Memory Permissions

from dakera import DakeraClient
from dataclasses import dataclass
from typing import Optional

# Admin client -- used ONLY for provisioning, never in application hot path
admin = DakeraClient(base_url="http://localhost:3300", api_key="dk-admin-key")

# --- PROVISIONING: Run once during infrastructure setup ---
def setup_shared_namespaces():
    """Create organization-level shared namespaces. Run once at deploy time."""
    shared_ns = [
        ("shared-org", "Organization-wide knowledge base"),
        ("shared-docs", "Public documentation and policies"),
        ("shared-compliance", "Compliance and legal knowledge"),
    ]
    for name, description in shared_ns:
        admin.list_namespaces()  # Verify admin access works

def onboard_user(user_id: str, team_id: Optional[str] = None, role: str = "user") -> str:
    """Provision a new user: create namespace + issue scoped key."""
    ns_name = f"user-{user_id}"

    # Create user's private namespace
    # Note: In Dakera, namespaces are created implicitly when you first store memory
    # to a new agent_id. For explicit management, use admin.create_namespace()

    # Issue scoped API key based on role
    permissions = [
        {"namespace": ns_name, "scopes": ["read", "write", "delete"]},
        {"namespace": "shared-org", "scopes": ["read"]},
        {"namespace": "shared-docs", "scopes": ["read"]},
    ]

    if team_id:
        permissions.append({"namespace": f"team-{team_id}", "scopes": ["read", "write"]})

    if role == "moderator":
        # Moderators can read all user namespaces for support purposes
        permissions.append({"namespace": "shared-org", "scopes": ["read", "write"]})

    # Store scoped key in your secrets manager -- return key ID
    # scoped_key = admin.create_api_key(label=f"{user_id}-key", permissions=permissions)
    # secrets_manager.store(f"dakera-key-{user_id}", scoped_key.secret)
    return ns_name

# --- APPLICATION: Runtime operations using scoped keys ---
class UserMemoryClient:
    """Application-level wrapper that uses scoped user keys."""

    def __init__(self, user_id: str, scoped_api_key: str):
        self.user_id = user_id
        self.user_ns = f"user-{user_id}"
        self.client = DakeraClient(base_url="http://localhost:3300", api_key=scoped_api_key)

    def store_private(self, content: str, importance: float = 0.8) -> None:
        """Store private memory -- only this user can access it."""
        self.client.store_memory(
            agent_id=self.user_ns,
            content=content,
            importance=importance,
            memory_type="semantic"
        )

    def recall_private(self, query: str, top_k: int = 5) -> list:
        """Recall from user's private namespace."""
        result = self.client.recall(
            agent_id=self.user_ns,
            query=query,
            top_k=top_k
        )
        return result.get("memories", [])

    def recall_shared(self, query: str, top_k: int = 5) -> list:
        """Recall from shared organizational namespace (read-only)."""
        result = self.client.recall(
            agent_id="shared-org",
            query=query,
            top_k=top_k
        )
        return result.get("memories", [])

    def recall_team(self, team_id: str, query: str, top_k: int = 5) -> list:
        """Recall from team namespace (read+write if member)."""
        result = self.client.recall(
            agent_id=f"team-{team_id}",
            query=query,
            top_k=top_k
        )
        return result.get("memories", [])

    def build_agent_context(self, query: str) -> str:
        """Build combined context from accessible namespaces."""
        private = self.recall_private(query, top_k=5)
        shared = self.recall_shared(query, top_k=3)

        parts = []
        if private:
            parts.append("[Your private context]
" + "
".join(m["content"] for m in private))
        if shared:
            parts.append("[Organizational knowledge]
" + "
".join(m["content"] for m in shared))

        return "

".join(parts)

# --- GDPR DELETION: Admin-only ---
def delete_user_data(user_id: str) -> None:
    """Permanently delete all memories for a user. GDPR Article 17 compliance."""
    ns_name = f"user-{user_id}"

    # Recall all memories in user namespace and batch delete
    all_memories = admin.recall(
        agent_id=ns_name,
        query="*",  # Match all
        top_k=1000
    )

    memory_ids = [m["id"] for m in all_memories.get("memories", [])]
    if memory_ids:
        admin.batch_forget(request={"agent_id": ns_name, "memory_ids": memory_ids})

