Merge remote-tracking branch 'upstream/main' into fix/docling-chunk-metadata

Signed-off-by: Peter Gustafsson <peter.gustafsson6@gmail.com>

Author: Peter Gustafsson

client-sdks/stainless/openapi.yml

@@ -13928,6 +13928,7 @@ components:
           anyOf:
           - type: string
           - type: 'null'
+          description: Name of the ranking algorithm. Supported values are "weighted", "rrf", "neural", and "classifier". Other string values are accepted for OpenAI API compatibility but are not supported.
         score_threshold:
           anyOf:
           - type: number

docs/docs/distributions/configuration.mdx

@@ -308,6 +308,24 @@ This allows you to:
 
 The server supports multiple authentication providers:
 
+#### Local API Key Provider
+
+Validates a shared secret API key against a list of allowed keys:
+
+```yaml
+server:
+  auth:
+    provider_config:
+      type: "local_api_key"
+      api_keys:
+      - "ogk_mykey1"
+      - "ogk_mykey2"
+```
+
+This is the simplest authentication provider — any key in the list authenticates successfully and is granted `admin` and `owner` [roles](../configuration.mdx#access-control) so the default owner-based access-controls work out of the box. Use it for development, internal services, or when you prefer to manage keys outside an identity provider.
+
+The token is validated as `Authorization: Bearer <key>` and the key string itself becomes the user principal. Because this provider does not resolve a `tenant_id`, it is only compatible with `server.tenancy.mode` `single` or `disabled` — startup will fail with `multi`.
+
 #### OAuth 2.0/OpenID Connect Provider with Kubernetes
 
 The server can be configured to use service account tokens for authorization, validating these against the Kubernetes API server, e.g.:

docs/static/deprecated-ogx-spec.yaml

@@ -7572,6 +7572,7 @@ components:
           anyOf:
           - type: string
           - type: 'null'
+          description: Name of the ranking algorithm. Supported values are "weighted", "rrf", "neural", and "classifier". Other string values are accepted for OpenAI API compatibility but are not supported.
         score_threshold:
           anyOf:
           - type: number

docs/static/experimental-ogx-spec.yaml

@@ -8942,6 +8942,7 @@ components:
           anyOf:
           - type: string
           - type: 'null'
+          description: Name of the ranking algorithm. Supported values are "weighted", "rrf", "neural", and "classifier". Other string values are accepted for OpenAI API compatibility but are not supported.
         score_threshold:
           anyOf:
           - type: number

docs/static/ogx-spec.yaml

@@ -12444,6 +12444,7 @@ components:
           anyOf:
           - type: string
           - type: 'null'
+          description: Name of the ranking algorithm. Supported values are "weighted", "rrf", "neural", and "classifier". Other string values are accepted for OpenAI API compatibility but are not supported.
         score_threshold:
           anyOf:
           - type: number

docs/static/stainless-ogx-spec.yaml

@@ -13928,6 +13928,7 @@ components:
           anyOf:
           - type: string
           - type: 'null'
+          description: Name of the ranking algorithm. Supported values are "weighted", "rrf", "neural", and "classifier". Other string values are accepted for OpenAI API compatibility but are not supported.
         score_threshold:
           anyOf:
           - type: number

scripts/check_file_size.py

@@ -26,6 +26,7 @@
 # Remove entries from this list as files get refactored.
 GRANDFATHERED_FILES = {
     "scripts/openapi_generator/schema_transforms.py",
+    "src/ogx/cli/stack/lets_go.py",
     "src/ogx/core/datatypes.py",
     "src/ogx/core/library_client.py",
     "src/ogx/providers/inline/responses/builtin/responses/openai_responses.py",

src/ogx/cli/stack/lets_go.py

@@ -12,6 +12,7 @@
 import inspect
 import logging  # allow-direct-logging :: for direct logging control in _suppress_provider_logs
 import os
+import secrets
 import shutil
 import subprocess
 import sys
@@ -210,6 +211,18 @@ def add_letsgo_arguments(parser: argparse.ArgumentParser) -> None:
         default=False,
         help="Allow running without TLS certificates. Disables FIPS enforcement. For local development only.",
     )
+    parser.add_argument(
+        "--host",
+        type=str,
+        default="127.0.0.1",
+        help="Host to bind the server to",
+    )
+    parser.add_argument(
+        "--no-auth",
+        action="store_true",
+        default=False,
+        help="Disable authentication entirely (generates no server.auth block in config).",
+    )
 
 
 def _add_file_search_and_responses(run_config: StackConfig) -> None:
@@ -471,6 +484,23 @@ async def _run_letsgo_cmd_impl(args: argparse.Namespace, parser: argparse.Argume
         config_dict["server"]["insecure"] = False
         cprint(f"  ✓ Generated self-signed TLS certificate → {cert_path}", color="green")
 
