330 lines
12 KiB
Python
330 lines
12 KiB
Python
"""
|
|
Member Portal — membership middleware for the Inference Cooperative.
|
|
|
|
Reconciles three systems:
|
|
1. Open Collective — who is a paying member (billing)
|
|
2. Cloudron — who can log in (identity/SSO)
|
|
3. LiteLLM — who can use the models, and how much (inference)
|
|
|
|
Three responsibilities:
|
|
A. Webhook handler — listen for Open Collective membership events
|
|
B. Key injector — read the member's email from a header, inject their
|
|
LiteLLM key, and forward the request to the gateway
|
|
C. Admin endpoints — health, status, manual reconciliation
|
|
"""
|
|
|
|
import os
|
|
import json
|
|
import logging
|
|
import sqlite3
|
|
import secrets
|
|
|
|
import httpx
|
|
from fastapi import FastAPI, Request, Response, HTTPException
|
|
from fastapi.responses import JSONResponse
|
|
|
|
logging.basicConfig(level=logging.INFO)
|
|
logger = logging.getLogger("member-portal")
|
|
|
|
app = FastAPI(title="Inference Cooperative Member Portal")
|
|
|
|
# --- Configuration (from environment) ---
|
|
CLOUDRON_API = os.environ.get("CLOUDRON_API_ORIGIN", "https://my.inference.coop")
|
|
CLOUDRON_TOKEN = os.environ.get("CLOUDRON_TOKEN", "")
|
|
LITELLM_BASE = os.environ.get("LITELLM_BASE", "https://gateway.inference.coop")
|
|
LITELLM_MASTER_KEY = os.environ.get("LITELLM_MASTER_KEY", "")
|
|
OPENCOLLECTIVE_SECRET = os.environ.get("OPENCOLLECTIVE_WEBHOOK_SECRET", "")
|
|
|
|
# Shared secret that LibreChat sends as a header on every request, so the
|
|
# portal can verify the request genuinely came through LibreChat (which is
|
|
# behind Cloudron SSO) rather than a direct, spoofed request.
|
|
PORTAL_SECRET = os.environ.get("PORTAL_SECRET", "")
|
|
|
|
# Secret token required in the Open Collective webhook URL path. Open
|
|
# Collective's generic webhooks are not HMAC-signed, so a secret in the URL
|
|
# is the standard way to authenticate them.
|
|
WEBHOOK_TOKEN = os.environ.get("WEBHOOK_TOKEN", "")
|
|
|
|
# Monthly credit budget (in USD of tokens) for all members.
|
|
# Single sliding-scale tier: everyone gets the same $15/month in credits,
|
|
# regardless of their $10/15/20 contribution. Governance decision (Loomio).
|
|
MEMBER_BUDGET = float(os.environ.get("MEMBER_BUDGET", "15.0"))
|
|
|
|
# The "members" group in Cloudron (group-based access control).
|
|
# Members are assigned to this group, which grants access to the chat app.
|
|
MEMBERS_GROUP_ID = os.environ.get("MEMBERS_GROUP_ID", "")
|
|
|
|
# Persistent store (SQLite) for email → LiteLLM key token mapping.
|
|
# Lives in /app/data (Cloudron localstorage addon persists this).
|
|
DB_PATH = os.environ.get("DB_PATH", "/app/data/members.db")
|
|
|
|
|
|
def _verify_portal_secret(request: Request) -> None:
|
|
"""Reject requests that didn't come through LibreChat (shared secret)."""
|
|
if not PORTAL_SECRET:
|
|
# If no secret is configured, refuse to inject keys (fail closed).
|
|
raise HTTPException(503, "Portal secret not configured")
|
|
provided = request.headers.get("x-portal-secret", "")
|
|
if not secrets.compare_digest(provided, PORTAL_SECRET):
|
|
raise HTTPException(401, "Invalid portal secret")
|
|
|
|
|
|
def get_db() -> sqlite3.Connection:
|
|
conn = sqlite3.connect(DB_PATH)
|
|
conn.execute(
|
|
"CREATE TABLE IF NOT EXISTS members ("
|
|
"email TEXT PRIMARY KEY, "
|
|
"key_token TEXT, "
|
|
"cloudron_user_id TEXT, "
|
|
"active INTEGER DEFAULT 1"
|
|
")"
|
|
)
|
|
return conn
|
|
|
|
|
|
def store_member(email: str, key_token: str, cloudron_user_id: str) -> None:
|
|
conn = get_db()
|
|
conn.execute(
|
|
"INSERT INTO members (email, key_token, cloudron_user_id, active) "
|
|
"VALUES (?, ?, ?, 1) "
|
|
"ON CONFLICT(email) DO UPDATE SET key_token=excluded.key_token, "
|
|
"cloudron_user_id=excluded.cloudron_user_id, active=1",
|
|
(email, key_token, cloudron_user_id),
|
|
)
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
|
|
def get_member_key(email: str) -> str | None:
|
|
conn = get_db()
|
|
row = conn.execute(
|
|
"SELECT key_token FROM members WHERE email = ? AND active = 1", (email,)
|
|
).fetchone()
|
|
conn.close()
|
|
return row[0] if row else None
|
|
|
|
|
|
def deactivate_member(email: str) -> str | None:
|
|
"""Mark a member inactive and return their key token (for deletion)."""
