tjx PddlmZddlZddlZddlmZmZddlmZm Z ej de j Z ej de j ZGdd Zej d d ZGd dejeZej dd ZGddejeZej dd Zej dd Zej dd Zej dd Zej dd ZGddejeeeeefZGddee je je je je j fZ!Gddee j"e j#e j$e j%e j&fZ'Gddee j(e j)e j*e j+e j,fZ-Gd d!ejeZ.Gd"d#Z/ej d$ee0e1ej2fZ3Gd%d&Z4d7d.Z5d8d1Z6d9d5Z7gd6Z8dS):) annotationsN)CallableSequence) exceptionstypesTH)boundAHc2eZdZdZdZeZ eZ d dZd dZd S) AuthaAdd custom authentication and authorization management to your LangGraph application. The Auth class provides a unified system for handling authentication and authorization in LangGraph applications. It supports custom user authentication protocols and fine-grained authorization rules for different resources and actions. To use, create a separate python file and add the path to the file to your LangGraph API configuration file (`langgraph.json`). Within that file, create an instance of the Auth class and register authentication and authorization handlers as needed. Example `langgraph.json` file: ```json { "dependencies": ["."], "graphs": { "agent": "./my_agent/agent.py:graph" }, "env": ".env", "auth": { "path": "./auth.py:my_auth" } ``` Then the LangGraph server will load your auth file and run it server-side whenever a request comes in. ???+ example "Basic Usage" ```python from langgraph_sdk import Auth my_auth = Auth() @my_auth.authenticate async def authenticate(authorization: str) -> Auth.types.MinimalUserDict: user = await verify_token(authorization) # Your token verification logic if not user: raise Auth.exceptions.HTTPException( status_code=401, detail="Unauthorized" ) return { "identity": user["id"], "permissions": user.get("permissions", []), } # Default deny: reject all requests that don't have a specific handler @my_auth.on async def deny_all(ctx: Auth.types.AuthContext, value: Any) -> False: return False # Allow users to create threads with their own identity as owner @my_auth.on.threads.create async def allow_thread_create( ctx: Auth.types.AuthContext, value: Auth.types.on.threads.create.value ): metadata = value.setdefault("metadata", {}) metadata["owner"] = ctx.user.identity # Allow users to read and search their own threads @my_auth.on.threads.read async def allow_thread_read( ctx: Auth.types.AuthContext, value: Auth.types.on.threads.read.value ) -> Auth.types.FilterType: return {"owner": ctx.user.identity} @my_auth.on.threads.search async def allow_thread_search( ctx: Auth.types.AuthContext, value: Auth.types.on.threads.search.value ) -> Auth.types.FilterType: return {"owner": ctx.user.identity} # Scope all store operations to the user's namespace @my_auth.on.store async def scope_store(ctx: Auth.types.AuthContext, value: Auth.types.on.store.value): namespace = tuple(value["namespace"]) if value.get("namespace") else () if not namespace or namespace[0] != ctx.user.identity: namespace = (ctx.user.identity, *namespace) value["namespace"] = namespace ``` ???+ note "Request Processing Flow" 1. Authentication (your `@auth.authenticate` handler) is performed first on **every request** 2. For authorization, the most specific matching handler is called: * If a handler exists for the exact resource and action, it is used (e.g., `@auth.on.threads.create`) * Otherwise, if a handler exists for the resource with any action, it is used (e.g., `@auth.on.threads`) * Finally, if no specific handlers match, the global handler is used (e.g., `@auth.on`) * If no global handler is set, the request is accepted This allows you to set default behavior with a global handler while overriding specific routes as needed. )_authenticate_handler_global_handlers_handler_cache _handlersonreturnNonecht||_ i|_g|_d|_i|_dSN)_Onrrrr r)selfs Y/var/www/html/CA-Chatbot/venv/lib/python3.11/site-packages/langgraph_sdk/auth/__init__.py__init__z Auth.__init__s?d))V rFH57AE"DFfnr cR|jtd|jd||_|S)a Register an authentication handler function. The authentication handler is responsible for verifying credentials and returning user scopes. It can accept any of the following parameters by name: - request (Request): The raw ASGI request object - path (str): The request path, e.g., "/threads/abcd-1234-abcd-1234/runs/abcd-1234-abcd-1234/stream" - method (str): The HTTP method, e.g., "GET" - path_params (dict[str, str]): URL path parameters, e.g., {"thread_id": "abcd-1234-abcd-1234", "run_id": "abcd-1234-abcd-1234"} - query_params (dict[str, str]): URL query parameters, e.g., {"stream": "true"} - headers (dict[bytes, bytes]): Request headers - authorization (str | None): The Authorization header value (e.g., "Bearer ") Args: fn: The authentication handler function to register. Must return a representation of the user. This could be a: - string (the user id) - dict containing {"identity": str, "permissions": list[str]} - or an object with identity and permissions properties Permissions can be optionally used by your handlers downstream. Returns: The registered handler function. Raises: ValueError: If an authentication handler is already registered. ???+ example "Examples" Basic token authentication: ```python @auth.authenticate async def authenticate(authorization: str) -> str: user_id = verify_token(authorization) return user_id ``` Accept the full request context: ```python @auth.authenticate async def authenticate( method: str, path: str, headers: dict[str, bytes] ) -> str: user = await verify_request(method, path, headers) return user ``` Return user name and permissions: ```python @auth.authenticate async def authenticate( method: str, path: str, headers: dict[str, bytes] ) -> Auth.types.MinimalUserDict: permissions, user = await verify_request(method, path, headers) # Permissions could be things like ["runs:read", "runs:write", "threads:read", "threads:write"] return { "identity": user["id"], "permissions": permissions, "display_name": user["name"], } ``` Nz&Authentication handler already set as .)r ValueErrorrrs r authenticatezAuth.authenticates@N  % 1V9SVVV &(" rN)rr)rr rr ) __name__ __module__ __qualname____doc__ __slots__rrrr rrr r sw]]~I E0 J ^G^G^G^G@LLLLLLrr VT) contravariantceZdZd dZdS) _ActionHandlerctxtypes.AuthContextvaluer'rtypes.HandlerResultc KdSrr&)rr+r-s r__call__z_ActionHandler.__call__6s !crN)r+r,r-r'rr.)r!r"r#r0r&rrr*r*5s(""""""rr*T) covariantceZdZdd ZddZdS)_ResourceActionOnauthr resource0typing.Literal['threads', 'crons', 'assistants']actionLtyping.Literal['create', 'read', 'update', 'delete', 'search', 'create_run']r-type[T]rrc>||_||_||_||_dSr)r5r6r8r-)rr5r6r8r-s rrz_ResourceActionOn.__init__?s$     rr_ActionHandler[T]cft|t|j|j|j||Sr)_validate_handler_register_handlerr5r6r8rs rr0z_ResourceActionOn.__call__Ms/"$)T]DKDDD rN) r5r r6r7r8r9r-r:rrrr<rr<)r!r"r#rr0r&rrr4r4>s<    rr4VCreateVUpdateVReadVDeleteVSearchceZdZUdZded<ded<ded<ded <d ed <d ed <d%dZejd&dZejddd'd Z d(ddd!d)d$ZdS)* _ResourceOnz< Generic base class for resource-specific handlers. z3type[VCreate | VUpdate | VRead | VDelete | VSearch]r-z type[VCreate]Createz type[VRead]Readz type[VUpdate]Updatez type[VDelete]Deletez type[VSearch]Searchr5r r6r7rrc:||_||_t||d|j|_t||d|j|_t||d|j|_t||d|j |_ t||d|j |_ dS)Ncreatereadupdatedeletesearch) r5r6r4rHrNrIrOrJrPrKrQrLrR)rr5r6s rrz_ResourceOn.__init__gs    2C (Hdk3 3  /@ (FDI/ /  3D (Hdk3 3  3D (Hdk3 3  3D (Hdk3 3  rre_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch] | _ActionHandler[dict[str, typing.Any]]=_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]cdSrr&rs rr0z_ResourceOn.__call__~s ILrNactions resourcesstr | Sequence[str]rWstr | Sequence[str] | NoneCallable[[_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]], _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]]cdSrr&rrXrWs rr0z_ResourceOn.__call__s  srrXrWl_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch] | _ActionHandler[dict[str, typing.Any]] | None_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch] | Callable[[_ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]], _ActionHandler[VCreate | VUpdate | VRead | VDelete | VSearch]]c |>t|tjdtjjd|Sdfd }||f}|S)NrT*handlerrc t|tjdtjjd|S)NrTrbr>typingcastr?r5r6)rcrs r decoratorz'_ResourceOn.__call__..decorators? g & & &;O!$)T]CII r)rcrTrrTre)rrrXrWrh_s` rr0z_ResourceOn.__call__st" > b ! ! !;O!$)T]CDD         w rr5r r6r7rr)rrSrrT)rXrYrWrZrr[r)rr_rXrZrWrZrr`) r!r"r#r$__annotations__rrfoverloadr0r&rrrGrGZs?>>>    . _LLL_L _ /3      _  #15.2########rrGceZdZejejzejzejzejzZ ejZ ejZ ejZ ejZ ejZdS) _AssistantsOnN)r!r"r#rAssistantsCreateAssistantsReadAssistantsUpdateAssistantsDeleteAssistantsSearchr-rHrIrJrKrLr&rrrnrnsu       !   !   !  #F  D  #F  #F  #FFFrrnceZdZejejzejzejzejzej zZ ejZ ejZ ejZ ejZejZej Zdfd ZxZS) _ThreadsOnr5r r6r7rrct||t||d|j|_dS)N create_run)superrr4 CreateRunrw)rr5r6 __class__s rrz_ThreadsOn.__init__sA x(((?P (L$.@ @ rrj)r!r"r#r ThreadsCreate ThreadsRead ThreadsUpdate ThreadsDelete ThreadsSearch RunsCreater-rHrIrJrKrLryr __classcell__)rzs@rrurus                    F  D  F  F  F I          rruceZdZeejejzejzejzej zZ ejZ ejZ ejZ ejZej ZdS)_CronsOnN)r!r"r#typer CronsCreate CronsRead CronsUpdate CronsDelete CronsSearchr-rHrIrJrKrLr&rrrrsx   /            E F ?D  F  F  FFFrrc"eZdZdZdd Zdd ZdS)_StoreActionOnz@Decorator for registering a handler for a specific store action.r5r r8Ctyping.Literal['put', 'get', 'search', 'delete', 'list_namespaces']r-r:rrc0||_||_||_dSr)r5r8r-)rr5r8r-s rrz_StoreActionOn.__init__ s    rrr<c\t|t|jd|j||S)Nstore)r>r?r5r8rs rr0z_StoreActionOn.__call__s-"$)Wdk2>>> rN)r5r r8rr-r:rrr@)r!r"r#r$rr0r&rrrr sBJJrrcreZdZddZejdddd ZejddZ dddddZdS)_StoreOnr5r rrc\||_t|dtj|_ t|dtj|_ t|dtj|_ t|dtj |_ t|dtj |_ dS)NputgetrRrQlist_namespaces) _authrrStorePutrStoreGetr StoreSearchrR StoreDeleterQStoreListNamespacesrrr5s rrz_StoreOn.__init__s !$u~>> "$u~>> %T8U5FGG  %T8U5FGG   . #U%>   rNrVrWtyping.Literal['put', 'get', 'search', 'list_namespaces', 'delete'] | Sequence[typing.Literal['put', 'get', 'search', 'list_namespaces', 'delete']] | NoneCallable[[AHO], AHO]cdSrr&)rrWs rr0z_StoreOn.__call__is  #srrAHOcdSrr&rs rr0z_StoreOn.__call__v(+r AHO | NoneAHO | Callable[[AHO], AHO]cN|tjdd||Sdfd }|S)aRegister a handler for specific resources and actions. Can be used as a decorator or with explicit resource/action parameters: @auth.on.store async def handler(): ... # Handle all store ops @auth.on.store(actions=("put", "get", "search", "delete")) async def handler(): ... # Handle specific store ops @auth.on.store.put async def handler(): ... # Handle store.put ops Nrrcrrcttrg}ntndg}|D]}tjd|||S)Nrbr isinstancestrlistr?r)rc action_listr8rWrs rrhz$_StoreOn.__call__..decoratorsf'3'' N&i /6/Bd7mmm % H H!$*gvwGGGGNrrcrrrr?r)rrrWrhs` ` rr0z_StoreOn.__call__ysQ2 > dj'4 < < <I       rr5r rr)rWrrrrrrrr)rrrWrrr)r!r"r#rrfrlr0r&rrrrsI I I I V _  # # # # #_ # _+++_+* ********rrrc|eZdZdZdZddZejdd ddZejddZ ddddddZdS)raEntry point for authorization handlers that control access to specific resources. The _On class provides a flexible way to define authorization rules for different resources and actions in your application. It supports three main usage patterns: 1. Global handlers that run for all resources and actions 2. Resource-specific handlers that run for all actions on a resource 3. Resource and action specific handlers for fine-grained control Each handler must be an async function that accepts two parameters: - ctx (AuthContext): Contains request context and authenticated user info - value: The data being authorized (type varies by endpoint) The handler should return one of: - None or True: Accept the request - False: Reject with 403 error - FilterType: Apply filtering rules to the response ???