xpander-sdk 2.0.226__py3-none-any.whl → 2.0.227__py3-none-any.whl

xpander_sdk/modules/agents/sub_modules/agent.py

@@ -175,6 +175,8 @@ class Agent(XPanderSharedModel):
             use_oidc_pre_auth: Optional[bool] = False
             pre_auth_audiences: Optional[List[str]] = []
             use_oidc_pre_auth_token_for_llm: Optional[bool] = False
+            oidc_pre_auth_token_mcp_audience: Optional[bool] = False
+            oidc_pre_auth_token_llm_audience: Optional[str] = None
 
         Example:
             >>> agent = Agent(id="agent123", name="Example Agent")
@@ -226,6 +228,8 @@ class Agent(XPanderSharedModel):
     use_oidc_pre_auth: Optional[bool] = False
     pre_auth_audiences: Optional[List[str]] = []
     use_oidc_pre_auth_token_for_llm: Optional[bool] = False
+    oidc_pre_auth_token_llm_audience: Optional[str] = None
+    oidc_pre_auth_token_mcp_audience: Optional[str] = None
 
     _connection_string: Optional[DatabaseConnectionString] = None
 

xpander_sdk/modules/backend/frameworks/agno.py

@@ -43,7 +43,7 @@ async def build_agent_args(
     is_async: Optional[bool] = True,
     auth_events_callback: Optional[Callable] = None,
 ) -> Dict[str, Any]:
-    model = _load_llm_model(agent=xpander_agent, override=override)
+    model = _load_llm_model(agent=xpander_agent, override=override, task=task)
     args: Dict[str, Any] = {
         "id": xpander_agent.id,
         "store_events": True
@@ -576,7 +576,7 @@ def _configure_deep_planning_guidance(args: Dict[str, Any], agent: Agent, task:
         plan_str = task.deep_planning.model_dump_json() if task.deep_planning and task.deep_planning.enabled and len(task.deep_planning.tasks) != 0 else "No execution plan, please generate"
         args["additional_context"] += f" \n Current execution plan: {plan_str}"
 
-def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> Any:
+def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}, task: Optional[Task] = None) -> Any:
     """
     Load and configure the appropriate LLM model based on the agent's provider configuration.
 
@@ -613,6 +613,12 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
     has_custom_llm_key = (
         True if agent.llm_credentials and agent.llm_credentials.value else False
     )
+    
+    oidc_llm_token = None
+    
+    # OIDC pre-auth token claim by audience
+    if agent and agent.pre_auth_audiences and agent.use_oidc_pre_auth_token_for_llm and agent.oidc_pre_auth_token_llm_audience and task and task.user_tokens and isinstance(task.user_tokens, dict) and "oidc_tokens" in task.user_tokens and isinstance(task.user_tokens["oidc_tokens"], dict):
+        oidc_llm_token = task.user_tokens["oidc_tokens"].get(agent.oidc_pre_auth_token_llm_audience, None)
 
     def get_llm_key(env_var_name: str) -> Optional[str]:
         """
@@ -624,6 +630,11 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
         Returns:
             Optional[str]: The resolved API key or None if not available.
         """
+        
+        # return oidc claimed api key
+        if oidc_llm_token:
+            return oidc_llm_token
+        
         env_llm_key = getenv(env_var_name)
 
         # If no custom key available, use environment variable
@@ -641,6 +652,9 @@ def _load_llm_model(agent: Agent, override: Optional[Dict[str, Any]] = {}) -> An
     
     llm_extra_headers = {}
     
+    if oidc_llm_token:
+        llm_extra_headers["x-oidc-token"] = oidc_llm_token
+    
     # Get organization default LLM extra headers
     api_client = APIClient(configuration=agent.configuration)
     org_default_llm_headers = run_sync(
@@ -975,27 +989,35 @@ async def _resolve_agent_tools(agent: Agent, task: Optional[Task] = None, auth_e
                 else StreamableHTTPClientParams
             )
             
