119 lines
3.8 KiB
Python
119 lines
3.8 KiB
Python
"""One-time, idempotent provisioning of the Fleet Ops demo client identity.
|
|
|
|
Docs: docs/superpowers/specs/2026-08-05-mobilityops-demo-token-design.md
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
from uuid import NAMESPACE_URL, UUID, uuid5
|
|
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from .models import (
|
|
ClientBindingRow,
|
|
ClientRow,
|
|
EnvironmentRow,
|
|
ProjectRow,
|
|
VirtualServerRow,
|
|
WorkspaceRow,
|
|
)
|
|
|
|
DEMO_CLIENT_ISSUER = "itworx-mcp-hub:demo-token"
|
|
DEMO_CLIENT_SUBJECT = "mobilityops-demo"
|
|
DEMO_CLIENT_ID: UUID = uuid5(NAMESPACE_URL, "https://hub.example.com/demo-client/mobilityops")
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class DemoClientResult:
|
|
client_id: UUID
|
|
binding_id: UUID
|
|
|
|
|
|
def provision_demo_client(
|
|
session: Session,
|
|
*,
|
|
workspace_slug: str = "itworx",
|
|
project_slug: str = "mobilityops",
|
|
environment_name: str = "prod",
|
|
) -> DemoClientResult:
|
|
workspace = session.scalar(select(WorkspaceRow).where(WorkspaceRow.slug == workspace_slug))
|
|
if workspace is None:
|
|
raise ValueError("demo client workspace is not registered")
|
|
project = session.scalar(
|
|
select(ProjectRow).where(
|
|
ProjectRow.workspace_id == workspace.id,
|
|
ProjectRow.slug == project_slug,
|
|
ProjectRow.status == "active",
|
|
)
|
|
)
|
|
if project is None:
|
|
raise ValueError("demo client project is not registered")
|
|
environment = session.scalar(
|
|
select(EnvironmentRow).where(
|
|
EnvironmentRow.workspace_id == workspace.id,
|
|
EnvironmentRow.project_id == project.id,
|
|
EnvironmentRow.name == environment_name,
|
|
EnvironmentRow.status == "active",
|
|
)
|
|
)
|
|
if environment is None:
|
|
raise ValueError("demo client environment is not registered")
|
|
# The demo client must bind to exactly one, unambiguous, externally-routed
|
|
# virtual server. Taking "the first match" would silently bind the demo
|
|
# identity to an arbitrary server if the project/environment ever grows a
|
|
# second one.
|
|
servers = session.scalars(
|
|
select(VirtualServerRow).where(
|
|
VirtualServerRow.workspace_id == workspace.id,
|
|
VirtualServerRow.project_id == project.id,
|
|
VirtualServerRow.environment_id == environment.id,
|
|
VirtualServerRow.enabled.is_(True),
|
|
VirtualServerRow.gateway_external_id.is_not(None),
|
|
)
|
|
).all()
|
|
if len(servers) != 1:
|
|
raise ValueError(
|
|
f"demo client virtual server is not uniquely determined "
|
|
f"({len(servers)} enabled, externally-routed servers found for "
|
|
f"{project_slug}/{environment_name}; expected exactly 1)"
|
|
)
|
|
server = servers[0]
|
|
|
|
client = session.get(ClientRow, DEMO_CLIENT_ID)
|
|
if client is None:
|
|
client = ClientRow(
|
|
id=DEMO_CLIENT_ID,
|
|
workspace_id=workspace.id,
|
|
subject=DEMO_CLIENT_SUBJECT,
|
|
issuer=DEMO_CLIENT_ISSUER,
|
|
client_type="mcp",
|
|
status="active",
|
|
record_metadata={"managedBy": "demo-token-provisioning"},
|
|
)
|
|
session.add(client)
|
|
session.flush()
|
|
|
|
binding = session.scalar(
|
|
select(ClientBindingRow).where(
|
|
ClientBindingRow.client_id == DEMO_CLIENT_ID,
|
|
ClientBindingRow.virtual_server_id == server.id,
|
|
)
|
|
)
|
|
if binding is None:
|
|
binding = ClientBindingRow(
|
|
workspace_id=workspace.id,
|
|
project_id=project.id,
|
|
client_id=DEMO_CLIENT_ID,
|
|
virtual_server_id=server.id,
|
|
enabled=True,
|
|
)
|
|
session.add(binding)
|
|
session.flush()
|
|
elif not binding.enabled:
|
|
binding.enabled = True
|
|
session.flush()
|
|
|
|
return DemoClientResult(client_id=client.id, binding_id=binding.id)
|