#j?dZddlZddlZddlmZmZddlmZmZddl m Z m Z m Z m Z ddlmZddlmZddlmZerdd lmZejeZGd d Zd Zd ZdeeefddfdZde dede fdZdS)u Configuration resolution with hierarchical overrides. Resolves config values through the hierarchy: Global (env vars) → Tenant config (via extension) → Bank config (database) Config values are resolved on every request to ensure consistency across multiple API servers. N)asdictreplace) TYPE_CHECKINGAny)RECALL_BUDGET_FUNCTIONSHindsightConfig_get_raw_confignormalize_config_dict)fq_table)TenantExtension)RequestContext)DatabaseBackendc eZdZdZddddedzfdZddededzd efd Z ddededzd e ee ffd Z ded e ee ffd Z dded e ee fdedzd dfdZded dfdZdS)ConfigResolverz?Resolves hierarchical configuration with tenant/bank overrides.Nbackendrtenant_extensionc||_||_t|_t j|_t j|_dS)z Initialize config resolver. Args: backend: Database backend for connection acquisition tenant_extension: Optional tenant extension for tenant-level config and permissions N) _backendrr _global_configrget_configurable_fields_configurable_fieldsget_credential_fields_credential_fields)selfrrs e/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/hindsight_api/config_resolver.py__init__zConfigResolver.__init__#sI  0-//$3$K$M$M!"1"G"I"Ibank_idcontextreturnc Ktj}jr|r j|d{V}|rt |}fd|D}||td|dt| n7#t$r*}t d|d|Yd}~nd}~wwxYw |d{V}|rT||td|dt| tdi|} | S)a Resolve full HindsightConfig for a bank with hierarchical overrides applied. This is for INTERNAL USE ONLY. Returns the complete config object with all fields including credentials and static fields. Use get_bank_config() for API responses. Resolution order: 1. Global config (from environment variables) 2. Tenant config overrides (from TenantExtension.get_tenant_config()) 3. Bank config overrides (from banks.config JSONB) Args: bank_id: Bank identifier context: Request context for tenant config resolution Returns: Complete HindsightConfig with hierarchical overrides applied Nc.i|]\}}|jv||Sr.0kvrs r z6ConfigResolver.resolve_full_config..Ns.*x*x*xDAqYZ^b^wYwYw1aYwYwYwrz)Applied tenant config overrides for bank : z&Failed to load tenant config for bank z'Applied bank config overrides for bank r#)rrrget_tenant_configr itemsupdateloggerdebuglistkeys Exceptionwarning_load_bank_configr) rrr config_dicttenant_overridesnormalized_tenantconfigurable_tenantebank_overridesresolved_configs ` rresolve_full_configz"ConfigResolver.resolve_full_config1s(T011   XW X X)-)>)P)PQX)Y)Y#Y#Y#Y#Y#Y#Y #(=>N(O(O%*x*x*x*x>>>>>>>  m   ~ . . . LLk7kkdSaSfSfShShNiNikk l l l*88K88sB%C C< C77C<c jK||d{V}t|}fd|D}fd|D}jr|r j||d{V^fd|D}t d|dtdt|dn7#t$r*}t d |d |Yd}~nd}~wwxYw|S) a Get fully resolved config for a bank (filtered by permissions). Resolution order: 1. Global config (from environment variables) 2. Tenant config overrides (from TenantExtension.get_tenant_config()) 3. Bank config overrides (from banks.config JSONB) Note: Config is resolved on every call (not cached) to ensure consistency across multiple API servers. SECURITY: - Only returns configurable fields (excludes static/infrastructure fields) - Filters out ALL credential fields (API keys, base URLs, etc.) - Further filtered by tenant/bank permissions if extension provides them Args: bank_id: Bank identifier context: Request context for tenant config resolution and permissions Returns: Dict of allowed configurable fields only (never includes credentials or static fields) Nc.i|]\}}|jv||Sr#r$r%s rr)z2ConfigResolver.get_bank_config..