stroblmeandClaude Opus 5
d4a9406c51
Docs / docs (push) Successful in 49s
Playwright Tests / test-playwright (1, 2) (push) Failing after 1m11s
Playwright Tests / test-playwright (2, 2) (push) Failing after 23s
pre-commit / pre-commit (push) Successful in 3m2s
Test Backend / test-backend (push) Successful in 2m22s
Compose Smoke Test / test-compose (push) Failing after 22s
Playwright Tests / merge-reports (push) Canceled after 1s
The gates have never gone green on the new runners. Three separate reasons: - backend/Dockerfile shipped Python 3.10 while the code imports typing.Self and datetime.UTC, so the container exited on import and the suite could not even load its conftest. The image moves to 3.13 and the packages declare >=3.12, which is the floor the tests actually pass on; ruff's target follows and rewrites timezone.utc and asyncio.TimeoutError accordingly. Relocking drops the 3.10 branch, which bumps FastAPI and so regenerates the SDK. - frontend/README.md had no trailing newline and two dashboard widgets used arbitrary text-[…] sizes. Both are em-relative on purpose, so they move to the inline style the neighbouring ramp already uses. - Every commit left its own run queued: without a concurrency group a runner that was offline for a while works through a backlog nobody reads. A stack that fails to come up now prints its logs before the teardown removes it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
104 lines
3.7 KiB
Python
104 lines
3.7 KiB
Python
"""Redeeming a claim code, from the dashboard or from the command line.
|
|
|
|
The work is the same either way — ask the portal, keep what it answers, and
|
|
map the account that asked to the portal identity that owns the installation —
|
|
so it lives here rather than in the route. The command line matters because a
|
|
machine on a cluster has no browser pointed at it: `fluksio enroll` does this
|
|
before the engine has started, holding nothing but the database.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import UTC, datetime
|
|
from typing import Any
|
|
|
|
import httpx
|
|
from sqlmodel import Session, select
|
|
|
|
import fluksio
|
|
from fluksio.cloud import config as cloud_config
|
|
from fluksio.models import User
|
|
|
|
|
|
class EnrollError(Exception):
|
|
"""A failure with the status the API should answer with."""
|
|
|
|
def __init__(self, status: int, detail: str) -> None:
|
|
super().__init__(detail)
|
|
self.status = status
|
|
self.detail = detail
|
|
|
|
|
|
class AlreadyEnrolled(EnrollError):
|
|
def __init__(self) -> None:
|
|
super().__init__(409, "This installation is already connected to a portal")
|
|
|
|
|
|
def redeem_claim(
|
|
portal_url: str, claim_code: str, *, timeout: float = 15.0
|
|
) -> dict[str, Any]:
|
|
"""Trade a claim code for this installation's credential and the portal's keys."""
|
|
base = portal_url.rstrip("/")
|
|
try:
|
|
response = httpx.post(
|
|
f"{base}/api/v1/enroll/",
|
|
json={"claim_code": claim_code, "app_version": fluksio.__version__},
|
|
timeout=timeout,
|
|
)
|
|
except httpx.HTTPError as exc:
|
|
raise EnrollError(502, f"Could not reach the portal: {exc}") from exc
|
|
if response.status_code == 404:
|
|
raise EnrollError(400, "That claim code is unknown or has expired")
|
|
if response.status_code != 200:
|
|
raise EnrollError(502, f"The portal refused the claim ({response.status_code})")
|
|
|
|
data: dict[str, Any] = response.json()
|
|
if not data.get("owner_id"):
|
|
# A portal older than remote users does not say who owns the
|
|
# installation, and without that the enrolling account cannot be mapped
|
|
# to anyone — which would leave the portal connected but refused here.
|
|
raise EnrollError(
|
|
502,
|
|
"That portal is too old for this installation: it did not say "
|
|
"which account owns the installation",
|
|
)
|
|
return data
|
|
|
|
|
|
def enroll(
|
|
session: Session, user: User, portal_url: str, claim_code: str
|
|
) -> cloud_config.CloudConfig:
|
|
"""Redeem the code and write the config the connector dials with."""
|
|
if cloud_config.exists():
|
|
raise AlreadyEnrolled()
|
|
|
|
data = redeem_claim(portal_url, claim_code)
|
|
config = cloud_config.CloudConfig(
|
|
portal_url=portal_url.rstrip("/"),
|
|
ws_url=data["ws_url"],
|
|
installation_id=data["installation_id"],
|
|
token=data["installation_token"],
|
|
issuer=data["issuer"],
|
|
# Pinned here, at the one moment the claim code proves who we are
|
|
# talking to. Nothing refreshes this.
|
|
jwks=data["jwks"],
|
|
local_user_id=str(user.id),
|
|
enrolled_at=datetime.now(UTC).isoformat(),
|
|
portal_account=user.email,
|
|
)
|
|
cloud_config.save(config)
|
|
|
|
owner_id = str(data["owner_id"])
|
|
# Re-enrolling from a different local account moves the mapping rather than
|
|
# leaving two accounts claiming the same portal identity, which the unique
|
|
# index would refuse and the lookup could not choose between anyway.
|
|
for other in session.exec(
|
|
select(User).where(User.portal_sub == owner_id, User.id != user.id)
|
|
):
|
|
other.portal_sub = None
|
|
session.add(other)
|
|
user.portal_sub = owner_id
|
|
session.add(user)
|
|
session.commit()
|
|
return config
|