How shauryadusht/sentinel-rag works
Secure Multi-Tenant RAG is a FastAPI application for tenant-scoped document ingestion and question answering. Users authenticate into an organisation; uploaded documents are validated, parsed, chunked, embedded and stored with access metadata. Queries pass through the route and RAG service, where a per-user cache may satisfy the request; otherwise retrieval applies role-derived filters and a second authorization check before approved context is sent to an LLM. The API also supports organisation/user management, document deletion, and query auditing. Wiring for unsampled routes and components is limited to documented capabilities.
Main entry points: ingestion/service.py Ingestion orchestrator · main.py FastAPI app · rag/service.py RAG service · retrieval/service.py Retrieval orchestrator
Components 26
API and identity
- FastAPI app
app/main.py - Auth routes
app/api/routes/auth.py - Org and user routes
app/api/routes/users.py - JWT middleware
app/middleware/auth.py - User service
app/services/user_service.py
Document ingestion
- Document routes
app/api/routes/documents.py - Ingestion orchestrator
app/ingestion/service.py - Document validator
app/ingestion/validator.py - Document parser
app/ingestion/parser.py - Text chunker
app/ingestion/chunker.py - Text embedder
app/ingestion/embedder.py
Secure RAG query
- Query route
app/api/routes/query.py - RAG service
app/rag/service.py - Response cache
app/rag/cache.py - Retrieval orchestrator
app/retrieval/service.py - Role scope resolver
app/retrieval/scope_resolver.py - Search filter builder
app/retrieval/filter_builder.py - Context authorization
app/retrieval/context_assembler.py - Prompt builder
app/rag/prompt_builder.py - LLM client
app/rag/llm_client.py
Persistence and audit
- Chroma vector store
app/db/vector_store.py - SQL database
app/db/session.py - Audit service
app/services/audit_service.py
Other components
- API user
- LLM provider
- Redis cache
Connections 34
- API user → FastAPI app: sends requests
- FastAPI app → Auth routes: dispatches auth
- FastAPI app → Org and user routes: dispatches org
- FastAPI app → Document routes: dispatches documents
- FastAPI app → Query route: dispatches queries
- FastAPI app → JWT middleware: installs middleware
- JWT middleware → Auth routes: permits public paths
- JWT middleware → Org and user routes: attaches user context
- JWT middleware → Document routes: attaches user context
- JWT middleware → Query route: attaches user context
- Auth routes → User service: authenticates users
- Org and user routes → User service: manages organisations
- User service → SQL database: reads and writes
- Document routes → Ingestion orchestrator: ingests or deletes
- Ingestion orchestrator → Document validator: validates input
- Ingestion orchestrator → Document parser: parses documents
- Ingestion orchestrator → Text chunker: chunks text
- Ingestion orchestrator → Text embedder: embeds chunks
- Ingestion orchestrator → Chroma vector store: upserts or deletes
- Ingestion orchestrator → SQL database: writes audit records
- Query route → RAG service: runs query
- RAG service → Response cache: checks and sets
- Response cache → Redis cache: reads and writes
- RAG service → Retrieval orchestrator: requests secure retrieval
- Retrieval orchestrator → Role scope resolver: resolves role scope
- Retrieval orchestrator → Text embedder: embeds query
- Retrieval orchestrator → Search filter builder: builds search filter
- Retrieval orchestrator → Chroma vector store: searches chunks
- Retrieval orchestrator → Context authorization: checks retrieved chunks
- RAG service → Prompt builder: builds prompt
- RAG service → LLM client: generates answer
- LLM client → LLM provider: sends prompt
- RAG service → Audit service: records query
- Audit service → SQL database: writes audit record