Model driven

.env.example

@@ -44,13 +44,21 @@ MOCK_MONGODB_DATABASE='test_database'
 # Set to "mock" to deactivate access, service removes auth from agent usage
 ACCESS_SERVICE = 'service' 
 
+# Authentication Configuration
+# Set to "true" to disable authentication (useful for local development/testing)
+# When disabled, all requests use a default user named "Default User"
+DISABLE_AUTH = 'false'  # Set to 'true' to disable authentication
+
+# Session and token configuration (not used when DISABLE_AUTH=true)
+SESSION_TOKEN_TTL = '15'  # Minutes
+REFRESH_TOKEN_TTL = '14'  # Days
+JWT_TOKEN_SECRET = 'your-secret-key-at-least-32-characters-long'
+
 ## Set google api-key
 GOOGLE_CLIENT_ID="your-google-api-key.apps.googleusercontent.com"
 # for encrypting access keys
 FERNET_KEY='your_fernet_key_here'
 
-# for authentication
-SESSION_JWT_TOKEN_SECRET="your secret here"
-
+# OAuth Configuration (not used when DISABLE_AUTH=true)
 GOOGLE_CLIENT_ID="your id"
 GOOGLE_CLIENT_SECRET="your secret here"

AUTHENTICATION_IMPLEMENTATION.md

@@ -0,0 +1,243 @@
+# Authentication Feature Flag Implementation - Summary
+
+## ✅ Implementation Complete
+
+A feature flag system has been successfully implemented to disable authentication across the entire RAGdoll repository.
+
+## Changes Made
+
+### 1. Configuration (`src/config.py`)
+- ✅ Added `DISABLE_AUTH` environment variable
+- ✅ Defaults to `false` (auth enabled for security)
+- ✅ Reads from `.env` file
+
+### 2. AuthService (`src/auth/auth_service/auth_service.py`)
+- ✅ Added `_get_or_create_default_user()` method
+- ✅ Modified `login_user()` to bypass OAuth when disabled
+- ✅ Modified `auth()` to skip authorization checks when disabled
+- ✅ Modified `get_authenticated_user()` to return default user when disabled
+- ✅ Added logging on startup to show auth status
+- ✅ Caches default user for performance
+
+### 3. Authentication Routes (`src/routes/auth.py`)
+- ✅ Updated `/api/login` to return mock tokens when disabled
+- ✅ Updated `/api/refresh` to return mock tokens when disabled
+- ✅ Updated `/api/logout` to work without tokens when disabled
+- ✅ Added `/api/auth-status` endpoint to check current status
+
+### 4. Documentation
+- ✅ Created `docs/manuals/authentication_feature_flag.md`
+- ✅ Updated `.env.example` with DISABLE_AUTH configuration
+- ✅ Added usage examples and troubleshooting guide
+
+### 5. Testing
+- ✅ Created `test_auth_flag.py` verification script
+
+## Default User Details
+
+When `DISABLE_AUTH=true`, a system user is automatically created:
+
+```python
+{
+    "name": "Default User",
+    "email": "default@local.dev",
+    "auth_provider": "system",
+    "provider_user_id": "default_user",
+    "owned_agents": []  # Auto-managed
+}
+```
+
+## How to Use
+
+### Option 1: Environment Variable
+```bash
+export DISABLE_AUTH=true
+python -m uvicorn src.main:app --reload
+```
+
+### Option 2: .env File
+```bash
+# In .env
+DISABLE_AUTH=true
+```
+
+Then start your server normally.
+
+### Option 3: Programmatic (for scripts)
+```python
+import os
+os.environ["DISABLE_AUTH"] = "true"
+
+# Now import and use RAGdoll modules
+from src.auth.auth_service.auth_service import AuthService
+```
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────┐
+│            All Protected Routes                  │
+│  /update-agent/, /agents/, /upload/agent, etc.  │
+└────────────────┬────────────────────────────────┘
+                 │
+                 ▼
+┌─────────────────────────────────────────────────┐
+│         auth_service.get_authenticated_user()   │
+│                                                  │
+│   ┌──────────────────────────────────┐         │
+│   │  if DISABLE_AUTH:                 │         │
+│   │    return default_user            │         │
+│   │  else:                            │         │
+│   │    validate JWT token             │         │
