72 lines
2.9 KiB
Python
72 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
from typing import Literal
|
|
|
|
from pydantic import BaseModel, ConfigDict, Field, StrictBool, StrictInt, StrictStr
|
|
|
|
from .forge_bootstrap import ForgeBootstrapPreflightV1
|
|
|
|
_SAFE_CODE = re.compile(r"^[a-z][a-z0-9_]{0,95}$")
|
|
_REVISION = re.compile(r"^[0-9a-f]{40}$")
|
|
_SHA256 = re.compile(r"^[0-9a-f]{64}$")
|
|
_CONTROLLER_VERSION = re.compile(r"^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$")
|
|
|
|
|
|
class ForgeControllerReaderProvisionRequestV1(BaseModel):
|
|
"""Empty request for the single fixed Forge controller-reader provisioner."""
|
|
|
|
model_config = ConfigDict(extra="forbid", frozen=True, strict=True)
|
|
|
|
|
|
class ForgeControllerReaderProvisionResultV1(BaseModel):
|
|
"""Safe response projection; the held reader token is never returned."""
|
|
|
|
model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
|
|
|
|
success: StrictBool
|
|
status: Literal["ready", "blocked", "conflict", "failed", "partial_failure"]
|
|
message: StrictStr = Field(pattern=_SAFE_CODE.pattern)
|
|
ready: StrictBool
|
|
secret_ref: Literal["ITWORX_FORGE_AUTHENTIK_READ_TOKEN"] = Field(alias="secretRef")
|
|
|
|
|
|
class ForgeSecretDeliveryRequestV1(BaseModel):
|
|
"""Caller supplies only the existing exact-revision Forge profile."""
|
|
|
|
model_config = ConfigDict(extra="forbid", frozen=True, strict=True)
|
|
|
|
profile: ForgeBootstrapPreflightV1
|
|
|
|
|
|
class ForgeSecretDeliveryControllerArtifactV1(BaseModel):
|
|
"""Strict safe identity projection from the independently guarded controller."""
|
|
|
|
model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True, strict=True)
|
|
|
|
controller_version: StrictStr = Field(alias="controllerVersion", pattern=_CONTROLLER_VERSION.pattern)
|
|
source_repository: Literal["jens/unraid-appops-gateway"] = Field(alias="sourceRepository")
|
|
source_revision: StrictStr = Field(alias="sourceRevision", pattern=_REVISION.pattern)
|
|
source_tree: StrictStr = Field(alias="sourceTree", pattern=_REVISION.pattern)
|
|
artifact_sha256: StrictStr = Field(alias="artifactSha256", pattern=_SHA256.pattern)
|
|
|
|
|
|
class ForgeSecretDeliveryResultV1(BaseModel):
|
|
"""Safe operator result; it contains no bundle material or token hashes."""
|
|
|
|
model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True, strict=True)
|
|
|
|
success: StrictBool
|
|
status: Literal["bundle_ready", "blocked", "conflict", "failed", "outcome_unknown"]
|
|
message: StrictStr = Field(pattern=_SAFE_CODE.pattern)
|
|
target: Literal["itworx-forge"]
|
|
revision: StrictStr = Field(pattern=_REVISION.pattern)
|
|
controller_artifact: ForgeSecretDeliveryControllerArtifactV1 | None = Field(
|
|
default=None, alias="controllerArtifact"
|
|
)
|
|
secret_files_ready: StrictInt | None = Field(default=None, alias="secretFilesReady")
|
|
master_key_backup_verified: StrictBool | None = Field(
|
|
default=None, alias="masterKeyBackupVerified"
|
|
)
|
|
apply_preflight: Literal["not_evaluated"] | None = Field(default=None, alias="applyPreflight")
|