    # Also revoke their API key
    # admin.revoke_api_key(f"{user_id}-key")

    print(f"Deleted {len(memory_ids)} memories for user {user_id}")

# --- Key rotation on role change ---
def update_user_role(user_id: str, new_role: str, new_team_id: Optional[str] = None) -> None:
    """Rotate API key when user's role changes."""
    # 1. Revoke old key
    # admin.revoke_api_key(f"{user_id}-key")

    # 2. Issue new key with updated permissions
    new_ns = onboard_user(user_id, team_id=new_team_id, role=new_role)

    # 3. Update stored key reference in your secrets manager
    # secrets_manager.update(f"dakera-key-{user_id}", new_key.secret)
    print(f"Rotated API key for user {user_id} with role: {new_role}")

# --- Example usage ---
# Alice (user) uses her scoped key
alice = UserMemoryClient("alice-chen", "dk-alice-scoped-key")
alice.store_private("My Q3 performance goal: improve API response time by 40%", 0.88)
context = alice.build_agent_context("performance goals")
print(context)

import { DakeraClient } from '@dakera-ai/dakera';

// Admin client -- provisioning only
const admin = new DakeraClient({ baseUrl: 'http://localhost:3300', apiKey: 'dk-admin-key' });

interface PermissionSpec {
  namespace: string;
  scopes: ('read' | 'write' | 'delete')[];
}

type UserRole = 'user' | 'moderator' | 'admin';

function buildPermissions(userId: string, role: UserRole, teamId?: string): PermissionSpec[] {
  const perms: PermissionSpec[] = [
    { namespace: `user-${userId}`, scopes: ['read', 'write', 'delete'] },
    { namespace: 'shared-org', scopes: ['read'] },
    { namespace: 'shared-docs', scopes: ['read'] },
  ];

  if (teamId) {
    perms.push({ namespace: `team-${teamId}`, scopes: ['read', 'write'] });
  }

  if (role === 'moderator') {
    perms.push({ namespace: 'shared-org', scopes: ['read', 'write'] });
  }

  return perms;
}

class UserMemoryClient {
  private readonly client: DakeraClient;
  private readonly userNs: string;

  constructor(userId: string, scopedApiKey: string) {
    this.userNs = `user-${userId}`;
    this.client = new DakeraClient({ baseUrl: 'http://localhost:3300', apiKey: scopedApiKey });
  }

  async storePrivate(content: string, importance = 0.8): Promise<void> {
    await this.client.storeMemory(this.userNs, { content, importance, memoryType: 'semantic' });
  }

  async recallPrivate(query: string, topK = 5) {
    return this.client.recall(this.userNs, query, { top_k: topK });
  }

  async recallShared(query: string, topK = 5) {
    // Will 403 if scoped key doesn't have read access to shared-org
    return this.client.recall('shared-org', query, { top_k: topK });
  }

  async recallTeam(teamId: string, query: string, topK = 5) {
    return this.client.recall(`team-${teamId}`, query, { top_k: topK });
  }

  async buildAgentContext(query: string): Promise<string> {
    const [privateResult, sharedResult] = await Promise.all([
      this.recallPrivate(query, 5),
      this.recallShared(query, 3),
    ]);

    const parts: string[] = [];
    if (privateResult.memories.length) {
      parts.push('[Your private context]
' + privateResult.memories.map(m => m.content).join('
'));
    }
    if (sharedResult.memories.length) {
      parts.push('[Organizational knowledge]
' + sharedResult.memories.map(m => m.content).join('
'));
    }
    return parts.join('

');
  }

  async listAccessibleNamespaces() {
    // Returns only namespaces the scoped key can access
    return this.client.listNamespaces();
  }
}

// GDPR deletion (admin only)
async function deleteUserData(userId: string): Promise<void> {
  const ns = `user-${userId}`;
  const allMemories = await admin.recall(ns, 'user data personal information', { top_k: 1000 });
  const ids = allMemories.memories.map(m => m.id).filter(Boolean) as string[];

  if (ids.length) {
    await admin.batchForget({ agentId: ns, memoryIds: ids });
  }
  console.log(`Deleted ${ids.length} memories for user ${userId}`);
}

