feat(admmin): add superadmin creation at startup

- remove MasterNotAllowedException exception
- remove hardcoded admin bypass
- delete MASTER_USER_ID and MASTER_KEY_ID for MASTER_ID
- add auth_master_username setting
- add auth_master_password setting
- remove use of master key as API key
- replace 0 refs to MASTER_ID global variable
- add setup_master method in lifespan (WIP: prints still present)
- rename master_key to secret_key in IdentityAccessManager

Author: tibo-pdn

api/domain/key/entities.py

@@ -4,8 +4,7 @@
 from api.helpers._identityaccessmanager import IdentityAccessManager
 from api.utils.exceptions import InvalidAPIKeyException
 
-MASTER_USER_ID = 0
-MASTER_KEY_ID = 0
+MASTER_ID: int = 0
 
 
 class KeyClaims(BaseModel):
@@ -19,10 +18,6 @@ class Key(BaseModel):
     value: str = Field(..., description="The raw API key value")
 
     def decode(self, secret_key: str) -> KeyClaims:
-        # TODO: Remove this hardcoded master key logic
-        if self.value == secret_key:
-            return KeyClaims(user_id=MASTER_USER_ID, key_id=MASTER_KEY_ID)
-
         if not self.value.startswith(IdentityAccessManager.TOKEN_PREFIX):
             raise InvalidAPIKeyException()
 

api/domain/userinfo/entities.py

@@ -1,6 +1,6 @@
 from pydantic import BaseModel, Field
 
-from api.domain.key.entities import MASTER_USER_ID
+from api.domain.key.entities import MASTER_ID
 from api.domain.role.entities import Limit, PermissionType
 
 
@@ -20,4 +20,4 @@ class UserInfo(BaseModel):
     @property
     def is_admin(self) -> bool:
         # TODO: remove self.id == 0 when master user is refacto
-        return PermissionType.ADMIN in self.permissions or self.id == MASTER_USER_ID
+        return PermissionType.ADMIN in self.permissions or self.id == MASTER_ID

api/helpers/_accesscontroller.py

@@ -83,35 +83,17 @@ async def _check_api_key(request: Request, api_key: HTTPAuthorizationCredentials
         if not api_key.credentials:
             raise InvalidAPIKeyException()
 
-        # master user can do anything
-        if api_key.credentials == global_context.identity_access_manager.secret_key:
-            user_info = UserInfo(
-                id=0,
-                email="master",
-                name="master",
-                budget=None,
-                limits=[],
-                permissions=[permission for permission in PermissionType],
-                expires=None,
-                created=0,
-                updated=0,
-                organization_id=0,
-                priority=0,
-            )
-            key_id = 0
-            key_name = "master"
-        else:
-            user_id, key_id, key_name = await global_context.identity_access_manager.check_token(
-                postgres_session=postgres_session, token=api_key.credentials
-            )
-            if not user_id:
-                raise InvalidAPIKeyException()
+        user_id, key_id, key_name = await global_context.identity_access_manager.check_token(
+            postgres_session=postgres_session, token=api_key.credentials
+        )
+        if not user_id:
+            raise InvalidAPIKeyException()
 
-            user_info = await global_context.identity_access_manager.get_user_info(postgres_session=postgres_session, user_id=user_id)
+        user_info = await global_context.identity_access_manager.get_user_info(postgres_session=postgres_session, user_id=user_id)
 
-            # invalid token if user is expired, except for /me and /me/role endpoints
-            if user_info.expires and user_info.expires < time.time() and not request.url.path.endswith(EndpointRoute.ME_INFO):
-                raise InvalidAPIKeyException()
+        # invalid token if user is expired, except for /me and /me/role endpoints
+        if user_info.expires and user_info.expires < time.time() and not request.url.path.endswith(EndpointRoute.ME_INFO):
+            raise InvalidAPIKeyException()
 
         return user_info, key_id, key_name
 

api/helpers/_documentmanager.py

@@ -29,7 +29,6 @@
     ChunkingFailedException,
     CollectionNotFoundException,
     DocumentNotFoundException,
-    MasterNotAllowedException,
     ParsingDocumentFailedException,
     VectorizationFailedException,
 )
@@ -49,9 +48,6 @@ def __init__(self, vector_store_model: str | None, parser_manager: ParserManager
 
