Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

scripts/provision_demo_client.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""One-time provisioning of the Fleet Ops demo client identity. Idempotent.
+
+Run this once before minting any demo tokens with mint_demo_token.py.
+Connects to the real Hub database using the same HUB_DATABASE_* environment
+variables and secret file the dataplane router itself uses.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--database-url",
+        default=None,
+        help="Full SQLAlchemy database URL, e.g. postgresql+psycopg://user:pass@host:5432/db. "
+        "Overrides HUB_DATABASE_* environment variables and the default /run/secrets password "
+        "file -- use this when running outside a container that has that secret mounted.",
+    )
+    args = parser.parse_args()
+
+    from services.control_api.persistence.db import (
+        create_engine_from_url,
+        session_factory,
+    )
+    from services.control_api.persistence.demo_client import provision_demo_client
+    from services.runtime.common import hub_database_url
+
+    engine = create_engine_from_url(args.database_url or hub_database_url())
+    try:
+        sessions = session_factory(engine)
+        with sessions() as session, session.begin():
+            # Project/environment are deliberately NOT exposed as CLI flags:
+            # the demo identity's scope is fixed at mobilityops/prod by
+            # provision_demo_client's own defaults and must never be widened
+            # from the command line.
+            result = provision_demo_client(session)
+    finally:
+        engine.dispose()
+    print(f"demo client id: {result.client_id}")
+    print(f"binding id: {result.binding_id}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())