40 lines
940 B
Python
40 lines
940 B
Python
"""Short-lived internal service tokens shared by trusted runtime components."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import time
|
|
|
|
|
|
def issue_broker_service_token(
|
|
secret: str,
|
|
project: str,
|
|
environment: str,
|
|
*,
|
|
ttl_seconds: int = 60,
|
|
) -> str:
|
|
"""Issue a bounded Docker broker token for one validated project context."""
|
|
|
|
payload = {
|
|
"aud": "docker-read-broker",
|
|
"project": project,
|
|
"environment": environment,
|
|
"exp": int(time.time()) + ttl_seconds,
|
|
}
|
|
encoded = (
|
|
base64.urlsafe_b64encode(json.dumps(payload, separators=(",", ":")).encode())
|
|
.decode()
|
|
.rstrip("=")
|
|
)
|
|
signature = (
|
|
base64.urlsafe_b64encode(
|
|
hmac.new(secret.encode(), encoded.encode(), hashlib.sha256).digest()
|
|
)
|
|
.decode()
|
|
.rstrip("=")
|
|
)
|
|
return f"{encoded}.{signature}"
|