Ë €^ŸiÝ%ãóþ—UdZddlmZddlZddlZddlmZddlmZejd«Z ehd£«Zde d <dd „Zdd„Z ddlmZdd lmZddlmZGd„de«ZdZdd„Zdd„Zy#e$rdZdZYŒwxYw)aRLM Neo-Cortex -- Tenant ID Extraction Middleware. Every incoming request to the RLM API must carry a tenant identity so the gateway can enforce per-tenant isolation, quota, and entitlements. Two extraction strategies are supported (tried in order): 1. **JWT Bearer token** (``Authorization: Bearer ``) The JWT payload must include a ``tenant_id`` or ``sub`` claim that is a valid UUID v4. The token is verified with HS256 against ``JWT_SECRET``. 2. **API key header** (default: ``X-Api-Key: ``) The header name is configurable via the ``API_KEY_HEADER`` env var. The key is looked up in Redis/PostgreSQL via the EntitlementLedger. The first 8 characters are used as a fast-path Redis key prefix. If neither strategy produces a valid tenant UUID the middleware returns HTTP 401 with a JSON ``{"error": "missing_tenant_identity"}`` body. The extracted tenant UUID is attached to ``request.state.tenant_id`` so downstream route handlers can access it without re-parsing headers. Story: integration-layer-middleware é)ÚannotationsN)ÚOptional)ÚUUIDzcore.rlm.middleware>ú/docsú/redocú/healthú /openapi.jsonú/zfrozenset[str]Ú _EXEMPT_PATHScó— ddl}|j|||g¬«}|jd«xs|jd«}|rtt |««S y#t $r }tjd|«Yd}~yd}~wwxYw)aŽDecode a JWT and extract the tenant UUID from payload. Returns None if the token is invalid, expired, or does not contain a recognised UUID claim. Args: token: Raw JWT string (without 'Bearer ' prefix). secret: HS256 signing secret. algorithm: JWT algorithm (usually 'HS256'). Returns: UUID extracted from 'tenant_id' or 'sub' claim, or None. rN)Ú algorithmsÚ tenant_idÚsubzJWT decode failed: %s)ÚjwtÚdecodeÚgetrÚstrÚ ExceptionÚloggerÚdebug)ÚtokenÚsecretÚ algorithmÚpyjwtÚpayloadÚraw_idÚexcs ú,/mnt/e/genesis-system/core/rlm/middleware.pyÚ_decode_jwtr0s€ð3ÛØ—,‘,˜u f¸)¸,ÓEˆØ—‘˜[Ó)Ò?¨W¯[©[¸Ó-?ˆÙÜœ˜F›Ó$Ð$ððøôò3Ü‰Ð,¨c×2Ð2Øûð3ús‚AAÁ BÁ A;Á;BcƒóK—tjjdd«}tjjdd«}t|«dk\r|ddn|}|r] ddlm}|j |dd¬ «}|jd |›«ƒd{–—†}|j«ƒd{–—†|rt|«S |rÎ ddl}|j|d¬ «ƒd{–—†} | jd|«ƒd{–—†} | j«ƒd{–—†| rxtt!