~s,[[[TQAAZ.s,ZZZTQ$BY9Y9YAq9Y9Y9Yrc$i|] \}}|v || Sr#r#)r&r'r(allowed_fieldss rr)z2ConfigResolver.get_bank_config..s)YYYAQ.EXEX1EXEXEXrz#Applied permission filter for bank z : allowed=z fields, returned=z fieldsz$Failed to load permissions for bank r*) r<rr,rget_allowed_config_fieldsr.r/lenr2r3)rrrr;r5filteredr9rAs` @rget_bank_configzConfigResolver.get_bank_configas2!% 8 8' J JJJJJJJ_-- \[[[[%6%6%8%8[[[[ZZZX^^%5%5ZZZ  VW V V'+'<'V'VW^`g'h'h!h!h!h!h!h!h!-YYYY1A1AYYYHLL;g;;QTUcQdQd;;$'MM;;; V V VTgTTQRTTUUUUUUUU Vs:BC<< D0 D++D0cVK j4d{V}|dtdd|d{V}|rz|drr|d}t |t rt j|}t|}fd| Dcdddd{VSdddd{Vn#1d{VswxYwYn7#t$r*}t d|d|Yd}~nd}~wwxYwiS) z Load bank config overrides from banks.config JSONB column. Args: bank_id: Bank identifier Returns: Dict of config overrides (only configurable fields, normalized keys) Nz( SELECT config FROM banksz( WHERE bank_id = $1 configc.i|]\}}|jv||Sr#r$r%s rr)z4ConfigResolver._load_bank_config..s,bbbTQ1HaCaCaAqCaCaCarzFailed to load bank config for r*) racquirefetchrowr isinstancestrjsonloadsr r,r2r.error)rrconnrow config_data normalizedr9s` rr4z ConfigResolver._load_bank_configso K},,.. c c c c c c c$ MM(0(9(9  c3x= c"%h-K"+s33>&*j&=&= "7{!C!CJcbbbZ-=-=-?-?bbb' c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c( K K K LLI7IIaII J J J J J J J J K sAC2BC ;C2C2 C**C2-C*.C22 D&< D!!D&updatesc Kt|}t||jz}|r t dt |dt||jz }|rtj}||z}|r_t dt |dt t|jdddt|jdt d t |d t t|jddd |j r|r |j ||d{V} | ot|| z } | rIt | r8d t | d t t| ddd ndnA#t$rt$r*} td|d| Yd} ~ nd} ~ wwxYwd|vrE|d=ddlm}  | |dn$#t$r} t d| d} ~ wwxYwd|vr+|dr#d|dD} | rt dt%||j4d{V}|dt-ddt/j||d{Vdddd{Vn#1d{VswxYwYtd|dt|dS)a" Update bank configuration overrides (with permission checking). Args: bank_id: Bank identifier updates: Dict of config field names to new values. Keys can be in env var format (HINDSIGHT_API_LLM_PROVIDER) or Python field format (llm_provider). Only configurable fields are allowed. context: Request context for permission checking Raises: ValueError: If attempting to override invalid/disallowed fields z&Cannot set credential fields via API: zE. Credentials (API keys, base URLs) must be set at server level only.z.Cannot override static (server-level) fields: zT. Only configurable fields can be overridden per-bank. Configurable fields include: N z ... (total: z fields)zUnknown configuration fields: z. Valid configurable fields: z...zNot allowed to modify fields: z. Your permissions allow: zkNot allowed to modify fields: {sorted(disallowed)}. Your permissions do not allow any config modifications.z%Failed to check permissions for bank r* entity_labels)parse_entity_labelszInvalid entity_labels format: retain_strategiescTg|]%}t|#|&Sr#)rMstrip)r&r's r z5ConfigResolver.update_bank_config..s3cccTWXYTZTZT`T`TbTbc!cccrzXStrategy names must not be empty strings. Remove entries with empty names before saving. UPDATE rGz SET config = config || $1::jsonb, updated_at = now() WHERE bank_id = $2 zUpdated bank config for )r setr1r ValueErrorsortedrrget_static_fieldsr0rCrrBr2r.r3engine.retain.entity_labelsrZ_validate_recall_budget_updatesrrJexecuter rNdumpsinfo)rrrUrnormalized_updatescredential_attemptsinvalid_fields static_fieldsinvalid_staticrA disallowedr9rZ empty_keysrQs rupdate_bank_configz!ConfigResolver.update_bank_configsN$37;;""4"9"9";";<W9X9XY\Z\Y\9]2^2^ddd   WW W W'+'<'V'VW^`g'h'h!h!h!h!h!h!h!