-            # handle mcp auth
-            if mcp.auth_type == MCPServerAuthType.OAuth2:
-                if not task:
-                    raise ValueError("MCP server with OAuth authentication detected but task not sent")
-                
-                # check if we have user tokens for this mcp
-                graph_item = next((gi for gi in agent.graph.items if gi.type == AgentGraphItemType.MCP and gi.settings and gi.settings.mcp_settings and gi.settings.mcp_settings.url and gi.settings.mcp_settings.url == mcp.url), None)
-                if graph_item and task.user_tokens and isinstance(task.user_tokens, dict) and graph_item.id in task.user_tokens:
-                    mcp.api_key = task.user_tokens[graph_item.id]
-                else:
-                    if not task.input.user or not task.input.user.id:
-                        raise ValueError("MCP server with OAuth authentication detected but user id not set on the task (task.input.user.id)")
+            oidc_mcp_token = None
+            # OIDC pre-auth token claim by audience
+            if agent and agent.pre_auth_audiences and agent.oidc_pre_auth_token_mcp_audience and task and task.user_tokens and isinstance(task.user_tokens, dict) and "oidc_tokens" in task.user_tokens and isinstance(task.user_tokens["oidc_tokens"], dict):
+                oidc_mcp_token = task.user_tokens["oidc_tokens"].get(agent.oidc_pre_auth_token_mcp_audience, None)
+                if oidc_mcp_token and oidc_mcp_token != "__none__":
+                    mcp.api_key = oidc_mcp_token
+            
+            if not oidc_mcp_token:
+                # handle mcp auth
+                if mcp.auth_type == MCPServerAuthType.OAuth2:
+                    if not task:
+                        raise ValueError("MCP server with OAuth authentication detected but task not sent")
                     
-                    auth_result: MCPOAuthGetTokenResponse = await authenticate_mcp_server(mcp_server=mcp,task=task,user_id=task.input.user.id, auth_events_callback=auth_events_callback)
-                    if auth_result and auth_result.data and isinstance(auth_result.data, MCPOAuthGetTokenGenericResponse) and auth_result.data.message:
-                        raise ValueError(f"MCP authentication failed: {auth_result.data.message}")
-                    if not auth_result:
-                        raise ValueError("MCP Server authentication failed")
-                    if auth_result.type != MCPOAuthResponseType.TOKEN_READY:
-                        raise ValueError("MCP Server authentication timeout")
-                    mcp.api_key = auth_result.data.access_token
+                    # check if we have user tokens for this mcp
+                    graph_item = next((gi for gi in agent.graph.items if gi.type == AgentGraphItemType.MCP and gi.settings and gi.settings.mcp_settings and gi.settings.mcp_settings.url and gi.settings.mcp_settings.url == mcp.url), None)
+                    if graph_item and task.user_tokens and isinstance(task.user_tokens, dict) and graph_item.id in task.user_tokens:
+                        mcp.api_key = task.user_tokens[graph_item.id]
+                    else:
+                        if not task.input.user or not task.input.user.id:
+                            raise ValueError("MCP server with OAuth authentication detected but user id not set on the task (task.input.user.id)")
+                        
+                        auth_result: MCPOAuthGetTokenResponse = await authenticate_mcp_server(mcp_server=mcp,task=task,user_id=task.input.user.id, auth_events_callback=auth_events_callback)
+                        if auth_result and auth_result.data and isinstance(auth_result.data, MCPOAuthGetTokenGenericResponse) and auth_result.data.message:
+                            raise ValueError(f"MCP authentication failed: {auth_result.data.message}")
+                        if not auth_result:
+                            raise ValueError("MCP Server authentication failed")
+                        if auth_result.type != MCPOAuthResponseType.TOKEN_READY:
+                            raise ValueError("MCP Server authentication timeout")
+                        mcp.api_key = auth_result.data.access_token
             
             if mcp.api_key:
                 
@@ -1007,6 +1029,7 @@ async def _resolve_agent_tools(agent: Agent, task: Optional[Task] = None, auth_e
                 if not mcp.headers:
                     mcp.headers = {}
                 mcp.headers["Authorization"] = f"Bearer {mcp.api_key}"
+            
             mcp_tools.append(
                 MCPTools(
                     transport=transport,

{xpander_sdk-2.0.226.dist-info → xpander_sdk-2.0.227.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xpander-sdk
-Version: 2.0.226
+Version: 2.0.227
 Summary: xpander.ai Backend-as-a-service for AI Agents - SDK
 Home-page: https://www.xpander.ai
 Author: xpanderAI

