§ پü+j؟مَہ—UdZddlmZddlZddlmZmZddlmZm Z ej ¦«ZiZde d<d ad e d<iZde d<dd„Zdd„Zdd„Zdd„Zdddœd d„Zd!d„ZdS)"uب LightClaw â€” multi-tenant API key routing. Mirrors: src/config.ts (L67-169) â€” resolveEffectiveApiKey, setApiKeyMap, setSessionApiKey, extractUinFromSessionKey, buildAuthHeaders. Routing model ------------- Two lookup tables are maintained at module scope: _global_api_key_map : { uin: apiKey } Built once at adapter startup from the configured API keys + the uin(s) returned by POST /cgi/ticket. Used by inbound handlers (which know the sender's uin directly). _session_key_to_api_key : { sessionKey.lower(): apiKey } Populated by the inbound handler when it starts processing a message. AI tool handlers (which only know ``ctx.sessionKey``) use this table to resolve the tenant's key without having to re-extract the uin. Resolution priority (mirrors TS): 1. sessionKey direct hit 2. senderId direct hit 3. uin extracted from sessionKey â†’ global map 4. _global_default_api_key é)عannotationsN)عDictعOptionalé)عCHANNEL_KEYع X_PRODUCTْDict[str, str]ع_global_api_key_mapععstrع_global_default_api_keyع_session_key_to_api_keyعmappingعdefault_api_keyعreturnعNonecَ¸—t5t ¦«|rt |¦«|pdaddd¦«dS#1swxYwYdS)uهReplace the uinâ†’apiKey map and the default key. Called once by ``LightClawAdapter.connect()`` after identity resolution. *mapping* may be empty â€” in that case every lookup falls through to *default_api_key*. rN)ع_lockr عclearعupdater )rrs ْ;/home/agentuser/.hermes/plugins/lightclawbot/src/tenancy.pyعset_api_key_mapr1s§€ُ ً8ً8ف×!ز!ر#ش#ذ#طً 0ف×&ز& wر/ش/ذ/ط"1ذ"7°Rذً 8ً8ً8ٌ8ô8ً8ً8ً8ً8ً8ً8ً8ًّّّ8ً8ً8ً8ً8ً8sˆ:AءAءAعsession_keyعapi_keycَٹ—|r|sdSt5|t| ¦«<ddd¦«dS#1swxYwYdS)uِRecord a ``sessionKey â†’ apiKey`` association. Called by the inbound handler right before dispatching a message to the agent so that tools executing within that session can look up the tenant's API key via the same session key. N)rrعlower)rrs rعset_session_api_keyr@s™€ًًکgًطˆف ً?ً?ط7>ص × 1ز 1ر 3ش 3ر4ً?ً?ً?ٌ?ô?ً?ً?ً?ً?ً?ً?ً?ًّّّ?ً?ً?ً?ً?ً?sژ8¸<؟<cَ¨—|sdSt5t | ¦«d¦«ddd¦«dS#1swxYwYdS)z@Best-effort cleanup; safe to call even if the key was never set.N)rrعpopr)rs rعclear_session_api_keyr Ms›€àًطˆف ً?ً?ف×#ز# K×$5ز$5ر$7ش$7¸ر>ش>ذ>ً?ً?ً?ٌ?ô?ً?ً?ً?ً?ً?ً?ً?ًّّّ?ً?ً?ً?ً?ً?sŒ.AءAءAْ Optional[str]cَ†—|sdS| ¦«}dD]Y}| |¦«}|dkr<||t|¦«zd…}| dd¦«d}|pdcSŒZt›d‌}| | ¦«¦«r|t|¦«d…}|pdSdS)aژExtract the peer uin embedded in a session key. Supported shapes (lowercased for matching, returned case-preserving): * ``agent:::direct:[...]`` * ``agent:::dm:[...]`` * legacy ``:dm:`` Returns ``None`` when no uin segment can be located (e.g. the main session key ``agent:main:main``). N)z:direct:ْ:dm:rْ:rr#)rعfindعlenعsplitrع startswith)rrعmarkerعidxعtailعpeerع legacy_prefixع remainders rعextract_uin_from_session_keyr/Ysي€ًًطˆtà×زرش€Eà&ً ً ˆطڈjٹjکر ش ˆطگ!ٹ8ˆ8طکs¥S¨،[¤[ر0ذ1ذ1ش2ˆDط—:’:کc 1ر%ش% aش(ˆDطگ<ک4ذذذًُ#ذ(ذ(ذ(€Mط×زک ×+ز+ر-ش-ر.ش.ً!ط¥ Mر 2ش 2ذ 3ذ 3ش4ˆ طذ کDذ àˆ4َ)rع sender_idr1cَ —t5|rrBsAًًًًً6#ذ"ذ"ذ"ذ"ذ"àذذذط!ذ!ذ!ذ!ذ!ذ!ذ!ذ!à*ذ*ذ*ذ*ذ*ذ*ذ*ذ*ً ˆ Œرش€ط&(ذذ(ذ(ذ(ر(ط!ذذ!ذ!ذ!ر!ط*,ذذ,ذ,ذ,ر,ً8ً8ً8ً8ً ?ً ?ً ?ً ?ً?ً?ً?ً?ًًًًًL"&ط#ً!'ً!'ً!'ً!'ً!'ً!'ًPًًًًًr0