Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

scripts/operator_identity.py

@@ -0,0 +1,37 @@
+"""Generate a human key once; deployment configuration contains only its digest.
+
+Run locally in a private terminal. Do not redirect the complete output into deployment config.
+"""
+
+import argparse
+import hashlib
+import json
+import re
+import secrets
+import uuid
+from datetime import UTC, datetime, timedelta
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--subject", required=True)
+    parser.add_argument("--role", choices=("viewer", "operator", "admin"), required=True)
+    parser.add_argument("--days", type=int, default=30)
+    args = parser.parse_args()
+    if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9._@-]{0,127}", args.subject):
+        parser.error("subject must be 1-128 letters, digits, dots, underscores, @ or hyphens")
+    if args.subject == "legacy-operator" or not 1 <= args.days <= 365:
+        parser.error("reserved subject or expiry outside 1-365 days")
+    token = "mfop_" + secrets.token_urlsafe(32)
+    record = {
+        "credential_id": str(uuid.uuid4()),
+        "subject": args.subject,
+        "role": args.role,
+        "token_sha256": hashlib.sha256(token.encode()).hexdigest(),
+        "expires_at": (datetime.now(UTC) + timedelta(days=args.days)).isoformat(),
+    }
+    print(json.dumps({"one_time_key": token, "deployment_record": record}, indent=2))
+
+
+if __name__ == "__main__":
+    main()