{xpander_sdk-2.0.226.dist-info → xpander_sdk-2.0.227.dist-info}/RECORD

@@ -27,7 +27,7 @@ xpander_sdk/modules/agents/models/agent.py,sha256=9foTMH4UOfgT9mPfObpeRxHEJButyQ
 xpander_sdk/modules/agents/models/agent_list.py,sha256=byEayS2uLwDKaVT3lAHltrFocQFKpr8XEwQ6NTEEEMo,4081
 xpander_sdk/modules/agents/models/knowledge_bases.py,sha256=YimpjVJxWe8YTbGMD6oGQOA_YV8ztHQHTTBOaBB44ZM,1037
 xpander_sdk/modules/agents/sub_modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/agents/sub_modules/agent.py,sha256=hNy-FvOQy0Eh6jpqWy-MRVLc9UnAqQcbCZ11UEzk0oQ,38093
+xpander_sdk/modules/agents/sub_modules/agent.py,sha256=EMiGgToBsENdN1lUU0OVx7bKIaMACQ9Klqot8oM9hmY,38347
 xpander_sdk/modules/agents/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/agents/utils/generic.py,sha256=XbG4OeHMQo4gVYCsasMlW_b8OoqS1xL3MlUZSjXivu0,81
 xpander_sdk/modules/backend/__init__.py,sha256=-NjikuZgHBhOM9xHML2vKsG0ICX9S2RKHktrWaODCBE,171
@@ -36,7 +36,7 @@ xpander_sdk/modules/backend/events_registry.py,sha256=d0V-lsz3I3G1QB643EM1i-a5oJ
 xpander_sdk/modules/backend/decorators/__init__.py,sha256=ub9c8G0Ll6AuCvfcFB6rqR8iamMJxtcW7QjWw3WSkPU,106
 xpander_sdk/modules/backend/decorators/on_auth_event.py,sha256=Xt_x9nncujMcF_SgM5hG6M-iZ6B-rDS97EPmgZkGdMk,4715
 xpander_sdk/modules/backend/frameworks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-xpander_sdk/modules/backend/frameworks/agno.py,sha256=eAnfhIxk3cXmh0p18QXV6-A6Uzr-qznm_rM1w08DAB0,43898
+xpander_sdk/modules/backend/frameworks/agno.py,sha256=q0ImRrPYpYpGhZE2J0XqCYmXgZECRpgVqAGCkCVleDY,45336
 xpander_sdk/modules/backend/frameworks/dispatch.py,sha256=ht9hT5-cHATofQbWsbWeTARx51Hne3TNNNjw6KECRtA,1814
 xpander_sdk/modules/backend/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/modules/backend/utils/mcp_oauth.py,sha256=5sYJcw557V3pSgutxUFzkBp5YxUJFUoB1V1rEe814pc,5430
@@ -90,8 +90,8 @@ xpander_sdk/utils/generic.py,sha256=XrRj2-L8c0YWpfPdDyXE-pVL-6lKF9VpyZzKHQ4wuCc,
 xpander_sdk/utils/tools.py,sha256=lyFkq2yP7DxBkyXYVlnFRwDhQCvf0fZZMDm5fBycze4,1244
 xpander_sdk/utils/agents/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 xpander_sdk/utils/agents/compactization_agent.py,sha256=S_U1dSmDC7I0JUsp_THUYjfutEI5QMBaMPJEXGp0_Sw,14389
-xpander_sdk-2.0.226.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-xpander_sdk-2.0.226.dist-info/METADATA,sha256=r6ATsBbKKNEDbMLLT4W2XbVgj7MLCkhpk-SjvWu_QUc,17952
-xpander_sdk-2.0.226.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-xpander_sdk-2.0.226.dist-info/top_level.txt,sha256=UCjnxQpsMy5Zoe7lmRuVDO6DI2V_6PgRFfm4oizRbVs,12
-xpander_sdk-2.0.226.dist-info/RECORD,,
+xpander_sdk-2.0.227.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+xpander_sdk-2.0.227.dist-info/METADATA,sha256=GsWF2uvdIA45EhMTa_hv_zGPnpLRDyTkLNjwI7T_kHg,17952
+xpander_sdk-2.0.227.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+xpander_sdk-2.0.227.dist-info/top_level.txt,sha256=UCjnxQpsMy5Zoe7lmRuVDO6DI2V_6PgRFfm4oizRbVs,12
+xpander_sdk-2.0.227.dist-info/RECORD,,