graph.items if gi.type == AgentGraphItemType.MCP and gi.settings and gi.settings.mcp_settings and gi.settings.mcp_settings.url and gi.settings.mcp_settings.url == mcp.url), None)
+                    if graph_item and task.user_tokens and isinstance(task.user_tokens, dict) and graph_item.id in task.user_tokens:
+                        mcp.api_key = task.user_tokens[graph_item.id]
+                    else:
+                        if not task.input.user or not task.input.user.id:
+                            raise ValueError("MCP server with OAuth authentication detected but user id not set on the task (task.input.user.id)")
+                        
+                        auth_result: MCPOAuthGetTokenResponse = await authenticate_mcp_server(mcp_server=mcp,task=task,user_id=task.input.user.id, auth_events_callback=auth_events_callback)
+                        if auth_result and auth_result.data and isinstance(auth_result.data, MCPOAuthGetTokenGenericResponse) and auth_result.data.message:
+                            raise ValueError(f"MCP authentication failed: {auth_result.data.message}")
+                        if not auth_result:
+                            raise ValueError("MCP Server authentication failed")
+                        if auth_result.type != MCPOAuthResponseType.TOKEN_READY:
+                            raise ValueError("MCP Server authentication timeout")
+                        mcp.api_key = auth_result.data.access_token
             
             if mcp.api_key:
                 
@@ -1007,6 +1029,7 @@ async def _resolve_agent_tools(agent: Agent, task: Optional[Task] = None, auth_e
                 if not mcp.headers:
                     mcp.headers = {}
                 mcp.headers["Authorization"] = f"Bearer {mcp.api_key}"
+            
             mcp_tools.append(
                 MCPTools(
                     transport=transport,

xpander_sdk/modules/tasks/sub_modules/task.py

@@ -134,6 +134,7 @@ class Task(XPanderSharedModel):
         additional_context (Optional[str]): Additional context to be passed to the agent.
         instructions_override (Optional[str]): Additional instructions to be appended to the agent's system prompt.
         test_run_node_id (Optional[str]): Internal test purpose workflow node id to execute.
+        user_oidc_token (Optional[str]): OIDC Token to be used for pre-auth
         expected_output (Optional[str]): Expected output of the execution.
         mcp_servers (Optional[List[MCPServerDetails]]): Optional list of mcp servers to use.
         triggering_agent_id (Optional[str]): Optional triggering agent id.
@@ -184,6 +185,7 @@ class Task(XPanderSharedModel):
     additional_context: Optional[str] = None
     instructions_override: Optional[str] = None
     test_run_node_id: Optional[str] = None
+    user_oidc_token: Optional[str] = None
     expected_output: Optional[str] = (None,)
     mcp_servers: Optional[List[MCPServerDetails]] = ([],)
     triggering_agent_id: Optional[str] = (None,)

xpander_sdk/modules/tasks/tasks_module.py

@@ -236,6 +236,7 @@ class Tasks(ModuleBase):
         additional_context: Optional[str] = None,
         instructions_override: Optional[str] = None,
         test_run_node_id: Optional[str] = None,
+        user_oidc_token: Optional[str] = None,
         expected_output: Optional[str] = None,
         mcp_servers: Optional[List[MCPServerDetails]] = [],
         triggering_agent_id: Optional[str] = None,
@@ -267,6 +268,7 @@ class Tasks(ModuleBase):
             additional_context (Optional[str]): Additional context to be passed to the agent.
             instructions_override (Optional[str]): Additional instructions to be appended to the agent's system prompt.
             test_run_node_id (Optional[str]): Internal test purpose workflow node id to execute.
+            user_oidc_token (Optional[str]): OIDC Token to be used for pre-auth
             expected_output (Optional[str]): Expected output of the execution.
             mcp_servers (Optional[List[MCPServerDetails]]): Optional list of mcp servers to use.
             triggering_agent_id (Optional[str]): Optional triggering agent id.
@@ -315,6 +317,7 @@ class Tasks(ModuleBase):
                     "additional_context": additional_context,
                     "instructions_override": instructions_override,
                     "test_run_node_id": test_run_node_id,
+                    "user_oidc_token": user_oidc_token,
                     "expected_output": expected_output,
                     "mcp_servers": [server.model_dump() for server in mcp_servers],
                     "triggering_agent_id": triggering_agent_id,

{xpander_sdk-2.0.225.dist-info → xpander_sdk-2.0.227.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xpander-sdk
-Version: 2.0.225
+Version: 2.0.227
 Summary: xpander.ai Backend-as-a-service for AI Agents - SDK
 Home-page: https://www.xpander.ai
 Author: xpanderAI