|
|
conn = get_db()
|
|
row = conn.execute(
|
|
"SELECT key_token FROM members WHERE email = ?", (email,)
|
|
).fetchone()
|
|
conn.execute("UPDATE members SET active = 0 WHERE email = ?", (email,))
|
|
conn.commit()
|
|
conn.close()
|
|
return row[0] if row else None
|
|
|
|
|
|
# --- Helpers ---
|
|
|
|
def cloudron_headers() -> dict:
|
|
return {"Authorization": f"Bearer {CLOUDRON_TOKEN}"}
|
|
|
|
|
|
async def cloudron_create_user(email: str, name: str) -> str:
|
|
"""Create (or return existing) Cloudron user, assigned to the members group.
|
|
|
|
Verified user shape (from live API):
|
|
{id, username, email, fallbackEmail, displayName, role, active, groupIds}
|
|
Roles: "owner", "admin", "user".
|
|
Group assignment is a SEPARATE call: PUT /api/v1/users/:userId/groups
|
|
with body {"groupIds": [...]}.
|
|
"""
|
|
async with httpx.AsyncClient() as client:
|
|
# Check if user exists
|
|
r = await client.get(
|
|
f"{CLOUDRON_API}/api/v1/users",
|
|
headers=cloudron_headers(),
|
|
)
|
|
r.raise_for_status()
|
|
for u in r.json().get("users", []):
|
|
if u.get("email") == email:
|
|
return u["id"]
|
|
|
|
# Create user (role "user" = regular member)
|
|
r = await client.post(
|
|
f"{CLOUDRON_API}/api/v1/users",
|
|
headers=cloudron_headers(),
|
|
json={
|
|
"username": email.split("@")[0],
|
|
"email": email,
|
|
"displayName": name,
|
|
"role": "user",
|
|
"active": True,
|
|
},
|
|
)
|
|
r.raise_for_status()
|
|
return r.json()["id"]
|
|
|
|
|
|
async def cloudron_set_group(user_id: str) -> None:
|
|
"""Assign a user to the members group (grants chat app access)."""
|
|
if not MEMBERS_GROUP_ID:
|
|
logger.warning("MEMBERS_GROUP_ID not set; skipping group assignment")
|
|
return
|
|
async with httpx.AsyncClient() as client:
|
|
r = await client.put(
|
|
f"{CLOUDRON_API}/api/v1/users/{user_id}/groups",
|
|
headers=cloudron_headers(),
|
|
json={"groupIds": [MEMBERS_GROUP_ID]},
|
|
)
|
|
r.raise_for_status()
|
|
|
|
|
|
async def cloudron_set_active(user_id: str, active: bool) -> None:
|
|
async with httpx.AsyncClient() as client:
|
|
r = await client.post(
|
|
f"{CLOUDRON_API}/api/v1/users/{user_id}",
|
|
headers=cloudron_headers(),
|
|
json={"active": active},
|
|
)
|
|
r.raise_for_status()
|
|
|
|
|
|
async def litellm_create_key(email: str, budget: float) -> str:
|
|
"""Create a LiteLLM virtual key for a member with a budget cap."""
|
|
async with httpx.AsyncClient() as client:
|
|
r = await client.post(
|
|
f"{LITELLM_BASE}/key/generate",
|
|
headers={"Authorization": f"Bearer {LITELLM_MASTER_KEY}"},
|
|
json={
|
|
"key_alias": f"member:{email}",
|
|
"max_budget": budget,
|
|
"budget_duration": "30d",
|
|
"models": ["deepseek-v4-flash", "gpt-oss-120b"],
|
|
},
|
|
)
|
|
r.raise_for_status()
|
|
return r.json().get("key", "")
|
|
|
|
|
|
async def litellm_disable_key(key_token: str) -> None:
|
|
"""Delete a member's LiteLLM key (on payment lapse)."""
|
|
if not key_token:
|
|
return
|
|
async with httpx.AsyncClient() as client:
|
|
await client.post(
|
|
f"{LITELLM_BASE}/key/delete",
|
|
headers={"Authorization": f"Bearer {LITELLM_MASTER_KEY}"},
|
|
json={"keys": [key_token]},
|
|
)
|
|
|
|
|
|
# --- A. Open Collective webhook ---
|
|
|
|
@app.post("/webhook/opencollective/{token}")
|
|
async def opencollective_webhook(request: Request, token: str):
|
|
"""Handle Open Collective membership events.
