# -*- coding: utf-8 -*- """智能体互通 API：内部事件接收 + 临时授权管理。 - ``POST /internal/im/agent-events``：im-service 在 agent_task 消息落库后回调， 由编排层完成权限校验 → 在线查询 → MQTT 派发（携带 X-IM-Token 内部令牌）。 - ``POST/GET/DELETE /agent-grants``：L3 成员开放调用（临时授权）管理（用户 API）。 """ from __future__ import annotations import logging from fastapi import APIRouter, Depends, Header, HTTPException from ..dependencies import get_db, get_current_user from ... import config from ...agent_gate import handle_agent_task_event from ...im import client as im_client from ...infrastructure.repositories import Database log = logging.getLogger("agent_gate.api") router = APIRouter(tags=["agent-gate"]) internal_router = APIRouter(prefix="/internal/im", tags=["agent-gate-internal"]) # ── 内部事件接收（im-service → server-core） ───────────────────── def _require_im_internal(x_im_token: str = Header(default="", alias="X-IM-Token")) -> None: """仅允许携带 IM_INTERNAL_TOKEN 的调用方（im-service）。""" if not config.IM_INTERNAL_TOKEN or x_im_token != config.IM_INTERNAL_TOKEN: raise HTTPException(status_code=403, detail="内部接口访问被拒绝") @internal_router.post("/agent-events", dependencies=[Depends(_require_im_internal)]) async def agent_events(payload: dict, db: Database = Depends(get_db)): """接收 im-service 的智能体任务事件（agent_task 消息落库后回调）。 body: {event, conv_id, sender_id, sender_name, content, metadata} """ event = payload.get("event", "") if event != "agent_task": return {"ok": False, "reason": f"unsupported event: {event}"} conv_id = str(payload.get("conv_id", "")) if not conv_id: return {"ok": False, "reason": "missing conv_id"} result = await handle_agent_task_event( db, im_client, conv_id=conv_id, sender_id=str(payload.get("sender_id", "")), sender_name=str(payload.get("sender_name", "")), content=str(payload.get("content", "")), metadata=payload.get("metadata") or {}, ) return result # ── 用户 API：L3 临时授权管理 ──────────────────────────────────── @router.post("/agent-grants", summary="创建智能体临时授权") async def create_grant(payload: dict, user: dict = Depends(get_current_user), db: Database = Depends(get_db)): """成员开放调用：授权另一个成员调用自己（的某个）智能体。 body: {grantee_user_id, target_agent_addr, scope?, max_calls?, expires_at?} """ grantee = str(payload.get("grantee_user_id", "")).strip() target_addr = str(payload.get("target_agent_addr", "")).strip() if not grantee or not target_addr: raise HTTPException(status_code=422, detail="grantee_user_id 与 target_agent_addr 必填") from ...agent_gate import parse_agent_addr parsed = parse_agent_addr(target_addr) if parsed is None or parsed[0] != user["id"]: raise HTTPException(status_code=403, detail="只能授权自己名下的智能体") if grantee == user["id"]: raise HTTPException(status_code=422, detail="不能授权给自己") grant = await db.agent_access_grants.create( grantor_user_id=user["id"], target_agent_addr=target_addr, grantee_user_id=grantee, scope=str(payload.get("scope", "")), max_calls=int(payload.get("max_calls", 0) or 0), expires_at=str(payload.get("expires_at", "")), ) return grant @router.get("/agent-grants", summary="智能体临时授权列表") async def list_grants(direction: str = "grantor", user: dict = Depends(get_current_user), db: Database = Depends(get_db)): """direction=grantor（我授权的）| grantee（我被授权的）。""" if direction == "grantee": return await db.agent_access_grants.list_by_grantee(user["id"]) return await db.agent_access_grants.list_by_grantor(user["id"]) @router.delete("/agent-grants/{grant_id}", summary="撤销智能体临时授权") async def revoke_grant(grant_id: str, user: dict = Depends(get_current_user), db: Database = Depends(get_db)): ok = await db.agent_access_grants.revoke(grant_id, user["id"]) if not ok: raise HTTPException(status_code=404, detail="授权不存在或无权撤销") return {"ok": True} # ── 用户 API：企业智能体目录（可调用智能体列表 + 在线状态） ────────── @router.get("/agents/directory", summary="企业可调用智能体目录") async def list_agent_directory(user: dict = Depends(get_current_user), db: Database = Depends(get_db)): """返回当前用户可调用的智能体目录（按成员分组），含在线状态。 可调用范围：自己的智能体 + 同企业成员 external_callable=True 的智能体 （企业管理员可看全部；普通成员受 L2/L3 权限约束，但目录仅展示「可被调用」 的智能体，实际调用时再由 authorize_call 做最终校验）。 """ from ...api.dependencies import get_user_organizations, get_user_primary_org from ...infrastructure.models import OrganizationMember, Organization, CompanyMember from sqlalchemy import select caller_id = user["id"] is_admin = "enterprise" in (user.get("capabilities") or []) # 1. 确定当前用户的主企业（enterprise 类型） primary_org = await get_user_primary_org(db, user, org_type="enterprise") if not primary_org: # 无企业归属：仅返回自己的智能体 org_id = "" else: org_id = primary_org["org_id"] # 2. 收集企业成员 user_id 集合（含自己） member_ids: set[str] = {caller_id} if org_id: # 优先查统一组织表 try: members = (await db.session.scalars( select(OrganizationMember).where( OrganizationMember.org_id == org_id, OrganizationMember.status == "active", ) )).all() for m in members: member_ids.add(m.user_id) except Exception: pass # 回退旧表 company_members（通过 company_id 关联） if len(member_ids) <= 1: try: from ...infrastructure.models import Company company = await db.session.scalar( select(Company).where(Company.org_id == org_id).limit(1) ) if company: cms = (await db.session.scalars( select(CompanyMember).where( CompanyMember.company_id == company.id, CompanyMember.status == "active", ) )).all() for cm in cms: member_ids.add(cm.user_id) except Exception: pass # 3. 批量查询每个成员的用户资料（名称/头像） user_profiles: dict[str, dict] = {} for uid in member_ids: u = await db.users.get_by_id(uid) if u: user_profiles[uid] = u # 4. 批量查询每个成员的可外部调用智能体（port=opc） from ...im import client as im_client result: list[dict] = [] for uid in sorted(member_ids): profile = user_profiles.get(uid) or {} agents = await db.agents.get_by_user(uid, port="opc") # 过滤：自己的全部展示；他人的仅展示 external_callable=True visible_agents = [] for a in agents: if uid == caller_id or is_admin or a.get("external_callable"): visible_agents.append(a) if not visible_agents: continue agent_items = [] for a in visible_agents: addr = f"{uid}.{a['id']}" # 在线状态查询（IM 内部接口，失败视为离线） online = False try: online_info = await im_client.internal_agent_online(addr) online = bool(online_info.get("online")) except Exception: pass agent_items.append({ "agent_id": a["id"], "name": a["name"], "avatar": "", # 智能体头像暂由前端默认占位 "description": a.get("description", ""), "call_mode": a.get("call_mode", "auto"), "external_callable": bool(a.get("external_callable")), "online": online, "is_own": uid == caller_id, }) result.append({ "user_id": uid, "name": profile.get("name") or profile.get("nickname") or profile.get("username") or uid, "avatar": profile.get("avatar", ""), "is_admin": bool(profile.get("is_admin")) or (uid == caller_id and is_admin), "agents": agent_items, }) return result