+│   │    return real user               │         │
+│   └──────────────────────────────────┘         │
+└─────────────────────────────────────────────────┘
+                 │
+                 ▼
+        ┌────────────────┐
+        │   Default User  │
+        │  (Auto-created) │
+        └────────────────┘
+```
+
+## Affected Components
+
+### ✅ Automatically Handled
+- Agent creation/updates
+- Agent deletion
+- Agent listing
+- Document uploads
+- Document deletion
+- Document listing
+- API key management
+- All authentication endpoints
+
+### ℹ️ No Changes Needed
+- RAG pipeline execution
+- LLM integration
+- Embedding generation
+- Database operations
+- WebSocket connections (if any)
+
+## Security Notes
+
+⚠️ **NEVER use `DISABLE_AUTH=true` in production!**
+
+This feature is designed for:
+- ✅ Local development
+- ✅ Automated testing
+- ✅ CI/CD pipelines
+- ✅ Demo environments
+- ✅ Prototyping
+
+NOT for:
+- ❌ Production deployments
+- ❌ Public-facing services
+- ❌ Any system with real user data
+- ❌ Shared development servers
+
+## Testing the Implementation
+
+### Manual Testing
+
+1. **Check auth status:**
+   ```bash
+   curl http://localhost:8000/api/auth-status
+   ```
+
+2. **Login without credentials:**
+   ```bash
+   curl -X POST http://localhost:8000/api/login \
+     -H "Content-Type: application/json" \
+     -d '{"token": "any", "provider": "any"}'
+   ```
+
+3. **Create agent without auth:**
+   ```bash
+   curl -X POST http://localhost:8000/update-agent/ \
+     -H "Content-Type: application/json" \
+     -d '{"name": "Test", ...}'
+   ```
+
+### Automated Testing
+
+Run the verification script:
+```bash
+python test_auth_flag.py
+```
+
+## Logging
+
+With authentication disabled, you'll see:
+```
+🔓 AUTHENTICATION DISABLED - Using default user for all requests
+🔓 Login bypassed - authentication disabled
+🔓 Auth check bypassed for agent <id>
+🔓 Returning default user (auth disabled)
+```
+
+With authentication enabled:
+```
+🔒 Authentication enabled
+```
+
+## Migration Path
+
+### Enabling Auth (Production)
+1. Remove `DISABLE_AUTH=true` from .env (or set to `false`)
+2. Configure OAuth credentials
+3. Set `JWT_TOKEN_SECRET`
+4. Restart server
+5. Users must authenticate
+
+### Disabling Auth (Development)
+1. Add `DISABLE_AUTH=true` to .env
+2. Restart server
+3. Authentication bypassed automatically
+
+## Integration with Existing Code
+
+The implementation is **transparent** to existing code:
+
+- ✅ No changes needed to route handlers
+- ✅ No changes needed to business logic
+- ✅ No changes needed to database operations
+- ✅ Everything continues to work normally
+
+The `auth_service` acts as a smart proxy:
+- When `DISABLE_AUTH=true` → Returns default user
+- When `DISABLE_AUTH=false` → Validates JWT tokens
+
+## Files Modified
+
+1. `src/config.py` - Added DISABLE_AUTH config
+2. `src/auth/auth_service/auth_service.py` - Bypass logic
+3. `src/routes/auth.py` - Updated auth endpoints
+4. `.env.example` - Added configuration docs
+5. `docs/manuals/authentication_feature_flag.md` - Full documentation
+6. `test_auth_flag.py` - Verification script
+
+## Success Criteria
+
+✅ Authentication can be disabled via environment variable
+✅ Default user is created automatically
+✅ All routes work without JWT tokens when disabled
+✅ All routes require JWT tokens when enabled
+✅ System logs authentication status clearly
+✅ No breaking changes to existing functionality
+✅ Comprehensive documentation provided
+
+## Next Steps
+
+1. **Set DISABLE_AUTH=true in your .env file**
+2. **Restart your server**
+3. **Test without authentication**
+4. **Read full docs at `docs/manuals/authentication_feature_flag.md`**
+
+## Support
+
+If you encounter issues:
+1. Check `/api/auth-status` endpoint
+2. Verify `DISABLE_AUTH=true` in environment
+3. Check server logs for 🔓/🔒 messages
+4. Review `docs/manuals/authentication_feature_flag.md`