|
|
|
|
Authenticated by a secret token in the URL path (Open Collective's
|
|
generic webhooks are not HMAC-signed, so a secret URL is the standard
|
|
way to authenticate them).
|
|
"""
|
|
if not WEBHOOK_TOKEN or not secrets.compare_digest(token, WEBHOOK_TOKEN):
|
|
raise HTTPException(401, "Invalid webhook token")
|
|
|
|
payload = await request.json()
|
|
|
|
event_type = payload.get("type", "")
|
|
data = payload.get("data", {})
|
|
member = data.get("member", {}) or data.get("fromCollective", {})
|
|
email = member.get("email") or data.get("email")
|
|
name = member.get("name", "Member")
|
|
|
|
if not email:
|
|
logger.warning("Webhook without email: %s", event_type)
|
|
return JSONResponse({"status": "ignored", "reason": "no email"})
|
|
|
|
logger.info("Open Collective event: %s for %s", event_type, email)
|
|
|
|
# Open Collective webhook events (verified):
|
|
# - "order.processed" → fires on EVERY payment (incl. monthly recurring)
|
|
# - "new member" → fires on FIRST contribution only
|
|
# - payload has "firstPayment" boolean to distinguish new vs recurring
|
|
# - "collective.transaction.created" is DEPRECATED (being removed)
|
|
if event_type in ("order.processed", "new.member", "collective.member.created"):
|
|
# New or renewed member → ensure active
|
|
user_id = await cloudron_create_user(email, name)
|
|
await cloudron_set_group(user_id)
|
|
await cloudron_set_active(user_id, True)
|
|
key_token = await litellm_create_key(email, MEMBER_BUDGET)
|
|
store_member(email, key_token, user_id)
|
|
return JSONResponse({"status": "activated", "user_id": user_id, "budget": MEMBER_BUDGET})
|
|
|
|
if event_type in ("collective.member.deleted", "collective.transaction.deleted"):
|
|
# Lapsed member → deactivate
|
|
key_token = deactivate_member(email)
|
|
await litellm_disable_key(key_token)
|
|
return JSONResponse({"status": "deactivated"})
|
|
|
|
return JSONResponse({"status": "ignored", "type": event_type})
|
|
|
|
|
|
# --- B. Key injector (proxy) ---
|
|
|
|
@app.get("/v1/models")
|
|
async def list_models():
|
|
"""List models (same for everyone — no per-user auth needed)."""
|
|
async with httpx.AsyncClient() as client:
|
|
r = await client.get(
|
|
f"{LITELLM_BASE}/v1/models",
|
|
headers={"Authorization": f"Bearer {LITELLM_MASTER_KEY}"},
|
|
)
|
|
return Response(
|
|
content=r.content,
|
|
status_code=r.status_code,
|
|
headers={"content-type": r.headers.get("content-type", "application/json")},
|
|
)
|
|
|
|
|
|
@app.api_route("/v1/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
|
|
async def inject_key(request: Request, path: str):
|
|
"""Read the member's email from a header, inject their key, forward to LiteLLM."""
|
|
# Verify the request came through LibreChat (shared secret), so a direct
|
|
# caller can't spoof the X-User-Email header and use another member's key.
|
|
_verify_portal_secret(request)
|
|
|
|
email = request.headers.get("x-user-email", "")
|
|
if not email:
|
|
raise HTTPException(401, "No member identity (x-user-email header)")
|
|
|
|
# Look up the member's key from the persistent store
|
|
member_key = get_member_key(email)
|
|
|
|
if not member_key:
|
|
raise HTTPException(403, "No active membership key")
|
|
|
|
# Forward the request to LiteLLM with the member's key
|
|
body = await request.body()
|
|
headers = dict(request.headers)
|
|
headers["authorization"] = f"Bearer {member_key}"
|
|
headers.pop("host", None)
|
|
headers.pop("content-length", None)
|
|
|
|
async with httpx.AsyncClient() as client:
|
|
upstream = await client.request(
|
|
method=request.method,
|
|
url=f"{LITELLM_BASE}/v1/{path}",
|
|
headers=headers,
|
|
content=body,
|
|
)
|
|
|
|
return Response(
|
|
content=upstream.content,
|
|
status_code=upstream.status_code,
|
|
headers={"content-type": upstream.headers.get("content-type", "application/json")},
|
|
)
|
|
|
|
|
|
# --- C. Admin / health ---
|
|
|
|
@app.get("/health")
|
|
async def health():
|
|
return {"status": "ok"}
|
|
|
|
|
|
@app.get("/")
|
|
async def index():
|
|
return {"service": "Inference Cooperative Member Portal", "version": "0.1.0"}
|