Merge remote-tracking branch 'upstream/main' into leseb/api-spec-comparison-v2

Signed-off-by: Sébastien Han <seb@redhat.com>

Author: leseb

.github/workflows/README.md

@@ -13,7 +13,7 @@ OGX uses GitHub Actions for Continuous Integration (CI). Below is a table detail
 | File Processors Tests | [file-processors-tests.yml](file-processors-tests.yml) | Run file processors integration tests |
 | Installer CI | [install-script-ci.yml](install-script-ci.yml) | Test the installation script |
 | Integration Auth Tests | [integration-auth-tests.yml](integration-auth-tests.yml) | Run the integration test suite with Kubernetes authentication |
-| Integration Responses & Conversations Auth Tests | [integration-responses-conversations-auth-tests.yml](integration-responses-conversations-auth-tests.yml) | Run responses and conversations auth tests with Kubernetes authentication |
+| Integration Responses, Conversations & Prompts Auth Tests | [integration-responses-conversations-auth-tests.yml](integration-responses-conversations-auth-tests.yml) | Run responses, conversations, and prompts auth tests with Kubernetes authentication |
 | SqlStore Integration Tests | [integration-sql-store-tests.yml](integration-sql-store-tests.yml) | Run the integration test suite with SqlStore |
 | Integration Tests (Replay) | [integration-tests.yml](integration-tests.yml) | Run the integration test suites from tests/integration in replay mode |
 | Vector IO Integration Tests | [integration-vector-io-tests.yml](integration-vector-io-tests.yml) | Run the integration test suite with various VectorIO providers |

.github/workflows/integration-responses-conversations-auth-tests.yml

@@ -1,6 +1,6 @@
-name: Integration Responses & Conversations Auth Tests
+name: Integration Responses, Conversations & Prompts Auth Tests
 
-run-name: Run responses and conversations auth tests with Kubernetes authentication
+run-name: Run responses, conversations, and prompts auth tests with Kubernetes authentication
 
 on:
   push:
@@ -218,6 +218,16 @@ jobs:
                   when:
                     - user is owner
                   description: Users can access their own responses
+                - permit:
+                    actions: [create]
+                    resource: sql_record::prompts::*
+                  description: Any authenticated user can create prompts
+                - permit:
+                    actions: [read, update, delete]
+                    resource: sql_record::prompts::*
+                  when:
+                    - user is owner
+                  description: Users can only access their own prompts
           EOF
           yq eval '.server.auth.provider_config.type = "${{ matrix.auth-provider }}"' -i "$run_dir/config.yaml"
           yq eval '.server.auth.provider_config.tls_cafile = "${{ env.KUBERNETES_CA_CERT_PATH }}"' -i "$run_dir/config.yaml"

.pre-commit-config.yaml

@@ -308,6 +308,26 @@ repos:
             }
             exit 0
 
+      - id: enforce-authorized-sqlstore
+        name: Enforce AuthorizedSqlStore usage
+        entry: bash
+        language: system
+        types: [python]
+        pass_filenames: false
+        always_run: true
+        files: ^src/
+        args:
+          - -c
+          - |
+            grep -rn --include="*.py" -E 'sqlstore_impl' src/ \
+              | grep -v 'core/storage/sqlstore/' && {
+              echo;
+              echo "❌ Direct sqlstore_impl usage is not allowed outside core/storage/sqlstore/.";
+              echo "Use authorized_sqlstore() from ogx.core.storage.sqlstore.authorized_sqlstore instead.";
+              echo;
+              exit 1;
+            } || true
+
       - id: check-file-size
         name: Check Python file size limit
         entry: python scripts/check_file_size.py

ARCHITECTURE.md

@@ -21,7 +21,6 @@ Client (ogx-client SDK or raw HTTP)
 FastAPI Server  (src/ogx/core/server/server.py)
   |
   |-- AuthenticationMiddleware  (token validation, user extraction)
-  |-- QuotaMiddleware           (rate limiting per client)
   |
   v
 Route Dispatch