// Key rotation on role change
async function updateUserRole(userId: string, newRole: UserRole, newTeamId?: string) {
  // 1. Build new permissions
  const newPerms = buildPermissions(userId, newRole, newTeamId);
  // 2. admin.revokeApiKey(`${userId}-key`) -- revoke old
  // 3. admin.createApiKey({ label: `${userId}-key`, permissions: newPerms }) -- issue new
  // 4. secretsManager.update(`dakera-key-${userId}`, newKey.secret)
  console.log(`Rotated key for ${userId} with role ${newRole}`);
}

// Usage
const alice = new UserMemoryClient('alice-chen', 'dk-alice-scoped-key');
await alice.storePrivate('My Q3 goal: improve API response time by 40%', 0.88);
const context = await alice.buildAgentContext('performance goals');
console.log(context);

use dakera_rs::{Client, StoreMemoryRequest, RecallRequest};

// Admin client (provisioning only -- never in request hot path)
let admin = Client::new("http://localhost:3300", "dk-admin-key");

// List existing namespaces
let namespaces = admin.list_namespaces().await?;
println!("Active namespaces: {:?}", namespaces);

// Alice's scoped client (rw: user-alice-chen, r: shared-org)
let alice = Client::new("http://localhost:3300", "dk-alice-scoped-key");

// Store private memory -- enforced server-side to user-alice-chen namespace
alice.store_memory("user-alice-chen", StoreMemoryRequest {
    content: "My Q3 performance goal: reduce API p99 latency by 40%.".into(),
    importance: Some(0.88),
    memory_type: "semantic".into(),
    ..Default::default()
}).await?;

// Recall from shared organizational namespace (read-only for alice)
let shared = alice.recall("shared-org", RecallRequest {
    query: "engineering standards documentation".into(),
    top_k: Some(5),
    ..Default::default()
}).await?;

// Attempt to write to shared-org -- will return 403 if alice's key is read-only
// let result = alice.store_memory("shared-org", StoreMemoryRequest { ... }).await;
// assert!(result.is_err()); // 403 Forbidden

// Verify alice cannot access bob's namespace
// let result = alice.recall("user-bob-smith", RecallRequest { ... }).await;
// assert!(result.is_err()); // 403 Forbidden

// Get memory policy for a namespace (admin operation)
let policy = admin.get_memory_policy("shared-org").await?;
println!("Shared org policy: {:?}", policy);

package main

import (
    "context"
    "fmt"

    dakera "github.com/dakera-ai/dakera-go"
)

func main() {
    ctx := context.Background()

    // Admin client -- provisioning only
    admin := dakera.NewClient("http://localhost:3300", "dk-admin-key")

    // List namespaces (admin can see all)
    namespaces, _ := admin.ListNamespaces(ctx)
    fmt.Printf("Namespaces: %v
", namespaces)

    // Alice's scoped client
    alice := dakera.NewClient("http://localhost:3300", "dk-alice-scoped-key")

    // Store private memory (alice can only write to user-alice-chen)
    alice.StoreMemory(ctx, "user-alice-chen", dakera.StoreMemoryRequest{
        Content:    "My Q3 goal: reduce API p99 latency by 40%.",
        Importance: 0.88,
        MemoryType: "semantic",
    })

    // Recall from shared namespace (read-only for alice)
    shared, _ := alice.Recall(ctx, "shared-org", dakera.RecallRequest{
        Query: "engineering standards documentation",
        TopK:  5,
    })
    fmt.Printf("Shared context: %d memories
", len(shared.Memories))

    // Attempt cross-tenant write -- blocked by Dakera (returns 403)
    _, err := alice.StoreMemory(ctx, "user-bob-smith", dakera.StoreMemoryRequest{
        Content: "Attempted cross-tenant write",
    })
    if err != nil {
        fmt.Println("Cross-tenant write blocked:", err) // 403 Forbidden
    }

    // Get memory policy
    policy, _ := admin.GetMemoryPolicy(ctx, "shared-org")
    fmt.Printf("Shared org policy: %+v
", policy)
}

// GDPR deletion helper
func deleteUserData(ctx context.Context, admin *dakera.Client, userID string) error {
    ns := fmt.Sprintf("user-%s", userID)
    memories, err := admin.Recall(ctx, ns, dakera.RecallRequest{
        Query: "all memories",
        TopK:  1000,
    })
    if err != nil {
        return err
    }

    ids := make([]string, 0, len(memories.Memories))
    for _, m := range memories.Memories {
        ids = append(ids, m.ID)
    }

    if len(ids) > 0 {
        return admin.BatchForget(ctx, ns, ids)
    }
    return nil
}