| d««}|r] ddlm}|j |dd¬ «}|j#d |›t!|«d¬«ƒd{–—†|j«ƒd{–—†|S|S yy7Œû7Œå#t$r }tjd|«Yd}~Œùd}~wwxYw7Œã7ŒË7Œµ7ŒY7ŒC#t$rY|SwxYw#t$r }tjd|«Yd}~yd}~wwxYww)u{Resolve an API key to a tenant UUID via Redis fast-path, then PostgreSQL. Redis key format: ``rlm:apikey:`` â†’ ```` If not in Redis, falls back to querying the ``rlm_tenant_api_keys`` table. Args: api_key: The raw API key string from the request header. Returns: UUID if the API key is recognised, else None. Ú REDIS_URLÚÚDATABASE_URLéNrTé)Údecode_responsesÚsocket_timeoutzrlm:apikey:zRedis API-key lookup failed: %sé)ÚtimeoutzNSELECT tenant_id FROM rlm_tenant_api_keys WHERE api_key = $1 AND active = TRUEri,)Úexz$PostgreSQL API-key lookup failed: %s)ÚosÚenvironrÚlenÚ redis.asyncioÚasyncioÚfrom_urlÚacloserrrrÚasyncpgÚconnectÚfetchrowÚcloserÚset)Úapi_keyÚ redis_urlÚpg_dsnÚprefix8ÚaioredisÚrÚcachedrr2ÚconnÚrowÚtids rÚ_lookup_api_keyrAMsÿèø€ô— ‘ —‘˜{¨BÓ/€IÜ— ‘ —‘˜~¨rÓ2€Fä ›\¨QÒ.ˆgbq‰k°G€Gñð AÝ,Ø×!Ñ! )¸dÐSTÐ!ÓUˆAØŸ5™5 ;¨w¨iÐ!8Ó9×9ˆFØ—(‘(“*×ÐÙÜ˜F“|Ð#ðñð FÛØ Ÿ™¨¸˜Ó;×;ˆDØŸ ™ Ø`Øó÷ˆCð—*‘*“,×ÐÙÜœ3˜s ;Ñ/Ó0Ó1áðÝ8Ø$×-Ñ-¨iÈ$Ð_`Ð-Óa˜ØŸe™e k°'°Ð$;¼SÀ»XÈ#˜eÓN×NÐNØŸh™h›j×(Ð(ð s ðñðA:øØùôò AÜL‰LÐ:¸C×@Ñ@ûð Aúð<øðøð øðOøØ(ùÜ$òØØ ðûôò FÜL‰LÐ?À×EÐEàûð Füs‚AG>Á1FÂFÂ FÂ$F Â%FÂ5G>Â:GÃF8ÃGÃ.F:Ã/GÄF<ÄGÄ'=GÅ$F>Å%GÅÆGÆG>ÆG>ÆFÆ FÆ F5ÆF0Æ+G>Æ0F5Æ5G>Æ8GÆ:GÆGÇGÇ GÇGÇ G>ÇGÇGÇ G;ÇG6Ç1G>Ç6G;Ç;G>)ÚBaseHTTPMiddleware)ÚRequest)ÚJSONResponsecó—eZdZdZdd„Zy)ÚTenantMiddlewareu]Extract tenant UUID from JWT or API key and attach to request state. Attach to a FastAPI app:: from core.rlm.middleware import TenantMiddleware app.add_middleware(TenantMiddleware) After this middleware runs, downstream handlers can access:: tenant_id: UUID = request.state.tenant_id # may be None for exempt paths Configuration (from os.environ, no hardcoded values): JWT_SECRET â€” HS256 signing secret JWT_ALGORITHM â€” default HS256 API_KEY_HEADER â€” header name, default X-Api-Key cƒóòK—d|j_|jjtvr||«ƒd{–—†St|«ƒd{–—†}|€Etjd|j|jj«tddddœ¬«S||j_tjd||j|jj«||«ƒd{–—†S7Œµ7Œ¤7Œw)Nz"Tenant extraction failed for %s %si‘Úmissing_tenant_identityz_Provide a valid JWT Bearer token (with tenant_id claim) or an API key in the configured header.)