67 lines
2.1 KiB
Python
67 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Mint a short-lived Fleet Ops demo bearer token. Operator-only.
|
|
|
|
Prints the token and its jti exactly once; nothing is persisted in
|
|
plaintext anywhere. Run provision_demo_client.py once, first, before the
|
|
first token is ever minted, and reachable via the same secret file
|
|
(DEMO_TOKEN_KEY_FILE, default /run/secrets/demo_token_signing_key) the
|
|
dataplane router verifies against.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
from services.runtime.demo_token import (
|
|
MAX_TTL_HOURS,
|
|
MIN_TTL_HOURS,
|
|
load_demo_token_signing_key,
|
|
mint_demo_token,
|
|
)
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument(
|
|
"--label", required=True, help="Human-readable name for this link, e.g. an org or event."
|
|
)
|
|
parser.add_argument(
|
|
"--ttl-hours",
|
|
type=int,
|
|
default=48,
|
|
help=f"Token lifetime in hours ({MIN_TTL_HOURS}-{MAX_TTL_HOURS}, default 48).",
|
|
)
|
|
parser.add_argument(
|
|
"--mcp-base-url",
|
|
default="https://mcp.example.com",
|
|
help="Base URL demo users should connect their MCP client to.",
|
|
)
|
|
parser.add_argument(
|
|
"--key-file",
|
|
type=Path,
|
|
default=None,
|
|
help="Path to the demo token signing secret file. Defaults to DEMO_TOKEN_KEY_FILE / "
|
|
"/run/secrets/demo_token_signing_key (container context). Pass this explicitly when "
|
|
"running on the Tower host directly, e.g. "
|
|
"/srv/example/appdata/itworx-mcp-hub/secrets/demo_token_signing_key.",
|
|
)
|
|
args = parser.parse_args()
|
|
|
|
key = load_demo_token_signing_key(args.key_file)
|
|
token, jti = mint_demo_token(key, ttl_hours=args.ttl_hours)
|
|
|
|
print(f"label: {args.label}")
|
|
print(f"jti: {jti} (save this -- needed to revoke early)")
|
|
print(f"expires in: {args.ttl_hours}h")
|
|
print()
|
|
print("MCP client connection:")
|
|
print(f" URL: {args.mcp_base_url}/mcp/mobilityops/prod")
|
|
print(f" Bearer token: {token}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|