Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/docker_read_broker/server.py

@@ -0,0 +1,106 @@
+"""Docker broker process entrypoint."""
+
+from __future__ import annotations
+
+import json
+import os
+from collections.abc import Mapping
+from pathlib import Path
+
+from packages.hub_runtime import SecretFileError, read_secret_file
+
+from .broker import (
+    BrokerApp,
+    BrokerError,
+    DockerBackend,
+    DockerEngineBackend,
+    Registration,
+    RegistrationStore,
+    ServiceTokenVerifier,
+    make_handler,
+)
+
+
+def _read_secret() -> str:
+    path = Path(os.getenv("BROKER_TOKEN_FILE", "/run/secrets/docker_broker_service_token"))
+    try:
+        return read_secret_file(
+            path,
+            expected_uid=(
+                int(os.environ["SECRET_EXPECTED_UID"]) if os.getenv("SECRET_EXPECTED_UID") else None
+            ),
+            expected_gid=(
+                int(os.environ["SECRET_EXPECTED_GID"]) if os.getenv("SECRET_EXPECTED_GID") else None
+            ),
+        )
+    except (SecretFileError, ValueError):
+        raise SystemExit("required broker secret validation failed") from None
+
+
+def _labels(container: Mapping[str, object]) -> Mapping[str, object]:
+    labels = container.get("Labels")
+    if isinstance(labels, Mapping):
+        return {str(key): value for key, value in labels.items()}
+    config = container.get("Config")
+    nested = config.get("Labels") if isinstance(config, Mapping) else None
+    if isinstance(nested, Mapping):
+        return {str(key): value for key, value in nested.items()}
+    return {}
+
+
+def _resolve_container_id(backend: DockerBackend, compose_project: str, service: str) -> str:
+    matches = []
+    for container in backend.containers():
+        labels = _labels(container)
+        if (
+            labels.get("com.docker.compose.project") == compose_project
+            and labels.get("com.docker.compose.service") == service
+        ):
+            matches.append(str(container.get("Id", "")))
+    if len(matches) != 1 or not matches[0]:
+        raise ValueError("registration target must resolve to exactly one container")
+    return matches[0]
+
+
+def _load_registrations(backend: DockerBackend) -> RegistrationStore:
+    path = Path(os.getenv("BROKER_REGISTRATIONS_FILE", "/etc/itworx/registered-targets.json"))
+    if not path.is_file():
+        return RegistrationStore(())
+    try:
+        document = json.loads(path.read_text(encoding="utf-8"))
+        if document.get("defaultDecision") != "deny":
+            raise ValueError("broker registration default must deny")
+        registrations = []
+        for item in document.get("containers", []):
+            match = item["match"]
+            compose_project = str(match["composeProject"])
+            service = str(match["service"])
+            registrations.append(
+                Registration(
+                    project=str(item["project"]),
+                    environment=str(item["environment"]),
+                    registered_id=str(item["registeredId"]),
+                    container_id=_resolve_container_id(backend, compose_project, service),
+                    compose_project=compose_project,
+                    service=service,
+                    allowed_reads=frozenset(str(value) for value in item.get("allowedReads", [])),
+                )
+            )
+        return RegistrationStore(registrations)
+    except (BrokerError, json.JSONDecodeError, KeyError, OSError, TypeError, ValueError):
+        raise SystemExit("broker registration validation failed") from None
+
+
+if __name__ == "__main__":
+    from http.server import ThreadingHTTPServer
+
+    backend = DockerEngineBackend()
+    application = BrokerApp(
+        backend,
+        _load_registrations(backend),
+        ServiceTokenVerifier(_read_secret()),
+    )
+    ThreadingHTTPServer(
+        ("0.0.0.0", int(os.getenv("BROKER_PORT", "8080"))),  # noqa: S104
+        make_handler(application),  # noqa: S104
+    ).serve_forever()