Memory Permissions

from dakera import DakeraClient
from typing import Optional

# Admin client (super_admin key) -- used ONLY for provisioning, never in application code
admin = DakeraClient(base_url="http://localhost:3000", api_key="dk-super-admin-key")

def ns(agent_id: str) -> str:
    """An agent's memories live in the namespace _dakera_agent_{agent_id}."""
    return f"_dakera_agent_{agent_id}"

SHARED_AGENTS = ["shared-org", "shared-docs"]

# --- PROVISIONING: Run once during infrastructure setup ---
def setup_shared_agents() -> None:
    """Create the organization-level agents (and their namespaces) ahead of time."""
    for agent_id in SHARED_AGENTS:
        admin.create_agent(agent_id)  # existing agents are left untouched

def onboard_user(user_id: str, team_id: Optional[str] = None) -> dict:
    """Provision a new user: create their agent and issue two scoped keys.

    A key has one scope plus a namespace grant list, so read+write on the
    user's own (and team) namespace and read-only on shared knowledge
    need two keys.
    """
    admin.create_agent(f"user-{user_id}")
    write_grants = [ns(f"user-{user_id}")]
    if team_id:
        write_grants.append(ns(f"team-{team_id}"))

    write_key = admin.create_key(
        name=f"{user_id}-write", scope="write", namespaces=write_grants, expires_in_days=90
    )
    read_key = admin.create_key(
        name=f"{user_id}-read-shared", scope="read",
        namespaces=[ns(a) for a in SHARED_AGENTS], expires_in_days=90
    )
    # Store both keys in your secrets manager; the key value is shown only once
    # secrets_manager.store(f"dakera-write-{user_id}", write_key["key"])
    # secrets_manager.store(f"dakera-read-{user_id}", read_key["key"])
    return {"write_key_id": write_key["key_id"], "read_key_id": read_key["key_id"]}

def change_team(write_key_id: str, user_id: str, new_team_id: str) -> None:
    """Replace the write key's grants in place (scope cannot change)."""
    admin.update_key(write_key_id, namespaces=[ns(f"user-{user_id}"), ns(f"team-{new_team_id}")])

# --- APPLICATION: Runtime operations using the user's scoped keys ---
class UserMemoryClient:
    """Application-level wrapper; Dakera enforces what each key may do."""

    def __init__(self, user_id: str, write_key: str, read_key: str):
        self.agent_id = f"user-{user_id}"
        self.client = DakeraClient(base_url="http://localhost:3000", api_key=write_key)
        self.shared = DakeraClient(base_url="http://localhost:3000", api_key=read_key)

    def store_private(self, content: str, importance: float = 0.8) -> None:
        """Store private memory -- only keys granted this namespace can reach it."""
        self.client.store_memory(
            agent_id=self.agent_id,
            content=content,
            importance=importance,
            memory_type="semantic"
        )

    def recall_private(self, query: str, top_k: int = 5) -> list:
        return self.client.recall(agent_id=self.agent_id, query=query, top_k=top_k).memories

    def recall_team(self, team_id: str, query: str, top_k: int = 5) -> list:
        return self.client.recall(agent_id=f"team-{team_id}", query=query, top_k=top_k).memories

    def recall_shared(self, query: str, top_k: int = 5) -> list:
        """Read-only key: a store_memory() into shared-org would get 403."""
        return self.shared.recall(agent_id="shared-org", query=query, top_k=top_k).memories

    def build_agent_context(self, query: str) -> str:
        """Two separately authorized recalls, merged in your application."""
        private = self.recall_private(query, top_k=5)
        shared = self.recall_shared(query, top_k=3)
        parts = []
        if private:
            parts.append("[Your private context]\n" + "\n".join(m.content for m in private))
        if shared:
            parts.append("[Organizational knowledge]\n" + "\n".join(m.content for m in shared))
        return "\n\n".join(parts)

# --- GDPR DELETION: Admin-only ---
def delete_user_data(user_id: str, key_ids: list[str]) -> None:
    """Permanently delete a user's memories and keys. GDPR Article 17 compliance."""
    admin.delete_namespace(ns(f"user-{user_id}"))  # the namespace and all its data
    for key_id in key_ids:
        admin.delete_key(key_id)
    print(f"Deleted namespace and {len(key_ids)} keys for user {user_id}")

import { DakeraClient } from '@dakera-ai/dakera';

// Admin client (super_admin key) -- provisioning only, never shipped to client apps
const admin = new DakeraClient({ baseUrl: 'http://localhost:3000', apiKey: process.env.DAKERA_ADMIN_KEY });

// An agent's memories live in the namespace _dakera_agent_{agentId}
const ns = (agentId: string) => `_dakera_agent_${agentId}`;
const SHARED_AGENTS = ['shared-org', 'shared-docs'];

// --- Provisioning: one write key and one read key per user (a key has one scope) ---
async function onboardUser(userId: string, teamId?: string) {
  await admin.createAgent(`user-${userId}`);

  const writeKey = await admin.createKey({
    name: `${userId}-write`,
    scope: 'write',
    namespaces: [ns(`user-${userId}`), ...(teamId ? [ns(`team-${teamId}`)] : [])],
    expires_in_days: 90,
  });
  const readKey = await admin.createKey({
    name: `${userId}-read-shared`,
    scope: 'read',
    namespaces: SHARED_AGENTS.map(ns),
    expires_in_days: 90,
  });
  // Store writeKey.key and readKey.key in your secrets manager -- shown only once
  return { writeKeyId: writeKey.key_id, readKeyId: readKey.key_id };
}

