How rohithswork/rbac-rag works
Purpose and Entry Points
Enterprise RAG API that answers PDF-based questions while restricting retrieval by a caller’s group-derived folder access. FastAPI starts at app/main.py; HTTP endpoints—including health, sync, query, and collection reset—are defined in app/api/routes.py. Request/response contracts live in app/models/request.py and app/models/response.py.
API and Orchestration Boundary
The API accepts a natural-language query plus user_email, then delegates application flow to service-layer orchestration. app/services/query.py coordinates intent handling and answer production; app/services/retrieval.py owns the RBAC-filtered retrieval-and-generation pipeline. This boundary keeps HTTP/Pydantic concerns separate from retrieval, authorization, and LLM integration.
Authorization and Metadata
RBAC is enforced before vector search. app/services/rbac.py resolves email → group IDs → permitted folder IDs against MongoDB helpers in app/database/mongodb.py. Folder IDs become a mandatory retrieval filter, preventing chunks outside the authorized document scope from reaching the prompt or LLM.
Document Synchronization and Ingestion
POST /sync drives ingestion of documents not yet represented in the vector store. app/services/ingestion.py coordinates PDF extraction, chunk creation, and vector persistence, using app/services/pdf_parser.py and app/services/chunker.py. Ingestion records/models are represented in app/models/ingest.py; file-level synthesis is available through app/services/file_summary.py.
Vector Retrieval
Weaviate is the semantic index and document-chunk store, encapsulated by app/database/weaviate.py. app/services/retrieval.py queries it with authorized folder filters and configured top-K selection, returning relevant chunks and source metadata. The reset endpoint permits collection recreation, making collection lifecycle an explicit operational capability.
Query Interpretation, Generation, and Response
Queries can be classified and parsed before retrieval through app/services/query_classifier.py and app/services/query_parser.py. Retrieved authorized context is converted into a constrained model prompt by app/services/prompt_builder.py; app/services/llm.py calls the Qwen model through an OpenAI-compatible vLLM endpoint. app/services/formatter.py produces answer and source output, while app/services/confidence.py calculates confidence and supports suggested follow-up questions.
Runtime and Infrastructure
The service runs on Python 3.10+ with FastAPI/Pydantic, launched as uvicorn app.main:app. Central environment-driven settings are in app/config.py. MongoDB supplies identity/group/folder metadata. docker-compose.yml provisions Weaviate and its text2vec-transformers vectorization service; the Qwen/vLLM endpoint is external to this compose stack. Connection addresses, collection name, retrieval depth, and LLM model settings are supplied through .env.
Components 21
API Runtime
- FastAPI entrypoint
app/main.py - HTTP routes · Health, sync, query, and collection reset endpoints.
app/api/routes.py - API contracts
app/models/request.py
Query Pipeline
- Query orchestration
app/services/query.py - Query classifier
app/services/query_classifier.py - Query parser
app/services/query_parser.py - Authorized retrieval · Retrieves only chunks within permitted folders and drives generation.
app/services/retrieval.py - RBAC resolver · Maps caller email through groups to permitted folders.
app/services/rbac.py - Prompt builder
app/services/prompt_builder.py - Qwen LLM client
app/services/llm.py - Answer formatter
app/services/formatter.py - Confidence & follow-ups
app/services/confidence.py
Ingestion
- Sync ingestion · Finds unsynced documents and persists their chunks.
app/services/ingestion.py - PDF extraction
app/services/pdf_parser.py - Chunk creation
app/services/chunker.py
Data & Infrastructure
- MongoDB helpers
app/database/mongodb.py - MongoDB
- Weaviate adapter · Handles semantic search, chunk persistence, and collection lifecycle.
app/database/weaviate.py - Weaviate
docker-compose.yml - External Qwen/vLLM · External to the Compose stack.
- Environment settings · Supplies connection, collection, retrieval, and model settings.
app/config.py
Connections 23
- FastAPI entrypoint → HTTP routes: registers
- HTTP routes → API contracts: validates
- HTTP routes → Query orchestration: query requests
- HTTP routes → Sync ingestion: POST /sync
- HTTP routes → Weaviate adapter: collection reset
- Query orchestration → Query classifier: classifies
- Query orchestration → Query parser: parses
- Query orchestration → Authorized retrieval: retrieves context
- Authorized retrieval → RBAC resolver: authorizes caller
- RBAC resolver → MongoDB helpers: resolves access
- MongoDB helpers → MongoDB: reads groups and folders
- Authorized retrieval → Weaviate adapter: filtered vector search · Folder IDs are mandatory search filters.
- Authorized retrieval → Prompt builder: authorized chunks
- Prompt builder → Qwen LLM client: constrained prompt
- Qwen LLM client → External Qwen/vLLM: generates
- Query orchestration → Answer formatter: formats answer and sources
- Query orchestration → Confidence & follow-ups: scores answer
- Sync ingestion → PDF extraction: extracts PDF text
- Sync ingestion → Chunk creation: creates chunks
- Sync ingestion → Weaviate adapter: persists vectors
- Weaviate adapter → Weaviate: indexes and searches
- Environment settings → Weaviate adapter: connection and collection
- Environment settings → Qwen LLM client: model settings