     @staticmethod
     async def create_collection(postgres_session: AsyncSession, user_id: int, name: str, visibility: CollectionVisibility, description: str | None = None) -> int:  # fmt: off
-        if user_id == 0:
-            raise MasterNotAllowedException(detail="Master user is not allowed to create collection.")
-
         query = (
             insert(table=CollectionTable)
             .values(name=name, user_id=user_id, visibility=visibility, description=description)

api/helpers/_identityaccessmanager.py

@@ -10,7 +10,7 @@
 from sqlalchemy.sql import func
 
 from api.schemas.admin.organizations import Organization
-from api.schemas.admin.roles import Limit, LimitType, PermissionType, Role
+from api.schemas.admin.roles import Limit, PermissionType, Role
 from api.schemas.admin.tokens import Token
 from api.schemas.admin.users import User
 from api.schemas.me.info import UserInfo
@@ -21,7 +21,6 @@
 from api.sql.models import Token as TokenTable
 from api.sql.models import User as UserTable
 from api.utils.configuration import configuration
-from api.utils.context import global_context
 from api.utils.exceptions import (
     DeleteOrganizationWithUsersException,
     DeleteRoleWithUsersException,
@@ -251,8 +250,9 @@ async def create_user(
         budget: float | None = None,
         expires: int | None = None,
         priority: int = 0,
+        check_master_email: bool = True,
     ) -> int:
-        if email == "master":
+        if check_master_email and email == configuration.settings.auth_master_username:
             raise ReservedEmailException()
 
         expires = func.to_timestamp(expires) if expires is not None else None
@@ -355,7 +355,7 @@ async def update_user(
         # update the user
         email = email if email is not None else user.email
 
-        if email == "master":
+        if email == configuration.settings.auth_master_username and email != user.email:
             raise ReservedEmailException()
 
         name = name if name is not None else user.name
@@ -732,44 +732,28 @@ async def get_user(
     async def get_user_info(self, postgres_session: AsyncSession, user_id: int | None = None, email: str | None = None) -> UserInfo:
         assert user_id is not None or email is not None, "user_id or email is required"
 
-        if user_id == 0:  # master user
-            routers = await global_context.model_registry.get_routers(router_id=None, name=None, postgres_session=postgres_session)
-            user = UserInfo(
-                id=0,
-                email="master",
-                name="master",
-                organization=0,
-                budget=None,
-                permissions=[permission for permission in PermissionType],
-                limits=[Limit(router=router.id, type=type, value=None) for router in routers for type in LimitType],
-                expires=None,
-                created=0,
-                updated=0,
-                priority=0,
-            )
-        else:
-            users = await self.get_users(postgres_session=postgres_session, user_id=user_id, email=email)
-            user = users[0]
-
-            roles = await self.get_roles(postgres_session, role_id=user.role)
-            role = roles[0]
-
-            # user cannot see limits on models that are not accessible by the role
-            limits = [limit for limit in role.limits if limit.value is None or limit.value > 0]
-
-            user = UserInfo(
-                id=user.id,
-                email=user.email,
-                name=user.name,
-                organization=user.organization,
-                budget=user.budget,
-                permissions=role.permissions,
-                limits=limits,
-                expires=user.expires,
-                created=user.created,
-                updated=user.updated,
-                priority=user.priority,
-            )
+        users = await self.get_users(postgres_session=postgres_session, user_id=user_id, email=email)
+        user = users[0]
+
+        roles = await self.get_roles(postgres_session, role_id=user.role)
+        role = roles[0]
+
+        # user cannot see limits on models that are not accessible by the role
+        limits = [limit for limit in role.limits if limit.value is None or limit.value > 0]
+
+        user = UserInfo(
+            id=user.id,
+            email=user.email,
+            name=user.name,
+            organization=user.organization,
+            budget=user.budget,
+            permissions=role.permissions,
+            limits=limits,
+            expires=user.expires,
+            created=user.created,
+            updated=user.updated,
+            priority=user.priority,
+        )
 
         return user
 
@@ -787,14 +771,19 @@ async def login(self, postgres_session: AsyncSession, email: str, password: str)
             Tuple containing the token ID and the token of the refreshed playground token.
         """
 
-        # TODO: Remove this authentication backdoor for the master user.
-        if email == "master" and password == self.secret_key:
-            return 0, self.secret_key
+        print("======= LOGIN ATTEMPT =======")
+        print(f"Email: {email}")
+        print(f"Password: {password}")
 
         user = await self.get_user_info(postgres_session=postgres_session, email=email)  # raise UserNotFoundException (404) if user not found
         result = await postgres_session.execute(statement=select(UserTable.password).where(UserTable.id == user.id))
         hashed_password = result.scalar_one()
 