+ example "Examples" Start by denying all requests by default with a global handler, then add specific handlers to allow access: ```python # Default deny: reject all requests without a specific handler @auth.on async def deny_all(ctx: AuthContext, value: Any) -> False: return False ``` Resource-specific handler to allow access (takes precedence over the global deny handler): ```python @auth.on.threads async def allow_thread_access(ctx: AuthContext, value: Any) -> Auth.types.FilterType: # Allow access only to threads owned by the user return {"owner": ctx.user.identity} ``` Resource and action specific handler: ```python @auth.on.threads.create async def allow_thread_create(ctx: AuthContext, value: Any) -> None: # Allow thread creation, stamping the owner value.setdefault("metadata", {})["owner"] = ctx.user.identity ``` Multiple resources or actions: ```python @auth.on(resources=["threads", "assistants"], actions=["read", "search"]) async def allow_reads(ctx: AuthContext, value: Any) -> Auth.types.FilterType: # Allow read/search, scoped to user's resources return {"owner": ctx.user.identity} ``` )r assistantscronsrunsrthreadsr-r5r rrc||_t|d|_t|d|_t |d|_t||_tttj f|_ dS)Nrrr)rrnrrurrrrrdictrrfAnyr-rs rrz _On.__init__s_ 'l;;!$ 22 dG,, d^^ #vz/* rNrVrXrYrWrZrcdSrr&r]s rr0z _On.__call__s #srrrcdSrr&rs rr0z _On.__call__rrr^rrcR|tjdd||Sdfd }|S)aRegister a handler for specific resources and actions. Can be used as a decorator or with explicit resource/action parameters: @auth.on async def handler(): ... # Global handler @auth.on(resources="threads") async def handler(): ... # types.Handler for all thread actions @auth.on(resources="threads", actions="create") async def handler(): ... # types.Handler for thread creation Nrcrrcttrg}ntndg}ttrg}ntndg}|D]}|D]}tj||||S)Nrbr)rc resource_listrr6r8rWrXrs rrhz_On.__call__..decorators)S)) T!* 3<3HYse '3'' N&i /6/Bd7mmm ) M M)MMF%dj(FGLLLLMNrrr)rrrXrWrhs` `` rr0z _On.__call__sW( > dj$b 9 9 9I        "rr)rXrYrWrZrrrr)rrrXrZrWrZrr) r!r"r#r$r%rrfrlr0r&rrrrs99vI++++ _ /3 #####_# _+++_++15.2 ++++++++rrr5r6 str | Noner8r types.Handlerrc"t||pd}|pd}|dkr7|dkr1|jrtd|j|n:||nd}||nd}||f|jvrtd|d|d|g|j||f<|S)NrbzGlobal handler already set.ztypes.Handler already set for z, r)r>rrappendr)r5r6r8rras rr?r?0s b3H ]sF36S==   <:;; ; $$R(((( ,HH#(FFc q6T^ # #GaGG1GGGHH H"$1v IrCallable[..., typing.Any]rcFtj|s"tdt|d|dtj|}d|jvr"tdt|d|dd|jvr"tdt|d|ddS) zValidates that an auth handler function meets the required signature. Auth handlers must: 1. Be async functions 2. Accept a ctx parameter of type AuthContext 3. Accept a value parameter for the data being authorized zAuth handler 'r!z|' must be an async function. Add 'async' before 'def' to make it asynchronous and ensure any IO operations are non-blocking.r+zm' must have a 'ctx: AuthContext' parameter. Update the function signature to include this required parameter.r-z' must have a 'value' parameter. The value contains the mutable data being sent to the endpoint.Update the function signature to include this required parameter.N)inspectiscoroutinefunctionrgetattr signature parameters)rsigs rr>r>Fs  &r * *  3WRR88 3 3 3    B  C CN"" PWRR88 P P P   cn$$ PWRR88 P P P   %$ruser:types.MinimalUser | types.BaseUser | types.MinimalUserDictboolct|tjp-t|to|ddkS)Nkind StudioUser)rrrrr)rs ris_studio_userrcsB 4)** I tT " " Gtxx'7'7<'Gr)r rr) r5r r6rr8rrrrr)rrrr)rrrr)9 __future__rrrfcollections.abcrrlanggraph_sdk.authrrTypeVarHandlerr Authenticatorr r r'Protocolr*r1Genericr4rArBrCrDrErGrorprqrrrsrnr{r|r}r~rrurrrrrrrrrrrrrr?r>r__all__r&rrrs"""""" ........00000000V^D ...V^D 3444````````J FN3d+++"""""V_Q'""" FN3$'''q)* &.d 3 3 3 &.d 3 3 3w$/// &.d 3 3 3 &.d 3 3 3[[[[[&.%'7!JK[[[|$$$$$       $$$.                 F       0V^A&&FFFFFFFFRfnU.c6:o1F"GHHHDDDDDDDDN,    : * ) )r