OpenAI has upgraded the GPT-4 Turbo model available to ChatGPT premium users. It claims that it&#x27;s enhanced in several ways.

OpenAI makes ChatGPT 'more direct, less verbose' | TechCrunch

Cathie Wood’s Ark Investment Management has announced that it holds a stake in Silicon Valley artificial intelligence darling OpenAI, a bet that the nascent AI industry will remake the tech landscape.

Cathie Wood’s ARK Venture Fund Announces It Holds a Stake in OpenAI - Bloomberg

18 votes, 13 comments. 2.2M subscribers in the singularity community. Everything pertaining to the technological singularity and related topics, e.g…

r/singularity on Reddit: According to OpenAI's open-sourced evals, new GPT-4-Turbo model seems slightly better than Opus

Cathie Wood&#x27;s Ark Investment Management said it holds a stake in Microsoft-backed OpenAI, Bloomberg News reported on Thursday, citing the company&#x27;s mail to its clients. &quot;As of April 10, 2024, the ARK Venture Fund invests in OpenAI,&quot; Ark said, referring to its $54 million VC fund, the report said.

Cathie Wood's Ark announces OpenAI stake, Bloomberg News reports

US News is a recognized leader in college, grad school, hospital, mutual fund, and car rankings. Track elected officials, research health conditions, and find news you can use in politics, business, health, and education.

Cathie Wood's Ark Announces OpenAI Stake, Bloomberg News Reports

39 votes, 21 comments. 1.3M subscribers in the OpenAI community. OpenAI is an AI research and deployment company. OpenAI&#x27;s mission is to ensure that…

r/OpenAI on Reddit: The new GPT-4 Turbo is now available to paid ChatGPT users.

64 votes, 16 comments. 1.3M subscribers in the OpenAI community. OpenAI is an AI research and deployment company. OpenAI&#x27;s mission is to ensure that…

r/OpenAI on Reddit: The newest GPT-4 Turbo has topped Claude 3 Opus on LMSYS Chatbot Arena!

Elon Musk’s fledgling AI startup X.AI Corp. is looking to raise $3 billion to $4 billion in a deal that would value the company at $18 billion, according to materials sent to investors.

Elon Musk’s xAI Looks to Raise Up to $4 Billion to Compete With OpenAI - Bloomberg

The Information has a simple mission: deliver important, deeply reported articles about the technology business you won’t find elsewhere. Many of the most influential people in the industry turn to us for fresh information and original insight.

OpenAI Researchers, Including Ally of Sutskever, Fired for Alleged Leaking

OpenAI and Meta are reportedly about to release new AI models that achieve important milestones towards achieving AGI.

