$jjdZddlmZmZddlmZddlmZddlm Z ddl m Z Gdde Z eGd d ZeGd d ZGd de eZdS)z>Tenant Extension for multi-tenancy and API key authentication.)ABCabstractmethod) dataclass)Any) Extension)RequestContextcDeZdZdZddedeeefdzffd ZxZS)AuthenticationErrorz!Raised when authentication fails.Nreasonheaderscp||_|pi|_td|dS)NzAuthentication failed: )r r super__init__)selfr r __class__s g/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/hindsight_api/extensions/tenant.pyrzAuthenticationError.__init__s< }"  ;6;;<<<<<)N)__name__ __module__ __qualname____doc__strdictr __classcell__)rs@rr r sc++==s=T#s(^d-B==========rr ceZdZUdZeed<dS) TenantContextz Tenant context returned by authentication. Contains the PostgreSQL schema name for tenant isolation. All database queries will use fully-qualified table names with this schema (e.g., schema_name.memory_units). schema_nameNrrrrr__annotations__rrrrs*rrceZdZUdZeed<dS)Tenantz Represents a tenant for worker discovery. Used by list_tenants() to return tenant information including the PostgreSQL schema name for database operations. schemaNrr rrr"r"!s% KKKKKrr"ceZdZdZededefdZedee fdZ dede e e ffdZdede dee dzfd Zdedefd ZdS) TenantExtensiona Extension for multi-tenancy and API key authentication. This extension validates incoming requests and returns the tenant context including the PostgreSQL schema to use for database operations. Built-in implementation: hindsight_api.extensions.builtin.tenant.ApiKeyTenantExtension Enable via environment variable: HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension HINDSIGHT_API_TENANT_API_KEY=your-secret-key The returned schema_name is used for fully-qualified table names in queries, enabling tenant isolation at the database level. contextreturnc KdS)aP Authenticate the action context and return tenant context. Args: context: The action context containing API key and other auth data. Returns: TenantContext with the schema_name for database operations. Raises: AuthenticationError: If authentication fails. Nr rr&s r authenticatezTenantExtension.authenticate?s  rc KdS)a List all tenants that should be processed by workers. This method is used by the worker to discover all tenants that need task polling. Workers will poll for pending tasks in each tenant's schema. Returns: List of Tenant objects containing schema information. For single-tenant setups, return [Tenant(schema="public")]. Nr )rs r list_tenantszTenantExtension.list_tenantsOs  rc KiS)a, Get tenant-specific configuration overrides. This method is called during hierarchical configuration resolution to get tenant-level config overrides. The returned dict should contain Python field names (lowercase snake_case) as keys, not environment variable names. Example: {"llm_model": "gpt-4", "retain_extraction_mode": "verbose"} The default implementation returns an empty dict (no tenant-specific config). Override this method in custom extensions to provide tenant-specific configuration. Args: context: The request context containing tenant information. Returns: Dict of config field names to values (only configurable fields). Empty dict if no tenant-specific config. r r)s rget_tenant_configz!TenantExtension.get_tenant_config]s * rbank_idNc KdS)a Get set of config fields that this tenant/bank is allowed to modify. This method controls which configurable fields can be modified via the bank config API. It enables fine-grained permission control per tenant or per bank. Examples: - Return None: Allow all configurable fields (default) - Return {"retain_chunk_size", "retain_custom_instructions"}: Allow only these fields - Return set(): Allow no modifications (read-only) The default implementation returns None (all configurable fields allowed). Override this method in custom extensions to implement custom permission logic. Args: context: The request context containing tenant information. bank_id: The bank identifier for per-bank permissions. Returns: Set of allowed field names, or None to allow all configurable fields. Returned fields must be a subset of HindsightConfig.get_configurable_fields(). Nr )rr&r/s rget_allowed_config_fieldsz)TenantExtension.get_allowed_config_fieldsts .trc<K||d{VS)a Authenticate MCP requests. By default, this calls authenticate(). Override this method to provide different authentication behavior for MCP endpoints (e.g., to disable auth for backwards compatibility with existing MCP servers). Args: context: The action context containing API key and other auth data. Returns: TenantContext with the schema_name for database operations. Raises: AuthenticationError: If authentication fails. N)r*r)s rauthenticate_mcpz TenantExtension.authenticate_mcps."&&w/////////r)rrrrrrrr*listr"r,rrrr.setr1r3r rrr%r%-s"  .  ]    ^    DL    ^  ~$sCx..~PSX[\_X`cgXg20n0000000rr%N)rabcrr dataclassesrtypingrhindsight_api.extensions.baserhindsight_api.modelsr Exceptionr rr"r%r rrr<s=DD########!!!!!!333333//////=====)===            q0q0q0q0q0iq0q0q0q0q0r