feat: add opt-in MCP decomposition hook points (design §10)
Adds the seven §10.2 hook-point modules + five env vars so Astrolabe Cloud can offload document processing to the external document-processor / embedding gateway. Purely additive: with every setting unset the server behaves exactly as today, so self-hosters are unaffected (Deck #92). Hook points (all default to current monolith behavior): - config: EMBEDDING_PROVIDER, INGEST_MODE, STATUS_BACKEND, COLLECTION_METADATA_SOURCE, FACT_EVENT_EMITTER (+ supporting settings), validated in Settings.__post_init__ (fail-fast STATUS_BACKEND=local with INGEST_MODE=external); shared canonical.py. - vector/payload_keys.py + acl_hash.py: cross-impl NAMESPACE/point_id (§2.2) and BLAKE2b-128 ACL hash (§11), pinned by fixtures shared with the document-processor repo. - embedding/gateway_client.py: OpenAI-compatible GatewayProvider authenticating via M2M OIDC client-credentials (separate realm); manual-only registry entry. - vector/collection_metadata.py: sentinel-point / API metadata source with env fallback. - vector/queue/: hexagonal ingest producer ports + memory/NATS adapters (Postgres seam); INGEST_MODE=external publishes mcp.ingest.requested.{tenant} instead of the in-memory stream and skips the in-process processor pool. The lifespan becomes a composition root across both deployment branches. - vector/queue/status.py: STATUS_BACKEND=bus subscriber feeding a StatusStore the vector-sync status endpoint reads. - admin/payload_backfill.py: POST /api/v1/admin/payload-backfill (admin scope); processor writes the new payload keys; query-side ACL pre-filter gated behind ACL_PREFILTER_ENABLED (default off). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
c7da612f20
commit
d883052fb8
@@ -0,0 +1,137 @@
|
||||
"""OpenAI-compatible embedding provider targeting the Astrolabe Cloud embedding
|
||||
gateway (design §10.2).
|
||||
|
||||
Active only when ``EMBEDDING_PROVIDER=gateway``. Registered *manually* in
|
||||
``providers/registry.py`` — never part of the autodetect chain — so self-hosters
|
||||
who don't opt in are unaffected.
|
||||
|
||||
**Auth model.** The MCP server is an OIDC *client* in the gateway's own
|
||||
machine-to-machine realm — a realm *parallel to, and distinct from*, the tenant
|
||||
realm the MCP server already serves as a client (Nextcloud user_oidc). It
|
||||
obtains a ``client_credentials`` token and presents it as a Bearer; the gateway
|
||||
maps the token's client-id → the tenant's underlying provider API key. This
|
||||
mirrors the control-plane CLI's ``fetch_m2m_token`` pattern
|
||||
(astrolabe-cloud-website ``services/control-plane/.../cli/_common.py``). When no
|
||||
M2M creds are configured the client calls the gateway unauthenticated — matching
|
||||
the gateway's current (not-yet-authenticated) state.
|
||||
|
||||
The gateway speaks the OpenAI ``/v1/embeddings`` wire format and routes by model
|
||||
name (e.g. ``mistral-embed`` → Mistral for the MVP). Embeddings-only: ``generate``
|
||||
is disabled (inherited ``NotImplementedError``).
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import time
|
||||
|
||||
import httpx
|
||||
|
||||
from ..providers.openai import OpenAIProvider
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# Refresh the cached token this many seconds before its stated expiry, so a
|
||||
# token never expires mid-flight (matches AstrolabeClient / CP CLI behavior).
|
||||
_EARLY_REFRESH_SECONDS = 60
|
||||
|
||||
|
||||
class GatewayTokenProvider:
|
||||
"""Caches a gateway M2M access token via the ``client_credentials`` grant.
|
||||
|
||||
HTTP Basic client auth + form-encoded grant, mirroring the website's
|
||||
``fetch_m2m_token``. Tokens are cached until ``_EARLY_REFRESH_SECONDS``
|
||||
before expiry.
|
||||
"""
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
token_url: str,
|
||||
client_id: str,
|
||||
client_secret: str,
|
||||
scope: str | None = None,
|
||||
timeout: float = 10.0,
|
||||
):
|
||||
self.token_url = token_url
|
||||
self.client_id = client_id
|
||||
self.client_secret = client_secret
|
||||
self.scope = scope
|
||||
self.timeout = timeout
|
||||
self._cache: tuple[str, float] | None = None # (token, expires_at)
|
||||
|
||||
async def get_token(self, *, force_refresh: bool = False) -> str:
|
||||
if (
|
||||
self._cache is not None
|
||||
and not force_refresh
|
||||
and time.time() < self._cache[1]
|
||||
):
|
||||
return self._cache[0]
|
||||
|
||||
data = {"grant_type": "client_credentials"}
|
||||
if self.scope:
|
||||
data["scope"] = self.scope
|
||||
|
||||
async with httpx.AsyncClient(
|
||||
timeout=httpx.Timeout(self.timeout, connect=5.0)
|
||||
) as client:
|
||||
resp = await client.post(
|
||||
self.token_url,
|
||||
data=data,
|
||||
auth=(self.client_id, self.client_secret),
|
||||
)
|
||||
resp.raise_for_status()
|
||||
body = resp.json()
|
||||
|
||||
expires_in = body.get("expires_in", 3600)
|
||||
self._cache = (
|
||||
body["access_token"],
|
||||
time.time() + expires_in - _EARLY_REFRESH_SECONDS,
|
||||
)
|
||||
logger.info("Obtained embedding-gateway M2M token (expires in %ss)", expires_in)
|
||||
return self._cache[0]
|
||||
|
||||
|
||||
class GatewayProvider(OpenAIProvider):
|
||||
"""Embeddings-only OpenAI-compatible provider pointed at the gateway."""
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
*,
|
||||
base_url: str,
|
||||
embedding_model: str,
|
||||
token_provider: GatewayTokenProvider | None = None,
|
||||
timeout: float = 120.0,
|
||||
):
|
||||
# AsyncOpenAI rejects an empty key; use a non-secret placeholder when
|
||||
# the gateway is unauthenticated. When a token provider is configured,
|
||||
# the real Bearer is set on the client before each request.
|
||||
super().__init__(
|
||||
api_key="gateway-unauthenticated",
|
||||
base_url=base_url,
|
||||
embedding_model=embedding_model,
|
||||
generation_model=None, # gateway never generates
|
||||
timeout=timeout,
|
||||
)
|
||||
self._token_provider = token_provider
|
||||
logger.info(
|
||||
"Initialized gateway embedding provider: base_url=%s, model=%s, auth=%s",
|
||||
base_url,
|
||||
embedding_model,
|
||||
"oidc-m2m" if token_provider else "none",
|
||||
)
|
||||
|
||||
async def _ensure_bearer(self) -> None:
|
||||
"""Refresh the OIDC M2M token onto the OpenAI client (no-op when
|
||||
unauthenticated). AsyncOpenAI reads ``api_key`` per request to build
|
||||
the Authorization header, so updating it here applies to the next call.
|
||||
"""
|
||||
if self._token_provider is not None:
|
||||
self.client.api_key = await self._token_provider.get_token()
|
||||
|
||||
async def embed(self, text: str) -> list[float]:
|
||||
await self._ensure_bearer()
|
||||
return await super().embed(text)
|
||||
|
||||
async def embed_batch(self, texts: list[str]) -> list[list[float]]:
|
||||
await self._ensure_bearer()
|
||||
return await super().embed_batch(texts)
|
||||
Reference in New Issue
Block a user