OpenAI and Meta Reportedly Preparing New AI Models Capable of Reasoning

OPX Ai

opxai

In this tutorial, we're focusing on how to build a question-answering CLI tool using Dewy and LangChain.js. Dewy is an open-source knowledge base that helps developers organize and retrieve information efficiently. LangChain.js is a framework that simplifies the integration of large language models (LLMs) into applications. By combining Dewy's capabilities for managing knowledge with LangChain.js's LLM integration, you can create tools that answer complex queries with precise and relevant information. This guide walks you through setting up your environment, loading documents into Dewy, and using an LLM through LangChain.js to answer questions based on the stored data. It's designed for engineers looking to enhance their projects with advanced question-answering functionalities. Why Dewy and LangChain.js? is an OSS knowledge base designed to streamline the way developers store, organize, and retrieve information. Its flexibility and ease of use make it an excellent choice for developers aiming to build knowledge-driven applications. Dewy , on the other hand, is a powerful framework that enables developers to integrate LLMs into their applications seamlessly. By combining Dewy's structured knowledge management with LangChain.js's LLM capabilities, developers can create sophisticated question-answering systems that can understand and process complex queries, offering precise and contextually relevant answers. LangChain.js The Goal Our aim is to build a simple yet powerful question-answering CLI script. This script will allow users to load documents into the Dewy knowledge base and then use an LLM, through LangChain.js, to answer questions based on the information stored in Dewy. This tutorial will guide you through the process, from setting up your environment to implementing the CLI script. You'll learn how to use LangChain to build a simple question-answering applicaiton, and how to integrate Dewy as a source of knowledge, allowing your applicaiton to answer questions based on specific documents you provide it. Prerequisites Before diving into the tutorial, ensure you have the following prerequisites covered: Basic knowledge of Typescript programming Familiarity with CLI tools development A copy of Dewy running on your local machine (see Dewy's if you need help here). installation instructions Step 1: Set Up Your Project The final code for this example is available if you'd like to jump ahead. in the Dewy repo First, create a directory for the TypeScript CLI project and change into the directory mkdir dewy_qa
cd dewy_qa With the directory set up, you can install TypeScript and initialize the project: npm init -y
npm i typescript --save-dev
npx tsc --init Depending on your environment, you may need to make some changes to your TypeScript config. Make sure that your looks something like the following: tsconfig.json {
  "compilerOptions": {
    "target": "ES6",
    "module": "CommonJS", 
    "moduleResolution": "node", 
    "declaration": true,
    "outDir": "./dist",
    "esModuleInterop": true,
    "strict": true,
} Now you're ready to create the CLI application. To keep the code from getting too messy, organize it into several directories, with the following layout dewy_qa/
├── commands/
│   └── ...
├── utils/
│   └── ...
├── index.ts
├── package.json
└── tsconfig.ts Each command will be implemented in the directory, and shared code will go in the directory. The entrypoint to the CLI application is the file . commands utils index.ts Start with a simple "hello world" version of - you'll start filling it out in the next section index.ts #!/usr/bin/env ts-node-script

console.log("hello world"); To verify the environment is setup correctly, try running the following command - you should see "hello world" printed in the console: npx ts-node index.ts Rather than typing out this very long command every time, let's create an entry in for the command. This will help us remember how to invoke the CLI, and make it easier to install as a command: package.json {
  ...
  "bin": {
    "dewy_qa": "./index.ts"
  }
  ...
} Now you can run your script with or the package and run it as just npm exec dewy_qa npm link dewy_qa Step 2: Implement document loading Load documents by setting up the Dewy client. The first step is to add some dependencies to the project. The first is , the client library for Dewy. The second is , which will help us build a CLI application with argument parsing, subcommands, and more. Finally, to makes the prompts more colorful. dewy-ts commander chalk npm install dewy-ts commander chalk Next, implement the load command's logic. You'll do this in a separate file named . This file implements a function named , which expects a URL and some additional options - this will be wired up with the CLI in a later section. commands/load.ts load Dewy makes document loading super simple - just setup the client and call with the URL of the file you'd like to load. Dewy takes care of extracting the PDF's contents, splitting them into chunks just the right size for sending to an LLM and indexing them for semantic search. addDocument import { Dewy } from 'dewy-ts'; 

import { success, error } from '../utils/colors';

export async function load(url: string, options: { collection: string, dewy_endpoint: string }): Promise<void> {
  console.log(success(`Loading ${url} into collection: ${options.collection}`));

  try {
    const dewy = new Dewy({
        BASE: options.dewy_endpoint
    })

    const result = await dewy.kb.addDocument({ collection: options.collection, url });

    console.log(success(`File loaded successfully`));
    console.log(JSON.stringify(result, null, 2));

  } catch (err: any) {
    console.error(error(`Failed to load file: ${err.message}`));
  }
} You may have noticed that some functions were imported from . This file just sets up some helpers for coloring console output - put it in so it can be used elsewhere: ../utils/colors utils import chalk from 'chalk';

export const success = (message: string) => chalk.green(message);
export const info = (message: string) => chalk.blue(message);
export const error = (message: string) => chalk.red(message); Step 3: Implement question-answering With the ability to load documents into Dewy, it's time to integrate LangChain.js to utilize LLMs for answering questions. This step involves setting up LangChain.js to query the Dewy knowledge base and process the results using an LLM to generate answers. To start, install some additional pacakges - and to use the OpenAI API as LLM: langchain openai npm install dewy-langchain langchain @langchain/openai openai This command is sort of long, so we'll walk through several pieces of it before combining them in the end Create Clients for OpenAI and Dewy The first thing to setup is Dewy (as before) and an LLM. One difference from before is that is used to build a : this is a special type used by LangChain for retrieving information as part of a chain. You'll see how the retriever is used in a just a minute. dewy DewyRetriever const model = new ChatOpenAI({
    openAIApiKey: options.openai_api_key,
});
const dewy = new Dewy({
    BASE: options.dewy_endpoint
})

