Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/app/services/enrollment_profiles.py

@@ -0,0 +1,60 @@
+"""Server-owned enrollment profiles and bounded runtime environment contracts."""
+
+from __future__ import annotations
+
+from typing import Any
+
+PROFILE_VERSION = "enrollment-profile/v1"
+
+PROFILES: dict[str, dict[str, Any]] = {
+    "internal-webapp": {
+        "public": True,
+        "authentication": "none",
+        "runtimeEnvironmentKeys": ("APPOPS_PUBLIC_URL",),
+        "requiresNpm": True,
+        "requiresOidc": False,
+    },
+    "internal-webapp-oidc": {
+        "public": True,
+        "authentication": "native-oidc",
+        "runtimeEnvironmentKeys": (
+            "APPOPS_PUBLIC_URL",
+            "OIDC_CLIENT_ID",
+            "OIDC_CLIENT_SECRET",
+            "OIDC_ISSUER",
+            "OIDC_ROLE_CLAIM",
+        ),
+        "requiresNpm": True,
+        "requiresOidc": True,
+    },
+    "internal-service": {
+        "public": False,
+        "authentication": "none",
+        "runtimeEnvironmentKeys": (),
+        "requiresNpm": False,
+        "requiresOidc": False,
+    },
+    "repopulse-authenticated": {
+        "public": True,
+        "authentication": "npm-access-list+maintenance-token",
+        "runtimeEnvironmentKeys": (
+            "REPOPULSE_GITEA_URL",
+            "REPOPULSE_GITEA_TOKEN",
+            "REPOPULSE_MAINTENANCE_TOKEN",
+        ),
+        "requiresNpm": True,
+        "requiresOidc": False,
+    },
+}
+
+
+def profile_contract(name: str) -> dict[str, Any] | None:
+    profile = PROFILES.get(name)
+    return dict(profile) if profile else None
+
+
+def profile_summary(name: str) -> dict[str, Any] | None:
+    profile = profile_contract(name)
+    if profile is None:
+        return None
+    return {"name": name, "version": PROFILE_VERSION, **profile}