ÚerrorÚdetail)Ústatus_codeÚcontentz!Tenant %s authenticated for %s %s)ÚstaterÚurlÚpathrÚ_extract_tenantrÚwarningÚmethodrDr)ÚselfÚrequestÚ call_nextrs rÚdispatchzTenantMiddleware.dispatch¡sÚèø€Ø&*ˆGM‰MÔ#ð{‰{×Ñ¤=Ñ0Ù& wÓ/×/Ð/ä-¨gÓ6×6ˆIàÐ Ü—‘Ø8Ø—N‘N G§K¡K×$4Ñ$4ôô$Ø #à!:ðFñô ð ð'0ˆGM‰MÔ#ÜL‰LØ3Ø˜7Ÿ>™>¨7¯;©;×+;Ñ+;ô ñ# 7Ó+×+Ð+ð30øà6øð.,ús4‚9C7»C1¼C7ÁC3ÁBC7Ã,C5Ã-C7Ã3C7Ã5C7N)rTrC)Ú__name__Ú __module__Ú__qualname__Ú__doc__rV©órrFrFs„ñ ô" ,r\rFTFcƒóÖK—tjjdd«}tjjdd«}tjjdd«}|jjdd«}|j d«r!|r|td«d }t |||«}|r|S|jj|d«}|rt|«ƒd {–—†}|r|Sy 7Œ w) z¢Try JWT, then API key; return UUID or None. Separated from the middleware class so it can be unit-tested independently and reused by the MCP bridge. Ú JWT_SECRETr"Ú JWT_ALGORITHMÚHS256ÚAPI_KEY_HEADERú X-Api-KeyÚ AuthorizationúBearer N)r+r,rÚheadersÚ startswithr-rrA)rTÚ jwt_secretÚ jwt_algorithmÚapi_key_headerÚauth_headerrr@r7s rrPrPÌsËèø€ô—J‘J—N‘N <°Ó4€JÜ—J‘J—N‘N ?°GÓ<€MÜ—Z‘Z—^‘^Ð$4°kÓB€Nð—/‘/×%Ñ% o°rÓ:€KØ×Ñ˜iÔ(©ZØœC ›N˜OÐ,ˆÜ˜% ¨]Ó;ˆÙØˆJðo‰o×!Ñ! .°"Ó5€GÙÜ# GÓ,×,ˆÙØˆJàð -ús‚CC)ÃC'Ã C)cƒó0K—tjjdd«}tjjdd«}tjjdd«j«}|j «Dcic]\}}|j«|“Œ}}}|jdd«}|jd«r!|r|t d«d }t|||«} | r| S|j|d«} | rt| «ƒd {–—†Sy cc}}w7Œw) u%Extract tenant UUID from a plain dict of headers (no Request object). Used by the MCP bridge which doesn't have a Starlette Request. Args: headers: Dict of header name â†’ value (case-insensitive lookup). Returns: UUID if a valid tenant is found, else None. r^r"r_r`rarbÚ authorizationrdN) r+r,rÚlowerÚitemsrfr-rrA)rergrhriÚkÚvÚ normalisedÚauthrr@r7s rÚextract_tenant_from_headersrsìsíèø€ô—Z‘Z—^‘^ L°"Ó5€JÜ—Z‘Z—^‘^ O°WÓ=€MÜ—Z‘Z—^‘^Ð$4°kÓB×HÑHÓJ€Nð,3¯=©=«?×;¡4 1 a!—'‘'“)˜Q‘,Ð;€JÑ;ð>‰>˜/¨2Ó.€DØ‡yÔ!¡jØ”S˜“^_Ð%ˆÜ˜% ¨]Ó;ˆÙØˆJðn‰n˜^¨RÓ0€GÙÜ$ WÓ-×-Ð-àùó<ð.ús‚BDÂDÂA)DÄDÄ D)rrrrrrÚreturnúOptional[UUID])r7rrtru)rTz 'Request'rtru)reÚdictrtru)rZÚ __future__rÚloggingr+ÚtypingrÚuuidrÚ getLoggerrÚ frozensetrÚ__annotations__rrAÚstarlette.middleware.baserBÚstarlette.requestsrCÚstarlette.responsesrDrFÚ_MIDDLEWARE_AVAILABLEÚImportErrorrPrsr[r\rúrƒsžðòõ0#ãÛ ÝÝà ˆ× Ñ Ð0Ó 1€ñ!*ò+ó!€ ˆ~óóó:6ðz;Ý<Ý*Ý0ô0,Ð-ô0,ðd!Ðóô@øðSòØ!ÐØÒðúsÁA0Á0 A<Á;A<