+    config_dict["server"]["host"] = args.host
+
+    if not args.no_auth:
+        api_keys = [f"ogk_{secrets.token_urlsafe(24)}" for _ in range(3)]
+        if "server" not in config_dict:
+            config_dict["server"] = {}
+        config_dict["server"]["auth"] = {
+            "provider_config": {"type": "local_api_key", "api_keys": api_keys},
+        }
+        cprint("  ✓ Simple authentication enabled", color="green")
+        cprint("    Here are keys you can use for authentication:", color="green")
+        for key in api_keys:
+            cprint(f"      {key}", color="yellow")
+        cprint(f'    curl -k -H "Authorization: Bearer {api_keys[0]}" \\', color="cyan")
+        cprint(f"      https://localhost:{args.port}/v1/chat/completions", color="cyan")
+        cprint("", color="green")
+
     config_file = distro_dir / "config.yaml"
     logger.info("Writing generated config to", config_file=config_file)
     with open(config_file, "w") as f:
@@ -552,6 +582,7 @@ async def _autodetect_providers(debug: bool = False) -> tuple[str, tuple[Qualifi
         ("remote::anthropic", None, "https://api.anthropic.com/v1", "ANTHROPIC_API_KEY", None),
         ("remote::gemini", None, "https://generativelanguage.googleapis.com/v1beta/openai", "GEMINI_API_KEY", None),
         ("remote::azure", "AZURE_API_BASE", "", "AZURE_API_KEY", None),
+        ("remote::meta", None, "https://api.meta.ai/v1", "META_API_KEY", None),
     ]
 
     passed: list[str] = []

src/ogx/core/datatypes.py

@@ -202,6 +202,7 @@ class OAuth2IntrospectionConfig(BaseModel):
 class AuthProviderType(StrEnum):
     """Supported authentication provider types."""
 
+    LOCAL_API_KEY = "local_api_key"
     OAUTH2_TOKEN = "oauth2_token"
     GITHUB_TOKEN = "github_token"
     CUSTOM = "custom"
@@ -303,6 +304,15 @@ class CustomAuthConfig(BaseModel):
     )
 
 
+class LocalApiKeyAuthConfig(BaseModel):
+    """Simple API key authentication for single-key deployments."""
+
+    type: Literal[AuthProviderType.LOCAL_API_KEY] = AuthProviderType.LOCAL_API_KEY
+    api_keys: list[str] = Field(
+        description="API keys that clients can send via the Authorization: Bearer header.",
+    )
+
+
 class GitHubTokenAuthConfig(BaseModel):
     """Configuration for GitHub token authentication."""
 
@@ -394,6 +404,7 @@ class UpstreamHeaderAuthConfig(BaseModel):
 
 AuthProviderConfig = Annotated[
     OAuth2TokenAuthConfig
+    | LocalApiKeyAuthConfig
     | GitHubTokenAuthConfig
     | CustomAuthConfig
     | KubernetesAuthProviderConfig

src/ogx/core/server/README.md

@@ -9,7 +9,7 @@ server/
   __init__.py
   server.py                    # Main FastAPI app, route dispatch, SSE streaming, lifespan
   auth.py                      # AuthenticationMiddleware (Bearer token validation)
-  auth_providers.py            # Auth provider implementations (Kubernetes, custom endpoint)
+  auth_providers.py            # Auth provider implementations (Kubernetes, custom endpoint, local API key)
   metrics.py                   # RequestMetricsMiddleware (per-API request metrics)
   routes.py                    # Route initialization and matching from FastAPI routers
   fastapi_router_registry.py   # Auto-discovery of FastAPI routers from ogx_api packages
@@ -30,7 +30,7 @@ Routes are defined as native FastAPI routers. `fastapi_router_registry.py` auto-
 ### Middleware
 
 - **`RequestMetricsMiddleware`** (`metrics.py`): Tracks per-API request counts and latency metrics. Runs as the outermost middleware.
-- **`AuthenticationMiddleware`** (`auth.py`): Validates Bearer tokens using a configured auth provider (Kubernetes, custom endpoint). Extracts user identity, attributes, and `tenant_id` for access control. Each auth provider resolves `tenant_id` from its source (JWT claim, HTTP header, K8s claim, or custom endpoint field). Endpoints can opt out by setting `openapi_extra={PUBLIC_ROUTE_KEY: True}` on their route.
+- **`AuthenticationMiddleware`** (`auth.py`): Validates Bearer tokens using a configured auth provider (Kubernetes, custom endpoint, local API key). Extracts user identity, attributes, and `tenant_id` for access control. Each auth provider resolves `tenant_id` from its source (JWT claim, HTTP header, K8s claim, or custom endpoint field). The local API key provider returns attributes (`roles`, `teams`) but **does not** resolve `tenant_id` — it only supports `single` or `disabled` tenancy modes. Endpoints can opt out by setting `openapi_extra={PUBLIC_ROUTE_KEY: True}` on their route.
 - **`TenancyMiddleware`** (`auth.py`): Enforces the configured tenancy mode after authentication. In `disabled` mode: passthrough. In `single` mode: overrides `tenant_id` to the configured default (works with or without auth). In `multi` mode: rejects requests with no `tenant_id` (401).
 - **`RouteAuthorizationMiddleware`** (`auth.py`): Enforces route-level access policies based on user roles.
 - **`ClientVersionMiddleware`** (`server.py`): Rejects requests from clients with incompatible major.minor versions.