15ea23d5d6
* feat: introduce hindsight-api-slim and hindsight-all-slim packages Closes #552 - Move all source code from hindsight-api/ to new hindsight-api-slim/ - hindsight-api-slim has heavy ML deps (torch, sentence-transformers, transformers, einops, flashrank, mlx, mlx-lm, safetensors) and pg0-embedded as optional extras: [local-ml], [embedded-db], [all] - hindsight-api becomes a zero-code meta-package depending on hindsight-api-slim[all] for full backward compatibility - Add hindsight-all-slim meta-package: hindsight-api-slim + client + embed - hindsight-all updated to depend on hindsight-api-slim[all] - pg0.py: lazy-import pg0 with clear ImportError pointing to [embedded-db] - Dockerfile: replace sed hack with proper uv sync --extra flags - Update release.yml, test.yml, lint.sh, release.sh, CLAUDE.md and all path references throughout the repo * refactor: rename hindsight/ directory to hindsight-all/ * docs: document hindsight-api-slim and hindsight-all-slim package variants Add package variants table and extras explanation to installation.md * docs: remove emojis from installation.md, use professional tone * docs: link Docker slim variant to pip package variants section * docs: consolidate Docker image variants into single table * ci: fix working-directory paths after package restructure - Replace all hindsight-api → hindsight-api-slim in test.yml - Replace hindsight → hindsight-all in test.yml - Add --extra embedded-db to test-embed API install step * ci: add local-ml and embedded-db extras to API sync steps These extras were previously implicit in the old hindsight-api package (which bundled everything). Now that hindsight-api-slim uses optional extras, we must explicitly request local-ml and embedded-db in CI. * ci: add API install step with embedded-db to test-embed smoke test The smoke test starts hindsight-api as a daemon, which requires pg0-embedded. Add a dedicated install step for hindsight-api-slim with embedded-db extra so the daemon can start successfully. * ci: remove --no-install-project when using optional extras When --no-install-project is combined with --extra, the optional deps are not installed because extras require the project to be active. Remove --no-install-project from steps that need local-ml or embedded-db. * ci: fix ordering of uv sync steps to preserve optional extras When uv sync runs for a different workspace member, it removes optional extras installed for other members. Fix by always running extra-requiring API sync last, after other workspace member syncs. Also remove --no-install-project from embedded-db sync in test-embed, as --no-install-project prevents optional extras from being active. * ci: add local-ml extra to test-embed API install for smoke test The smoke test starts the full API server which needs sentence-transformers for local embeddings (default provider). Add local-ml extra to the install. * ci: simplify extras with --all-extras and add slim pip smoke test - Replace explicit --extra local-ml --extra embedded-db with --all-extras for cleaner, more maintainable sync steps - Add test-pip-slim job: tests hindsight-api-slim[embedded-db] without local ML models, using Cohere for embeddings/reranking (mirrors Docker slim smoke test approach) * ci: simplify slim smoke test to health check only (mirrors Docker test)
90 lines
3.9 KiB
Python
90 lines
3.9 KiB
Python
"""Built-in tenant extension implementations."""
|
|
|
|
from hindsight_api.config import get_config
|
|
from hindsight_api.extensions.tenant import AuthenticationError, Tenant, TenantContext, TenantExtension
|
|
from hindsight_api.models import RequestContext
|
|
|
|
|
|
class DefaultTenantExtension(TenantExtension):
|
|
"""
|
|
Default single-tenant extension with no authentication.
|
|
|
|
This is the default extension used when no tenant extension is configured.
|
|
It provides single-tenant behavior using the configured schema from
|
|
HINDSIGHT_API_DATABASE_SCHEMA (defaults to 'public').
|
|
|
|
Features:
|
|
- No authentication required (passes all requests)
|
|
- Uses configured schema from environment
|
|
- Perfect for single-tenant deployments without auth
|
|
|
|
Configuration:
|
|
HINDSIGHT_API_DATABASE_SCHEMA=your-schema (optional, defaults to 'public')
|
|
|
|
This is automatically enabled by default. To use custom authentication,
|
|
configure a different tenant extension:
|
|
HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension
|
|
"""
|
|
|
|
def __init__(self, config: dict[str, str]):
|
|
super().__init__(config)
|
|
# Cache the schema at initialization for consistency
|
|
# Support explicit schema override via config, otherwise use environment
|
|
self._schema = config.get("schema", get_config().database_schema)
|
|
|
|
async def authenticate(self, context: RequestContext) -> TenantContext:
|
|
"""Return configured schema without any authentication."""
|
|
return TenantContext(schema_name=self._schema)
|
|
|
|
async def list_tenants(self) -> list[Tenant]:
|
|
"""Return configured schema for single-tenant setup."""
|
|
return [Tenant(schema=self._schema)]
|
|
|
|
|
|
class ApiKeyTenantExtension(TenantExtension):
|
|
"""
|
|
Built-in tenant extension that validates API key against an environment variable.
|
|
|
|
This is a simple implementation that:
|
|
1. Validates the API key matches HINDSIGHT_API_TENANT_API_KEY
|
|
2. Returns the configured schema (HINDSIGHT_API_DATABASE_SCHEMA, default 'public')
|
|
for all authenticated requests
|
|
|
|
Configuration:
|
|
HINDSIGHT_API_TENANT_EXTENSION=hindsight_api.extensions.builtin.tenant:ApiKeyTenantExtension
|
|
HINDSIGHT_API_TENANT_API_KEY=your-secret-key
|
|
HINDSIGHT_API_DATABASE_SCHEMA=your-schema (optional, defaults to 'public')
|
|
HINDSIGHT_API_TENANT_MCP_AUTH_DISABLED=true (optional, disable auth for MCP endpoints)
|
|
|
|
For multi-tenant setups with separate schemas per tenant, implement a custom
|
|
TenantExtension that looks up the schema based on the API key or token claims.
|
|
"""
|
|
|
|
def __init__(self, config: dict[str, str]):
|
|
super().__init__(config)
|
|
self.expected_api_key = config.get("api_key")
|
|
if not self.expected_api_key:
|
|
raise ValueError("HINDSIGHT_API_TENANT_API_KEY is required when using ApiKeyTenantExtension")
|
|
# Allow disabling MCP auth for backwards compatibility
|
|
self.mcp_auth_disabled = config.get("mcp_auth_disabled", "").lower() in ("true", "1", "yes")
|
|
|
|
async def authenticate(self, context: RequestContext) -> TenantContext:
|
|
"""Validate API key and return configured schema context."""
|
|
if context.api_key != self.expected_api_key:
|
|
raise AuthenticationError("Invalid API key")
|
|
return TenantContext(schema_name=get_config().database_schema)
|
|
|
|
async def list_tenants(self) -> list[Tenant]:
|
|
"""Return configured schema for single-tenant setup."""
|
|
return [Tenant(schema=get_config().database_schema)]
|
|
|
|
async def authenticate_mcp(self, context: RequestContext) -> TenantContext:
|
|
"""
|
|
Authenticate MCP requests.
|
|
|
|
If mcp_auth_disabled is set, skip authentication for backwards compatibility.
|
|
Otherwise, delegate to authenticate().
|
|
"""
|
|
if self.mcp_auth_disabled:
|
|
return TenantContext(schema_name=get_config().database_schema)
|
|
return await self.authenticate(context)
|