-!$%7%<%<%>%>!?!?.!PJ!( .V^VJ=O=O^^7=d>>R>RSVTVSV>W7X7X^^^^"V     W W WUwUURSUUVVVVVVVV W 0 0 05G5X5d H H H H H H G##$6$GHHHH G G G !E!!E!EFFF G "4 4 49KL_9` 4cc%78K%LcccJ  n ((:;;;=((**       d,, ))  -..                                      [w[[$?Q?V?V?X?X:Y:Y[[\\\\\sDBG((H&< H!!H&<I I/I**I/AL"" L,/L,c&K|j4d{V}|dtdd|d{Vdddd{Vn#1d{VswxYwYtd|ddS)z Reset bank configuration to defaults (remove all overrides). Args: bank_id: Bank identifier Nr_rGz SET config = '{}'::jsonb, updated_at = now() WHERE bank_id = $1 zReset bank config for z to defaults)rrJrfr r.rh)rrrQs rreset_bank_configz ConfigResolver.reset_bank_configsF=((**       d,, ))                                     BWBBBCCCCCs.A"" A,/A,)N)__name__ __module__ __qualname____doc__r rrMr rr<dictrrEr4rprrr#rrrr s{II J J 1 J_W[E[ J J J J...~PT?T.`o....`//S/>D;P/\`adfiai\j////b"s"tCH~""""JW[c]c]c]%)#s(^c]>Lt>Sc] c]c]c]c]JDsDtDDDDDDrr)recall_budget_fixed_lowrecall_budget_fixed_midrecall_budget_fixed_high)recall_budget_adaptive_lowrecall_budget_adaptive_midrecall_budget_adaptive_highrUr cld|vr_|d}t|tr|tvr't dt td|t D]R}||vrL||}t|trt|ts|dkrt |d|StD]Y}||vrS||}t|ts"t|ttfr|dkrt |d|ZdD]R}||vrL||}t|trt|ts|dkrt |d|Sd |vr8d |vr6|d |d kr&t d |d d |d d dSdSdS)zJValidate recall budget config updates. Raises ValueError on invalid input.recall_budget_functionz&recall_budget_function must be one of z, got rYz! must be a positive integer, got rz must be a positive number, got )recall_budget_minrecall_budget_maxrrzrecall_budget_min (z ) must be <= recall_budget_max ()N) rLrMlowerrrarb_RECALL_BUDGET_FIXED_KEYSintbool_RECALL_BUDGET_ADAPTIVE_KEYSfloat)rUfunctionkeyvalues rrere<sI7**34(C(( HNN,<,>CLEeS)) UZt-D-D UPQ  C!S!S%!S!STTT+TT '>>CLE%&& Tje .M.M TQVZ[Q[Q[ C!R!R!R!RSSS9UU '>>CLEeS)) UZt-D-D UPQ  C!S!S%!S!STTTg%%*=*H*H & ''2E*F F FFg.A&BFF&-.A&BFFF &%*H*H F FrrH strategy_namec |jpi}||vr td|d|S||}t|ts td|d|St jfd|D}|s|Std|dt| t|fi|S)a Apply a named retain strategy's overrides on top of a resolved config. A strategy is a named set of hierarchical field overrides stored in config.retain_strategies. Any field in _HIERARCHICAL_FIELDS can be overridden, including retain_extraction_mode, retain_chunk_size, entity_labels, entities_allow_free_form, etc. Unknown strategy names log a warning and return config unchanged. Unknown or non-hierarchical fields in the strategy are silently ignored. zUnknown retain strategy 'z', using resolved config as-iszRetain strategy 'z' is not a dict, skippingc$i|] \}}|v || Sr#r#)r&r'r( configurables rr)z"apply_strategy..vs)HHHAa<6G6G16G6G6GrzApplying retain strategy 'z': ) r[r.r3rLrwrrr,r/r0r1r)rHr strategies overridesrDrs @rapply_strategyr_s)/RJJ&&`=```aaa =)I i & &S=SSSTTT ":<rs ''''''''%%%%%%%% 877777;;;;;;//////=<<<<<<  8 $ $MDMDMDMDMDMDMDMD`   T#s(^     F'?'3'?''''''r