$jrdZddlmZddlmZmZmZmZddlm Z GddeZ GddeZ d S) z*Built-in tenant extension implementations.) get_config)AuthenticationErrorTenant TenantContextTenantExtension)RequestContextc`eZdZdZdeeefffd ZdedefdZ de e fdZ xZ S)DefaultTenantExtensiona Default single-tenant extension with no authentication. This is the default extension used when no tenant extension is configured. It provides single-tenant behavior using the configured schema from HINDSIGHT_API_DATABASE_SCHEMA (defaults to 'public'). Features: - No authentication required (passes all requests) - Uses configured schema from environment - Perfect for single-tenant deployments without auth Configuration: HINDSIGHT_API_DATABASE_SCHEMA=your-schema (optional, defaults to 'public') This is automatically enabled by default. To use custom authentication, configure a different tenant extension: HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension configct||dtj|_dS)Nschema)super__init__getrdatabase_schema_schemaselfr __class__s o/home/rurouni/.hermes/hermes-agent/venv/lib/python3.11/site-packages/hindsight_api/extensions/builtin/tenant.pyrzDefaultTenantExtension.__init__s=    zz(JLL,HII contextreturnc0Kt|jS)z4Return configured schema without any authentication. schema_name)rrrrs r authenticatez#DefaultTenantExtension.authenticate#s6666rc2Kt|jgSz1Return configured schema for single-tenant setup.)r )rrrs r list_tenantsz#DefaultTenantExtension.list_tenants'sdl+++,,r)__name__ __module__ __qualname____doc__dictstrrrrrlistrr" __classcell__rs@rr r s(JtCH~JJJJJJ 7.7]7777-DL--------rr cpeZdZdZdeeefffd ZdedefdZ de e fdZ dedefdZ xZS) ApiKeyTenantExtensionaJ Built-in tenant extension that validates API key against an environment variable. This is a simple implementation that: 1. Validates the API key matches HINDSIGHT_API_TENANT_API_KEY 2. Returns the configured schema (HINDSIGHT_API_DATABASE_SCHEMA, default 'public') for all authenticated requests Configuration: HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension HINDSIGHT_API_TENANT_API_KEY=your-secret-key HINDSIGHT_API_DATABASE_SCHEMA=your-schema (optional, defaults to 'public') HINDSIGHT_API_TENANT_MCP_AUTH_DISABLED=true (optional, disable auth for MCP endpoints) For multi-tenant setups with separate schemas per tenant, implement a custom TenantExtension that looks up the schema based on the API key or token claims. r ct||d|_|jst d|dddv|_dS)Napi_keyzIHINDSIGHT_API_TENANT_API_KEY is required when using ApiKeyTenantExtensionmcp_auth_disabled)true1yes)rrrexpected_api_key ValueErrorlowerr0rs rrzApiKeyTenantExtension.__init__?sy    & 9 5 5$ jhii i!',?!D!D!J!J!L!LPd!drrrcK|j|jkrtdtt jS)z6Validate API key and return configured schema context.zInvalid API keyr)r/r5rrrrrs rrz"ApiKeyTenantExtension.authenticateGs= ?d3 3 3%&788 8)EFFFFrcJKttjgSr )rrrr!s rr"z"ApiKeyTenantExtension.list_tenantsMs!jll:;;;<r@s00++++++gggggggggggg//////!-!-!-!-!-_!-!-!-H.0.0.0.0.0O.0.0.0.0.0r