// Team change: replace the write key's grants in place (scope cannot change)
async function changeTeam(writeKeyId: string, userId: string, newTeamId: string) {
  await admin.updateKey(writeKeyId, { namespaces: [ns(`user-${userId}`), ns(`team-${newTeamId}`)] });
}

// --- Runtime: user-scoped clients ---
class UserMemoryClient {
  private client: DakeraClient;
  private shared: DakeraClient;
  private agentId: string;

  constructor(userId: string, writeKey: string, readKey: string) {
    this.agentId = `user-${userId}`;
    this.client = new DakeraClient({ baseUrl: 'http://localhost:3000', apiKey: writeKey });
    this.shared = new DakeraClient({ baseUrl: 'http://localhost:3000', apiKey: readKey });
  }

  async storePrivate(content: string, importance = 0.8) {
    await this.client.storeMemory(this.agentId, { content, importance, memory_type: 'semantic' });
  }

  async recallPrivate(query: string, topK = 5) {
    const { memories } = await this.client.recall(this.agentId, query, { top_k: topK });
    return memories;
  }

  async recallShared(query: string, topK = 3) {
    // Read-only key: a store into shared-org would get 403
    const { memories } = await this.shared.recall('shared-org', query, { top_k: topK });
    return memories;
  }

  // Two separately authorized recalls, merged in your application
  async buildContext(query: string): Promise<string> {
    const [priv, shared] = await Promise.all([this.recallPrivate(query), this.recallShared(query)]);
    const parts: string[] = [];
    if (priv.length) parts.push('[Your private context]\n' + priv.map(m => m.content).join('\n'));
    if (shared.length) parts.push('[Organizational knowledge]\n' + shared.map(m => m.content).join('\n'));
    return parts.join('\n\n');
  }
}

// GDPR deletion: the namespace and all its data, then the user's keys
async function deleteUserData(userId: string, keyIds: string[]) {
  await admin.deleteNamespace(ns(`user-${userId}`));
  for (const id of keyIds) await admin.deleteKey(id);
}

use dakera_client::{CreateKeyRequest, DakeraClient, UpdateKeyRequest};

// Admin client (super_admin key): provisioning only
let admin = DakeraClient::builder("http://localhost:3000")
    .api_key(std::env::var("DAKERA_ADMIN_KEY")?)
    .build()?;

let ns = |agent: &str| format!("_dakera_agent_{}", agent);

// Create the user's agent (and namespace) ahead of time (v0.12.2)
admin.create_agent("user-alice-chen").await?;

// A key has one scope, so Alice gets a write key and a read key
let write_key = admin.create_key(CreateKeyRequest {
    name: "alice-chen-write".into(),
    scope: "write".into(),
    namespaces: Some(vec![ns("user-alice-chen"), ns("team-engineering")]),
    expires_in_days: Some(90),
}).await?;

let read_key = admin.create_key(CreateKeyRequest {
    name: "alice-chen-read-shared".into(),
    scope: "read".into(),
    namespaces: Some(vec![ns("shared-org")]),
    expires_in_days: Some(90),
}).await?;
println!("store {} and {} in your secrets manager", write_key.key_id, read_key.key_id);

// Team change: replace the write key's grants in place
admin.update_key(
    &write_key.key_id,
    &UpdateKeyRequest::new().with_namespaces(vec![ns("user-alice-chen"), ns("team-platform")]),
).await?;

// GDPR deletion: the namespace and all its data, then the keys
admin.delete_namespace(&ns("user-alice-chen")).await?;
admin.delete_key(&write_key.key_id).await?;
admin.delete_key(&read_key.key_id).await?;

admin := dakera.NewClientWithOptions(dakera.ClientOptions{
    BaseURL: "http://localhost:3000",
    APIKey:  os.Getenv("DAKERA_ADMIN_KEY"), // super_admin: provisioning only
})
ctx := context.Background()
ns := func(agent string) string { return "_dakera_agent_" + agent }
days := 90

// Create the user's agent (and namespace) ahead of time (v0.12.2)
admin.CreateAgent(ctx, "user-alice-chen")

// A key has one scope, so Alice gets a write key and a read key
writeKey, _ := admin.CreateKey(ctx, dakera.CreateKeyRequest{
    Name:          "alice-chen-write",
    Scope:         "write",
    Namespaces:    dakera.GrantNamespaces(ns("user-alice-chen"), ns("team-engineering")),
    ExpiresInDays: &days,
})
readKey, _ := admin.CreateKey(ctx, dakera.CreateKeyRequest{
    Name:          "alice-chen-read-shared",
    Scope:         "read",
    Namespaces:    dakera.GrantNamespaces(ns("shared-org")),
    ExpiresInDays: &days,
})
// writeKey.Key and readKey.Key are shown only once: store them in your secrets manager

// Team change: replace the write key's grants in place (scope cannot change)
admin.UpdateKey(ctx, writeKey.ID, dakera.UpdateKeyRequest{
    Namespaces: dakera.GrantNamespaces(ns("user-alice-chen"), ns("team-platform")),
})

// GDPR deletion: the namespace and all its data, then the keys
admin.DeleteNamespace(ctx, ns("user-alice-chen"))
admin.DeleteKey(ctx, writeKey.ID)
admin.DeleteKey(ctx, readKey.ID)