Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/control_api/persistence/demo_client.py

@@ -0,0 +1,118 @@
+"""One-time, idempotent provisioning of the Fleet Ops demo client identity.
+
+Docs: docs/superpowers/specs/2026-08-05-mobilityops-demo-token-design.md
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from uuid import NAMESPACE_URL, UUID, uuid5
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from .models import (
+    ClientBindingRow,
+    ClientRow,
+    EnvironmentRow,
+    ProjectRow,
+    VirtualServerRow,
+    WorkspaceRow,
+)
+
+DEMO_CLIENT_ISSUER = "itworx-mcp-hub:demo-token"
+DEMO_CLIENT_SUBJECT = "mobilityops-demo"
+DEMO_CLIENT_ID: UUID = uuid5(NAMESPACE_URL, "https://hub.example.com/demo-client/mobilityops")
+
+
+@dataclass(frozen=True)
+class DemoClientResult:
+    client_id: UUID
+    binding_id: UUID
+
+
+def provision_demo_client(
+    session: Session,
+    *,
+    workspace_slug: str = "itworx",
+    project_slug: str = "mobilityops",
+    environment_name: str = "prod",
+) -> DemoClientResult:
+    workspace = session.scalar(select(WorkspaceRow).where(WorkspaceRow.slug == workspace_slug))
+    if workspace is None:
+        raise ValueError("demo client workspace is not registered")
+    project = session.scalar(
+        select(ProjectRow).where(
+            ProjectRow.workspace_id == workspace.id,
+            ProjectRow.slug == project_slug,
+            ProjectRow.status == "active",
+        )
+    )
+    if project is None:
+        raise ValueError("demo client project is not registered")
+    environment = session.scalar(
+        select(EnvironmentRow).where(
+            EnvironmentRow.workspace_id == workspace.id,
+            EnvironmentRow.project_id == project.id,
+            EnvironmentRow.name == environment_name,
+            EnvironmentRow.status == "active",
+        )
+    )
+    if environment is None:
+        raise ValueError("demo client environment is not registered")
+    # The demo client must bind to exactly one, unambiguous, externally-routed
+    # virtual server. Taking "the first match" would silently bind the demo
+    # identity to an arbitrary server if the project/environment ever grows a
+    # second one.
+    servers = session.scalars(
+        select(VirtualServerRow).where(
+            VirtualServerRow.workspace_id == workspace.id,
+            VirtualServerRow.project_id == project.id,
+            VirtualServerRow.environment_id == environment.id,
+            VirtualServerRow.enabled.is_(True),
+            VirtualServerRow.gateway_external_id.is_not(None),
+        )
+    ).all()
+    if len(servers) != 1:
+        raise ValueError(
+            f"demo client virtual server is not uniquely determined "
+            f"({len(servers)} enabled, externally-routed servers found for "
+            f"{project_slug}/{environment_name}; expected exactly 1)"
+        )
+    server = servers[0]
+
+    client = session.get(ClientRow, DEMO_CLIENT_ID)
+    if client is None:
+        client = ClientRow(
+            id=DEMO_CLIENT_ID,
+            workspace_id=workspace.id,
+            subject=DEMO_CLIENT_SUBJECT,
+            issuer=DEMO_CLIENT_ISSUER,
+            client_type="mcp",
+            status="active",
+            record_metadata={"managedBy": "demo-token-provisioning"},
+        )
+        session.add(client)
+        session.flush()
+
+    binding = session.scalar(
+        select(ClientBindingRow).where(
+            ClientBindingRow.client_id == DEMO_CLIENT_ID,
+            ClientBindingRow.virtual_server_id == server.id,
+        )
+    )
+    if binding is None:
+        binding = ClientBindingRow(
+            workspace_id=workspace.id,
+            project_id=project.id,
+            client_id=DEMO_CLIENT_ID,
+            virtual_server_id=server.id,
+            enabled=True,
+        )
+        session.add(binding)
+        session.flush()
+    elif not binding.enabled:
+        binding.enabled = True
+        session.flush()
+
+    return DemoClientResult(client_id=client.id, binding_id=binding.id)