const retriever = new DewyRetriever({ dewy, collection }); Create a LangChain Prompt This is a string template that instructs the LLM how it should behave, with placeholders for additional context which will be provided when the "chain" is created. In this case, the LLM is instructed to answer the question, but only using the information it's provided. This reduces the model's tendency to "hallucinate", or make up an answer that's plausible but wrong.  The values of and are provided in the next step: context question const prompt =
PromptTemplate.fromTemplate(`Answer the question 
based only on the following context:

{context}

Question: {question}`); Build the Chain LangChain works by building up "chains" of behavior that control how to query the LLM and other data sources. This example uses , which provides a more flexible programming experience than some of LangChain's original interfaces. LCEL Use a to create an LCEL chain. This chain describes how to generate the and values: the context is generated using the retriever created earlier, and the question is generated by passing through the step's input. The results Dewy retrieves are formatted as a string by piping them to the function. RunnableSequence context question formatDocumentsAsString This chain does the following: It retrieves documents using the and assigns them to and assigns the chain's input value to . DewyRetriever context question It formats the prompt string using the and variables. context question It passes the formatted prompt to the LLM to generate a response. It formats the LLM's response as a string. const chain = RunnableSequence.from([
    {
        context: retriever.pipe(formatDocumentsAsString),
        question: new RunnablePassthrough(),
    },
    prompt,
    model,
    new StringOutputParser(),
]); Execute the chain Now that the chain has been constructed, execute it and output the results to the console. As you'll see, is an input argument provided by the caller of the function. question Executing the chain using allows you to see each response chunk as it's returned from the LLM. The stream handler loop is sort of ugly, but it's just filtering to appropriate stream results and writing them to (using it would have added newlines after each chunk). chain.streamLog() STDOUT console.log const stream = await chain.streamLog(question);

// Write chunks of the response to STDOUT as they're received
console.log("Answer:");
for await (const chunk of stream) {
    if (chunk.ops?.length > 0 && chunk.ops[0].op === "add") {
        const addOp = chunk.ops[0];
        if (
        addOp.path.startsWith("/logs/ChatOpenAI") &&
        typeof addOp.value === "string" &&
        addOp.value.length
        ) {
        process.stdout.write(addOp.value);
        }
    }
} Pull it all together as a command Now that you've seen all the pieces, you're ready to create the command. This should look similar to the command from before, with some additional imports. query load import { StringOutputParser } from "@langchain/core/output_parsers";
import { PromptTemplate } from "@langchain/core/prompts";
import { formatDocumentsAsString } from "langchain/util/document";
import { RunnablePassthrough, RunnableSequence } from "@langchain/core/runnables";
import { ChatOpenAI } from "@langchain/openai";

import { Dewy } from 'dewy-ts'; 
import { DewyRetriever } from 'dewy-langchain';

import { success, error } from '../utils/colors';

export async function query(question: string, options: { collection: string, dewy_endpoint: string, openai_api_key: string }): Promise<void> {
  console.log(success(`Querying ${options.collection} collection for: "${question}"`));

  try {
    const model = new ChatOpenAI({
        openAIApiKey: options.openai_api_key,
    });
    const dewy = new Dewy({
        BASE: options.dewy_endpoint
    })

    const retriever = new DewyRetriever({ dewy, collection: options.collection });

    const prompt =
    PromptTemplate.fromTemplate(`Answer the question based only on the following context:
    {context}

    Question: {question}`);

    const chain = RunnableSequence.from([
        {
            context: retriever.pipe(formatDocumentsAsString),
            question: new RunnablePassthrough(),
        },
        prompt,
        model,
        new StringOutputParser(),
    ]);

    const stream = await chain.streamLog(question);

    // Write chunks of the response to STDOUT as they're received
    console.log("Answer:");
    for await (const chunk of stream) {
        if (chunk.ops?.length > 0 && chunk.ops[0].op === "add") {
          const addOp = chunk.ops[0];
          if (
            addOp.path.startsWith("/logs/ChatOpenAI") &&
            typeof addOp.value === "string" &&
            addOp.value.length
          ) {
            process.stdout.write(addOp.value);
          }
        }
    }

  } catch (err: any) {
    console.error(error(`Failed to query: ${err.message}`));
  }
} Step 4: Building the CLI With Dewy and LangChain.js integrated, the next step is to build the CLI interface. Use a library like to create a user-friendly command-line interface that supports commands for loading documents into Dewy and querying the knowledge base using LangChain.js. commander First, rewrite to create the subcommands and . The argument determines which Dewy collection the document should be loaded into (Dewy lets you organize documents into different collections, similar to file folders). The argument lets you specify how to connect to Dewy - by default an instance running locally on port is assumed. Finally, the argument (which defaults to an environment variable) configures the OpenAI API: index.ts load query --collection --dewy-endpoint 8000 --openai_api_key #!/usr/bin/env ts-node-script

import { Command } from 'commander';
import { load } from './commands/load';
import { query } from './commands/query';

const program = new Command();

program.name('dewy-qa').description('CLI tool for interacting with a knowledge base API').version('1.0.0');

const defaultOpenAIKey = process.env.OPENAI_API_KEY;

program
  .command('load')
  .description("Load documents into Dewy from a URL")
  .option('--collection <collection>', 'Specify the collection name', 'main')
  .option('--dewy-endpoint <endpoint>', 'Specify the collection name',  'http://localhost:8000')
  .argument('<url>', 'URL to load into the knowledge base')
  .action(load);

program
  .command('query')
  .description('Ask questions using an LLM and the loaded documents for answers')
  .option('--collection <collection>', 'Specify the collection name', 'main')
  .option('--dewy-endpoint <endpoint>', 'Specify the collection name',  'http://localhost:8000')
  .option('--openai-api-key <key>', 'Specify the collection name', defaultOpenAIKey)
  .argument('<question>', 'Question to ask the knowledge base')
  .action(query);

program.parse(process.argv); OK, all done - wasn't that easy? You can try it out by running the command: dewy_qa load https://arxiv.org/pdf/2009.08553.pdf You should see something like Loading https://arxiv.org/pdf/2009.08553.pdf into collection: main
File loaded successfully
{
  "id": 18,
  "collection": "main",
  "extracted_text": null,
  "url": "https://arxiv.org/pdf/2009.08553.pdf",
  "ingest_state": "pending",
  "ingest_error": null
} Extracting the content of a large PDF can take a minute or two, so you'll often see when you first load a new document. "ingest_state": "pending" Next, try asking some questions: dewy_qa query "tell me about RAG You should see something like Querying main collection for: "tell me about RAG"
Answer:
Based on the given context, RAG refers to the RAG proteins, 
which are involved in DNA binding and V(D)J recombination. 
The RAG1 and RAG2 proteins work together to bind specific 
DNA sequences known as RSS (recombination signal sequences) 
and facilitate the cutting and rearrangement of DNA segments 
during the process of V(D)J recombination... Conclusion By following this guide, you've learned how to create a CLI that uses Dewy to manage knowledge and LangChain.js to process questions and generate answers. This tool demonstrates the practical application of combining a structured knowledge base with the analytical power of LLMs, enabling developers to build more intelligent and responsive applications. Further Reading and Resources Dewy GitHub repository: https://github.com/Dewy Dewy TypeScript client repository: https://github.com/DewyKB/dewy-ts Dewy LangChain integration repository: https://github.com/DewyKB/dewy_langchainjs LangChain.js documentation: https://js.langchain.com OpenAI documentation: https://platform.opnai.com

Creating a Question-Answering CLI with Dewy and LangChain.js

Dewy এবং LangChain.js এর সাথে একটি প্রশ্ন-উত্তরকারী CLI তৈরি করা

Erstellen einer Frage-Antwort-CLI mit Dewy und LangChain.js

Creación de una CLI de respuesta a preguntas con Dewy y LangChain.js

Création d'une CLI de questions-réponses avec Dewy et LangChain.js

डेवी और लैंगचेन.जेएस के साथ एक प्रश्न-उत्तर सीएलआई बनाना

Dewy と LangChain.js を使用した質問応答 CLI の作成

Dewy 및 LangChain.js를 사용하여 질문 답변 CLI 생성

Criando uma CLI de resposta a perguntas com Dewy e LangChain.js

Создание CLI, отвечающего на вопросы, с помощью Dewy и LangChain.js

Dewy ve LangChain.js ile Soru Yanıtlayan CLI Oluşturma

Tạo CLI trả lời câu hỏi bằng Dewy và LangChain.js

使用 Dewy 和 LangChain.js 创建问答 CLI

Back to Friday 31st of February, Italy's Data Protection Authority (the so called ) temporarily banned OpenAI's ChatGPT chatbot and launched a probe over a suspected breach of the artificial intelligence application's data collection rules. Guarantor The Guarantor have accused of neglecting to check the age of ChatGPT users and engaging in massive collection and storage of personal data without any legal justification for training the chatbot. OpenAI In response, . OpenAI has halted Italian user access to the chatbot and plans to offer solutions to address these concerns clarified that it is not attempting to hinder AI progress but rather emphasizes the necessity of following regulations to safeguard the privacy of Italian and European citizens. Garante In the meanwhile, in response to the , we have seen many people resort to unreliable VPNs or non-transparent apps to continue accessing the service. ChatGPT block in Italy So, during the Easter holidays, . I worked on a side-project with my colleague to offer an open-source alternative to ChatGPT that allows anyone to be in control of its own data without needing a VPN in Italy Diego Pizzocaro It started from an existing Github project available under MIT license called . It got our attention because it was an open-source project, consisting of a React frontend app and a Node.js backend app, available both on-line and via a Docker instance. chat-with-gtp We forked the project and adapted it to the Italian context, providing Italian localisation and getting rid of all the backend (and Dockerization) part, to provide just the React interface, that has the characteristic of relying only on informations stored within the browser context. We called it and we released it both freely on Vercel for an immediate usage and also as an open-source project that can be installed in any workstation. OpenAccessGPT . No VPN required from Italy, as communication via API is not subject to investigation by the Privacy Guarantor. OpenAccessGPT has the important characteristic of using OpenAI APIs and stores conversation data exclusively locally The fact that OpenAccessGPT uses the OpenAI APIs puts on the table two important aspects that come closed to some of the things that the Italian Guarantor is looking for. In specific, as per it is stated in the API : data usage policies of OpenAI OpenAI not uses data submitted by customers via API to train or improve its models, unless the user explicitly decides to share its data with OpeAI for this purpose. Any data sent through the API is retained for abuse and misuse monitoring purposes for a maximum of 30 days, after which it will be deleted (unless otherwise required by law). Hence, to summarise, OpenAccessGPT takes advantage of the new OpenAI APIs for ChatGPT, which only store data for 30 days on OpenAI servers and then are permanently deleted, without using them to train and improve OpenAI AI models. . Once we released OpenAccessGPT we started to spread the voice and in only one day we reached more that 300.000 people that expressed their support and started to play with the tool and asked how to collaborate to the project We were emotionally touched by all of this, confirming how often from tiny but clear ideas a meaningful impact can be bootstrapped. Many open-source LLM projects are emerging, which can also be installed directly on your PC, and we believe this is a trend destined to grow, in line with our OpenAccessGPT project - and we hope one day to include many other AIs to interact with. We are sure that many other developers, hackers and technology enthusiasts in Italy are working "silently" to find alternative solutions to access these AIs - with due attention - and generally advance this incredible technology and its adoption, which it's changing the world. If any of them would like to join us and give us a hand we will be very happy! ! If you are interested in helping us or trying it, do not hesitate to join the project's and participate in the . Any other useful info is also present on our Discord Server GitHub project Project website

Breaking Through the Italian ChatGPT Ban with OpenAccessGPT

OpenAccessGPT সহ ইতালিয়ান চ্যাটজিপিটি নিষেধাজ্ঞার মাধ্যমে বিরতি

Durchbrechen des italienischen ChatGPT-Verbots mit OpenAccessGPT

Rompiendo la prohibición italiana de ChatGPT con OpenAccessGPT

Briser l'interdiction italienne de ChatGPT avec OpenAccessGPT

OpenAccessGPT के साथ इतालवी चैटजीपीटी प्रतिबंध को तोड़ना

OpenAccessGPT でイタリアの ChatGPT 禁止を突破

OpenAccessGPT로 이탈리아 ChatGPT 금지 돌파

Rompendo com a proibição italiana do ChatGPT com o OpenAccessGPT

OpenAccessGPT ile İtalyan ChatGPT Yasağını Aşmak

Vượt qua lệnh cấm ChatGPT của Ý với OpenAccessGPT

使用 OpenAccessGPT 突破意大利 ChatGPT 禁令

Last week, I wrote about . I used rate limiting as an example, moving it from a library inside the application to the API Gateway. Today, I'll use another example: authentication and authorization. putting the right feature at the right place Securing a Spring Boot application I'll keep using Spring Boot in the following because I'm familiar with it. The Spring Boot application offers a REST endpoint to check employees' salaries. The specific use case is taken from the Open Policy Agent site (more later): Create a policy that allows users to request their own salary as well as the salary of their direct subordinates. We need a way to: Authenticate an HTTP request as coming from a known user Check whether the user has access to the salary data In any other case, return a . 401 I'll pass an authentication token in the request to keep things simple. I won't rely on a dedicated authentication/authorization backend, such as Keycloak, but it should be a similar approach if you do. To enable Spring Security on the app, we need to add the Spring Boot Security Starter. <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency> We also need to enable Spring Security to work its magic: @SpringBootApplication
@EnableWebSecurity
class SecureBootApplication With those two steps in place, we can start securing the application according to the above requirement: internal fun security() = beans {                                       //1
    bean {
        val http = ref<HttpSecurity>()
        http {
            authorizeRequests {
                authorize("/finance/salary/**", authenticated)          //2
            }
            addFilterBefore<UsernamePasswordAuthenticationFilter>(
                TokenAuthenticationFilter(ref())                        //3
            )
            httpBasic { disable() }
            csrf { disable() }
            logout { disable() }
            sessionManagement {
                sessionCreationPolicy = SessionCreationPolicy.STATELESS
            }
        }
        http.build()
    }
    bean { TokenAuthenticationManager(ref(), ref()) }                   //4
} Use the Kotlin Beans DSL - because I can Only allow access to the endpoint to authenticated users Add a filter in the filter chain to replace regular authentication Add a custom authentication manager Requests look like the following: curl -H 'Authorization: xyz'  localhost:9080/finance/salary/bob The filter extracts from the request the necessary data used to decide whether to allow the request or not: internal class TokenAuthenticationFilter(authManager: AuthenticationManager) :
    AbstractAuthenticationProcessingFilter("/finance/salary/**", authManager) {

    override fun attemptAuthentication(req: HttpServletRequest, resp: HttpServletResponse): Authentication {
        val header = req.getHeader("Authorization")                   //1
        val path = req.servletPath.split('/')                         //2
        val token = KeyToken(header, path)                            //3
        return authenticationManager.authenticate(token)              //4
    }

    // override fun successfulAuthentication(
} Get the authentication token Get the path Wrap it under a dedicated structure Try to authenticate the token In turn, the manager tries to authenticate the token: internal class TokenAuthenticationManager(
    private val accountRepo: AccountRepository,
    private val employeeRepo: EmployeeRepository
) : AuthenticationManager {
  override fun authenticate(authentication: Authentication): Authentication {
    val token = authentication.credentials as String? ?:                       //1
        throw BadCredentialsException("No token passed")
    val account = accountRepo.findByPassword(token).orElse(null) ?:            //2
        throw BadCredentialsException("Invalid token")
    val path = authentication.details as List<String>
    val accountId = account.id
    val segment = path.last()
    if (segment == accountId) return authentication.withPrincipal(accountId)   //3
    val employee = employeeRepo.findById(segment).orElse(null)                 //4
    val managerUserName = employee?.manager?.userName
    if (managerUserName != null && managerUserName == accountId)               //5
        return authentication.withPrincipal(accountId)                         //5
    throw InsufficientAuthenticationException("Incorrect token")               //6
  }
} Get the authorization token passed from the filter Try to find the account that has this token. For simplicity's sake, the token is stored in plain text without hashing If the account tries to access its data, allow it If not, we must load the hierarchy from another repo. If the account attempts to access data from an employee they manage, allow it. Else, deny it. The whole flow can be summarized as the following: Now, we can try some requests. curl -H 'Authorization: bob' localhost:9080/finance/salary/bob asks for his own salary, and it works. bob curl -H 'Authorization: bob' localhost:9080/finance/salary/alice asks for the salary of one of his subordinates, and it works as well. bob curl -H 'Authorization: bob' localhost:9080/finance/salary/alice asks for her manager's salary, which is not allowed. alice The code above works perfectly but has one big issue: there's no way to audit the logic. One must know Kotlin and how Spring Security works to ensure the implementation is sound. Introducing Open Policy Agent Open Policy Agent, or OPA for short, describes itself as "Policy-based control for cloud native environments". Stop using a different policy language, policy model, and policy API for every product and service you use. Use OPA for a unified toolset and framework for policy across the cloud native stack. Whether for one service or for all your services, use OPA to decouple policy from the service's code so you can release, analyze, and review policies (which security and compliance teams love) without sacrificing availability or performance. -- OPA Website In short, OPA allows writing policies and offers a CLI and a daemon app to evaluate them. You write policies in a specific interpreted language named , and I must admit it's not fun. Anyway, here's our above policy written in "clear" text: Rego package ch.frankel.blog.secureboot

employees := data.hierarchy                                 //1

default allow := false

# Allow users to get their own salaries.
allow {
	input.path == ["finance", "salary", input.user]         //2
}

# Allow managers to get their subordinates' salaries.
allow {
	some username
	input.path = ["finance", "salary", username]            //3
	employees[input.user][_] == username                    //3
} Get the employee hierarchy somehow (see below) If the account requests their salary, allow access If the account requests the salary of a subordinate, allow access I used two variables in the above snippet: and . is the payload that the application sends to OPA. It should be in JSON format and has the following form: input data input {
    "path": [
        "finance",
        "salary",
        "alice"
    ],
    "user": "bob"
} More Open Policy Agent goodness However, OPA can't decide on the input alone, as it doesn't know the employee's hierarchy. One approach would be to load the hierarchy data on the app and send it to OPA. A more robust approach is to let OPA access external data to separate responsibilities cleanly. OPA offers to achieve it. Here, I pretend to extract data from the database, bundle it together with the policy file, serve the bundle via HTTP, and configure OPA to load it at regular intervals. many options Employee Note that you shouldn't use Apache APISIX only to serve static files. But since I'll be using it in the next evolution of my architecture, I want to avoid having a separate HTTP server to simplify the system. Now that we moved the decision logic to OPA, we can replace our code with a request to the OPA service. The new version of the authentication manager is: internal class OpaAuthenticationManager(
    private val accountRepo: AccountRepository,
    private val opaWebClient: WebClient
) : AuthenticationManager {

    override fun authenticate(authentication: Authentication): Authentication {
        val token = authentication.credentials as String? ?:                       //1
            throw BadCredentialsException("No token passed")
        val account = accountRepo.findByPassword(token).orElse(null) ?:             //1
            throw BadCredentialsException("Invalid token")
        val path = authentication.details as List<String>
        val decision = opaWebClient.post()                                         //2
            .accept(MediaType.APPLICATION_JSON)
            .contentType(MediaType.APPLICATION_JSON)
            .bodyValue(OpaInput(DataInput(account.id, path)))                      //3
            .exchangeToMono { it.bodyToMono(DecisionOutput::class.java) }          //4
            .block() ?: DecisionOutput(ResultOutput(false))                        //5
        if (decision.result.allow) return authentication.withPrincipal(account.id) //6
        else throw InsufficientAuthenticationException("OPA disallow")             //6
    }
} Keep the initial logic authentication Replace the authorization with a call to the OPA service Serialize the data to conform to the JSON input that the OPA policy expects Deserialize the result If something is wrong, the default should be to disallow Abide by OPA's result The flow is now the following: At this point, we moved the authorization logic from the code to OPA. Moving authentication to the API Gateway The next and final step is to move the logic The obvious candidate is the API Gateway since we set Apache APISIX in the previous step. In general, we should use the capabilities of the API Gateway as much as possible and fall back to libraries for the rest. authentication Apache APISIX has multiple authentication plugins available. Because I used a bearer token, I'll use . Let's create our users, or in Apache APISIX terms, : key-auth consumers consumers:
  - username: alice
    plugins:
      key-auth:
        key:  alice
  - username: betty
    plugins:
      key-auth:
        key:  betty
  - username: bob
    plugins:
      key-auth:
        key:  bob
  - username: charlie
    plugins:
      key-auth:
        key:  charlie Now, we can protect the Spring Boot upstream: routes:
  - uri: /finance/salary*
    upstream:
      type: roundrobin
      nodes:
        "boot:8080": 1
    plugins:
      key-auth:
        header: Authorization                    #1
      proxy-rewrite:
        headers:
          set:
            X-Account: $consumer_name            #2 Authenticate with and the header key-auth Authorization Sets the consumer id in the HTTP header for the upstream X-Account APISIX guarantees that requests that reach the Spring Boot app are authenticated. The code only needs to call the OPA service and follow the decision. We can entirely remove Spring Security and replace it with a filter: simple bean {
    val repo = ref<EmployeeRepository>()
    router {
        val props = ref<AppProperties>()
        val opaWebClient = WebClient.create(props.opaEndpoint)
        filter { req, next -> validateOpa(opaWebClient, req, next) }
        GET("/finance/salary/{user_name}") {
          // ...
        }
    }
}

internal fun validateOpa(
    opaWebClient: WebClient,
    req: ServerRequest,
    next: (ServerRequest) -> ServerResponse
): ServerResponse {
    val httpReq = req.servletRequest()
    val account = httpReq.getHeader("X-Account")                           //1
    val path = httpReq.servletPath.split('/').filter { it.isNotBlank() }
    val decision = opaWebClient.post()                                     //2
        .accept(MediaType.APPLICATION_JSON)
        .contentType(MediaType.APPLICATION_JSON)
        .bodyValue(OpaInput(DataInput(account, path)))
        .exchangeToMono { it.bodyToMono(DecisionOutput::class.java) }
        .block() ?: DecisionOutput(ResultOutput(false))
    return if (decision.result.allow) next(req)
    else ServerResponse.status(HttpStatus.UNAUTHORIZED).build()
} Get the account name from the API Gateway Nothing changes afterward The final flow is the following: Conclusion Everything looks like a nail when all you've got is a hammer. Developers' mighty hammer of choice is code. I've written tons of code to solve problems, and later on, I've used even more libraries to solve even more problems. As you evolve from developer to architect, you increase the number of tools you have. In this regard, code is only one tool among many. Your organization has many infrastructure tools you can leverage to develop solutions at minimal costs. In this post, I've shown how you can leverage OPA and Apache APISIX to move your authentication and authorization logic from the code to the infrastructure. The former allows you to audit your security policies, the latter coherence among all your upstream across all tech stacks. The complete source code for this post can be found on . GitHub To go further: Spring Security Open Policy Agent OPA Bundles Rego playground Spring Security Authorization with OPA Originally published at on February 26th, 2023 A Java Geek

Stories, News & Mentions about OPXAI

Opxai’s Stories on HackerNoon

Opxai's News & Mentions