mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-31 10:12:21 +01:00
106 lines
4.9 KiB
Python
106 lines
4.9 KiB
Python
"""One-use transport capabilities for admitted local Cookbook producers.
|
|
|
|
The internal HTTP token authenticates transport only. A capability bridges one
|
|
server-owned request/operation/backend to one exact resolved local launch body.
|
|
It is never persisted, returned to the model, or usable for shell/job control.
|
|
"""
|
|
from contextlib import contextmanager
|
|
from dataclasses import dataclass
|
|
import hashlib
|
|
import json
|
|
import secrets
|
|
import threading
|
|
import time
|
|
|
|
from src.agent_runtime.resources import NativeBackendResource, ResourceIdentityError
|
|
|
|
CAPABILITY_HEADER = "X-Odysseus-Local-Model-Capability"
|
|
_ROUTES = {"download_model": "/api/model/download", "serve_model": "/api/model/serve",
|
|
"serve_preset": "/api/model/serve"}
|
|
_PENDING = {}
|
|
_LOCK = threading.Lock()
|
|
|
|
|
|
def _digest(payload):
|
|
return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":"),
|
|
allow_nan=False).encode()).hexdigest()
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class _Capability:
|
|
authority: object
|
|
operation: object
|
|
backend: NativeBackendResource
|
|
path: str
|
|
payload_digest: str
|
|
deadline: float
|
|
|
|
|
|
@contextmanager
|
|
def model_control_headers(tool, content, owner, payload, *, scheduled=False):
|
|
from src.tools._common import _internal_headers
|
|
headers = _internal_headers(owner)
|
|
if payload.get("remote_host"):
|
|
yield headers # Remote workload authority/transport is unchanged.
|
|
return
|
|
from src.agent_runtime.authority import active_request_authority, ExactOperation
|
|
from src.agent_runtime.remote_resources import active_backend_operation
|
|
from src.tool_security import owner_is_admin_or_single_user
|
|
authority = active_request_authority()
|
|
operation = ExactOperation.normalize(tool, content)
|
|
backend = active_backend_operation()
|
|
if (authority is None or authority.owner != str(owner or "").strip().casefold()
|
|
or tool not in _ROUTES or not owner_is_admin_or_single_user(owner)):
|
|
raise ResourceIdentityError("Local model producer has no matching server authority")
|
|
if scheduled:
|
|
# Called only by the server-owned scheduled action, after restoration of
|
|
# its immutable input ceiling. A task name or owner alone is not enough.
|
|
if tool != "serve_model" or not authority.permits(operation):
|
|
raise ResourceIdentityError("Scheduled local model input is outside authority")
|
|
resource = NativeBackendResource(tool)
|
|
if resource not in authority.backend_resources:
|
|
raise ResourceIdentityError("Scheduled local model backend is outside authority")
|
|
else:
|
|
# This binding exists only after dispatch admission (including one-use
|
|
# exact approval). A generic tool grant/header cannot create it over HTTP.
|
|
if (backend is None or backend.resource != NativeBackendResource(tool)
|
|
or (backend.request_id, backend.owner, backend.session_id,
|
|
backend.transport_tool, backend.exact_input) !=
|
|
(authority.request_id, authority.owner, authority.session_id, tool, operation.input)):
|
|
raise ResourceIdentityError("Local model producer operation or backend changed")
|
|
resource = backend.resource
|
|
capability = _Capability(authority, operation, resource, _ROUTES[tool], _digest(payload), time.monotonic() + 60)
|
|
token = secrets.token_urlsafe(32)
|
|
headers.update({CAPABILITY_HEADER: token, "X-Odysseus-Owner": authority.owner})
|
|
with _LOCK:
|
|
_PENDING[token] = capability
|
|
try:
|
|
yield headers
|
|
finally:
|
|
with _LOCK:
|
|
_PENDING.pop(token, None)
|
|
|
|
|
|
def consume_model_control(request, payload):
|
|
"""Claim exactly once at the local route, before any producer effect."""
|
|
from core.middleware import INTERNAL_TOOL_HEADER, INTERNAL_TOOL_TOKEN, INTERNAL_TOOL_USER
|
|
from src.auth_helpers import is_direct_loopback_request
|
|
token = request.headers.get(CAPABILITY_HEADER)
|
|
if not token:
|
|
return False
|
|
if (not is_direct_loopback_request(request)
|
|
or not secrets.compare_digest(request.headers.get(INTERNAL_TOOL_HEADER, ""), INTERNAL_TOOL_TOKEN)):
|
|
raise ResourceIdentityError("Local model transport is untrusted")
|
|
with _LOCK:
|
|
capability = _PENDING.get(token)
|
|
if (capability is None or capability.deadline < time.monotonic()
|
|
or request.method != "POST" or request.url.path != capability.path
|
|
or payload.get("remote_host") or _digest(payload) != capability.payload_digest
|
|
or request.headers.get("X-Odysseus-Owner", "") != capability.authority.owner
|
|
or getattr(request.state, "current_user", None) not in
|
|
(None, INTERNAL_TOOL_USER, capability.authority.owner)):
|
|
raise ResourceIdentityError("Local model capability binding changed or expired")
|
|
del _PENDING[token]
|
|
request.state.local_model_authority = capability.authority
|
|
return True
|