Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

scripts/mint_demo_token.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Mint a short-lived Fleet Ops demo bearer token. Operator-only.
+
+Prints the token and its jti exactly once; nothing is persisted in
+plaintext anywhere. Run provision_demo_client.py once, first, before the
+first token is ever minted, and reachable via the same secret file
+(DEMO_TOKEN_KEY_FILE, default /run/secrets/demo_token_signing_key) the
+dataplane router verifies against.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from services.runtime.demo_token import (
+    MAX_TTL_HOURS,
+    MIN_TTL_HOURS,
+    load_demo_token_signing_key,
+    mint_demo_token,
+)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--label", required=True, help="Human-readable name for this link, e.g. an org or event."
+    )
+    parser.add_argument(
+        "--ttl-hours",
+        type=int,
+        default=48,
+        help=f"Token lifetime in hours ({MIN_TTL_HOURS}-{MAX_TTL_HOURS}, default 48).",
+    )
+    parser.add_argument(
+        "--mcp-base-url",
+        default="https://mcp.example.com",
+        help="Base URL demo users should connect their MCP client to.",
+    )
+    parser.add_argument(
+        "--key-file",
+        type=Path,
+        default=None,
+        help="Path to the demo token signing secret file. Defaults to DEMO_TOKEN_KEY_FILE / "
+        "/run/secrets/demo_token_signing_key (container context). Pass this explicitly when "
+        "running on the Tower host directly, e.g. "
+        "/srv/example/appdata/itworx-mcp-hub/secrets/demo_token_signing_key.",
+    )
+    args = parser.parse_args()
+
+    key = load_demo_token_signing_key(args.key_file)
+    token, jti = mint_demo_token(key, ttl_hours=args.ttl_hours)
+
+    print(f"label: {args.label}")
+    print(f"jti: {jti}  (save this -- needed to revoke early)")
+    print(f"expires in: {args.ttl_hours}h")
+    print()
+    print("MCP client connection:")
+    print(f"  URL:          {args.mcp_base_url}/mcp/mobilityops/prod")
+    print(f"  Bearer token: {token}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())