{xpander_sdk-2.0.225.dist-info → xpander_sdk-2.0.227.dist-info}/RECORD

@@ -27,7 +27,7 @@ xpander_sdk/modules/agents/models/agent.py,sha256=9foTMH4UOfgT9mPfObpeRxHEJButyQ
 xpander_sdk/modules/agents/models/agent_list.py,sha256=byEayS2uLwDKaVT3lAHltrFocQFKpr8XEwQ6NTEEEMo,4081
 xpander_sdk/modules/agents/models/knowledge_bases.py,sha256=YimpjVJxWe8YTbGMD6oGQOA_YV8ztHQHTTBOaBB44ZM,1037
 xpander_sdk/modules/agents/sub_modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/agents/sub_modules/agent.py,sha256=4ZGoR4ouCquLCVmJ0Ma7e8E8wNCtrmFzWPk-fA_yXFQ,37909
+xpander_sdk/modules/agents/sub_modules/agent.py,sha256=EMiGgToBsENdN1lUU0OVx7bKIaMACQ9Klqot8oM9hmY,38347
 xpander_sdk/modules/agents/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/agents/utils/generic.py,sha256=XbG4OeHMQo4gVYCsasMlW_b8OoqS1xL3MlUZSjXivu0,81
 xpander_sdk/modules/backend/__init__.py,sha256=-NjikuZgHBhOM9xHML2vKsG0ICX9S2RKHktrWaODCBE,171
@@ -36,7 +36,7 @@ xpander_sdk/modules/backend/events_registry.py,sha256=d0V-lsz3I3G1QB643EM1i-a5oJ
 xpander_sdk/modules/backend/decorators/__init__.py,sha256=ub9c8G0Ll6AuCvfcFB6rqR8iamMJxtcW7QjWw3WSkPU,106
 xpander_sdk/modules/backend/decorators/on_auth_event.py,sha256=Xt_x9nncujMcF_SgM5hG6M-iZ6B-rDS97EPmgZkGdMk,4715
 xpander_sdk/modules/backend/frameworks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/backend/frameworks/agno.py,sha256=eAnfhIxk3cXmh0p18QXV6-A6Uzr-qznm_rM1w08DAB0,43898
+xpander_sdk/modules/backend/frameworks/agno.py,sha256=q0ImRrPYpYpGhZE2J0XqCYmXgZECRpgVqAGCkCVleDY,45336
 xpander_sdk/modules/backend/frameworks/dispatch.py,sha256=ht9hT5-cHATofQbWsbWeTARx51Hne3TNNNjw6KECRtA,1814
 xpander_sdk/modules/backend/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/backend/utils/mcp_oauth.py,sha256=5sYJcw557V3pSgutxUFzkBp5YxUJFUoB1V1rEe814pc,5430
@@ -62,12 +62,12 @@ xpander_sdk/modules/knowledge_bases/sub_modules/knowledge_base.py,sha256=0HTUYjC
 xpander_sdk/modules/knowledge_bases/sub_modules/knowledge_base_document_item.py,sha256=oLQApvsd573ZfYGV7Ji4XB5bNUyUFIeZWPIhZS1DIM4,1815
 xpander_sdk/modules/knowledge_bases/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/tasks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/tasks/tasks_module.py,sha256=-X5F8sPPFBZBnR9JCc5TbHz7yslBHKlCWMqaCEU2AHA,21070
+xpander_sdk/modules/tasks/tasks_module.py,sha256=uNb55iiqL3EkO1Nx3njK6veW_keJPdQn5eg2uXNj85c,21253
 xpander_sdk/modules/tasks/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/tasks/models/task.py,sha256=pYzXg0jnE6ft4pVFvxiVexO5eMUFkg1VxXybzFtL1ys,4483
 xpander_sdk/modules/tasks/models/tasks_list.py,sha256=8V1T0vCtGN79qLMPwe37pOA7Wvuf8pbJNOhWL0BPo-8,5126
 xpander_sdk/modules/tasks/sub_modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/tasks/sub_modules/task.py,sha256=XXRqvq71F7jEDhKw8BoZRzfzxqkVAzwfbJkBjgGlnUI,38259
+xpander_sdk/modules/tasks/sub_modules/task.py,sha256=29JJnMmGhRA4yAzimRpQB2z_bLEQjElsh2ZaSevLDXI,38377
 xpander_sdk/modules/tasks/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/tasks/utils/files.py,sha256=KqqwSQSrwim2-H3XP5wOadDDfngAyEI034tA7Oon-vc,3631
 xpander_sdk/modules/tools_repository/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -90,8 +90,8 @@ xpander_sdk/utils/generic.py,sha256=XrRj2-L8c0YWpfPdDyXE-pVL-6lKF9VpyZzKHQ4wuCc,
 xpander_sdk/utils/tools.py,sha256=lyFkq2yP7DxBkyXYVlnFRwDhQCvf0fZZMDm5fBycze4,1244
 xpander_sdk/utils/agents/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/utils/agents/compactization_agent.py,sha256=S_U1dSmDC7I0JUsp_THUYjfutEI5QMBaMPJEXGp0_Sw,14389
-xpander_sdk-2.0.225.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-xpander_sdk-2.0.225.dist-info/METADATA,sha256=NFRWC_OWuCPklj8nIEVdY7ni53OPGBK9Kvd4ucBsl94,17952
-xpander_sdk-2.0.225.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-xpander_sdk-2.0.225.dist-info/top_level.txt,sha256=UCjnxQpsMy5Zoe7lmRuVDO6DI2V_6PgRFfm4oizRbVs,12
-xpander_sdk-2.0.225.dist-info/RECORD,,
+xpander_sdk-2.0.227.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+xpander_sdk-2.0.227.dist-info/METADATA,sha256=GsWF2uvdIA45EhMTa_hv_zGPnpLRDyTkLNjwI7T_kHg,17952
+xpander_sdk-2.0.227.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+xpander_sdk-2.0.227.dist-info/top_level.txt,sha256=UCjnxQpsMy5Zoe7lmRuVDO6DI2V_6PgRFfm4oizRbVs,12
+xpander_sdk-2.0.227.dist-info/RECORD,,