Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

packages/hub_runtime/service_tokens.py

@@ -0,0 +1,39 @@
+"""Short-lived internal service tokens shared by trusted runtime components."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import time
+
+
+def issue_broker_service_token(
+    secret: str,
+    project: str,
+    environment: str,
+    *,
+    ttl_seconds: int = 60,
+) -> str:
+    """Issue a bounded Docker broker token for one validated project context."""
+
+    payload = {
+        "aud": "docker-read-broker",
+        "project": project,
+        "environment": environment,
+        "exp": int(time.time()) + ttl_seconds,
+    }
+    encoded = (
+        base64.urlsafe_b64encode(json.dumps(payload, separators=(",", ":")).encode())
+        .decode()
+        .rstrip("=")
+    )
+    signature = (
+        base64.urlsafe_b64encode(
+            hmac.new(secret.encode(), encoded.encode(), hashlib.sha256).digest()
+        )
+        .decode()
+        .rstrip("=")
+    )
+    return f"{encoded}.{signature}"