+        print("-- USER FOUND --")
+        print(f"User: {user}")
+        print(f"Result: {result}")
+        print(f"Hashed password: {hashed_password}")
+
         if not hashed_password:
             raise PasswordNotFoundException()
 
@@ -803,4 +792,7 @@ async def login(self, postgres_session: AsyncSession, email: str, password: str)
 
         token_id, token = await self.refresh_token(postgres_session, user_id=user.id, name=self.PLAYGROUND_KEY_NAME)
 
+        print("-- LOGIN SUCCESSFUL --")
+        print(f"Token ID: {token_id}")
+        print(f"Token: {token}")
         return token_id, token

api/helpers/models/_modelregistry.py

@@ -8,6 +8,7 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.clients.model import BaseModelProvider as ModelProvider
+from api.domain.key.entities import MASTER_ID
 from api.infrastructure.fastapi.schemas.providers import Provider, ProviderCarbonFootprintZone, ProviderType
 from api.schemas.admin.routers import Router, RouterLoadBalancingStrategy
 from api.schemas.core.configuration import Model as ModelConfiguration
@@ -116,7 +117,7 @@ async def setup(self, models: list[ModelConfiguration], postgres_session: AsyncS
                     load_balancing_strategy=model.load_balancing_strategy,
                     cost_prompt_tokens=model.cost_prompt_tokens,
                     cost_completion_tokens=model.cost_completion_tokens,
-                    user_id=0,  # setup as master user
+                    user_id=MASTER_ID,  # setup as master user
                     postgres_session=postgres_session,
                 )
                 logger.info(f"Router {model.name} are created (id: {router_id})")
@@ -137,7 +138,7 @@ async def setup(self, models: list[ModelConfiguration], postgres_session: AsyncS
                 try:
                     provider_id = await self.create_provider(
                         router_id=router.id,
-                        user_id=0,  # setup as master user
+                        user_id=MASTER_ID,  # setup as master user
                         type=provider.type,
                         url=provider.url,
                         key=provider.key,
@@ -196,7 +197,7 @@ async def create_router(
         """
 
         # Create the router in database
-        user_id = None if user_id == 0 else user_id  # 0 corresponds to master user ID
+        user_id = None if user_id == MASTER_ID else user_id
         try:
             query = (
                 insert(RouterTable)
@@ -412,7 +413,7 @@ async def get_routers(
 
         routers = []
         for row in router_results:
-            user_id = 0 if row["user_id"] is None else row["user_id"]  # 0 corresponds to master user ID
+            user_id = MASTER_ID if row["user_id"] is None else row["user_id"]
             routers.append(
                 Router(
                     id=row["id"],
@@ -511,7 +512,7 @@ async def create_provider(
 
         # Create provider
         try:
-            user_id = None if user_id == 0 else user_id  # 0 corresponds to master user ID
+            user_id = None if user_id == MASTER_ID else user_id
             qos_metric = qos_metric.value if qos_metric is not None else None
             query = (
                 insert(ProviderTable)
@@ -630,7 +631,7 @@ async def get_providers(
         providers = []
         for row in rows:
             qos_metric = Metric(row["qos_metric"]) if row["qos_metric"] is not None else None
-            user_id = 0 if row["user_id"] is None else row["user_id"]  # 0 corresponds to master user ID
+            user_id = MASTER_ID if row["user_id"] is None else row["user_id"]
             providers.append(
                 Provider(
                     id=row["id"],

api/infrastructure/postgres/_postgresrouterrepository.py

@@ -2,7 +2,7 @@
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from api.domain.key.entities import MASTER_USER_ID
+from api.domain.key.entities import MASTER_ID
 from api.domain.model import ModelType as RouterType
 from api.domain.router import RouterRepository
 from api.domain.router.entities import Router, RouterLoadBalancingStrategy, RouterPage, RouterSortField, SortOrder
@@ -39,7 +39,7 @@ def _select_routers_with_provider_stats() -> Select:
 
     @staticmethod
     def _row_to_router_with_aliases(row, aliases: list[str]) -> Router:
-        user_id = MASTER_USER_ID if row.user_id is None else row.user_id
+        user_id = MASTER_ID if row.user_id is None else row.user_id
         return Router(
             id=row.id,
             name=row.name,
@@ -129,7 +129,7 @@ async def create_router(
         user_id: int,
         aliases: list[str] | None = None,
     ) -> Router | RouterNameAlreadyExistsError | RouterAliasAlreadyExistsError:
-        db_user_id = None if user_id == MASTER_USER_ID else user_id
+        db_user_id = None if user_id == MASTER_ID else user_id
         aliases = aliases or []
 
         try: