letta-ai / letta

Letta (formerly MemGPT) is a framework for creating LLM services with memory.
https://letta.com
Apache License 2.0
13.05k stars 1.43k forks source link

`/auth` endpoint broken #1664

Open 4shub opened 3 months ago

4shub commented 3 months ago

Describe the bug If you successfully enter in a password to /auth, you will not be able to login as the UUID returned is not valid in AuthResponse

Error Message

    self.__pydantic_validator__.validate_python(data, self_instance=self)
pydantic_core._pydantic_core.ValidationError: 1 validation error for AuthResponse
uuid
  Input should be a valid UUID, invalid character: expected an optional prefix of `urn:uuid:` followed by [0-9a-fA-F-], found `u` at 1 [type=uuid_parsing, input_value='user-85c04b62-2225-4b8a-8488-b678adf88cd5', input_type=str]
    For further information visit https://errors.pydantic.dev/2.8/v/uuid_parsing

Possible Solution It seems like we are passing the API_KEY as the UUID on this successful auth response instead of a UUID.

ibabbar commented 3 months ago

I get same issue on AWS Linux, but not on Mac

zboyles commented 3 months ago

It happens on Mac too.

zboyles commented 3 months ago

I had a few minutes to try a rough test and simply stripping the user- prefix from the authentication response allows the user to login. No idea the ramifications of this but I figured I'd share.

# memgpt/server/rest_api/auth/index.py

... # truncated

    @router.post("/auth", tags=["auth"], response_model=AuthResponse)
    def authenticate_user(request: AuthRequest) -> AuthResponse:
        """
        Authenticates the user and sends response with User related data.

        Currently, this is a placeholder that simply returns a UUID placeholder
        """
        interface.clear()

        is_admin = False
        if request.password != password:
            response = server.api_key_to_user(api_key=request.password)
        else:
            is_admin = True
            response = server.authenticate_user()

        # adding the 2 lines below allows the login
        if response.startswith("user-"):
            response = response[5:]
        return AuthResponse(uuid=response, is_admin=is_admin)

I'm not sure the background of the id format change but my first thought was to add a display property on the AuthResponse class and allow flexible validation with the user id formats interchangeable.