granthi-sync/server/__pycache__/granthi_link.cpython-314.pyc

+
¦,…j1ãó@
€Rt^R
I
t
^R
It^R
It^R
It^R
It^R
It^R
It^R
It^R
I	t	^R
I
t
^R
It^R
I
t^RIHtHt^RIHtHtRt]P(!R4
tRt]P.!R4
tRRl
tR	t!R
R4t!RR
]4tRtRt]R8Xd
]!4R
#R
#)a granthi-link: provisioning service for the granthi-sync product spine.

Bridges shre-id (Zitadel) identity to a Granthi (Gitea) forge:

  POST /v1/link   {zitadel_access_token, device_name}
                  -> validates the token against Zitadel userinfo
                  -> ensures a Gitea user exists (admin API)
                  -> mints a scoped Gitea token for that user (admin basic
                     auth + `Sudo:` header -- the only mechanism that works
                     on Gitea 1.27; token-authenticated sudo returns 401)
                  -> {gitea_base, login, token, token_name}

  POST /v1/repos  {token, name, private} -> creates a user repo with the
                  USER token, returns clone URLs rebased onto the public
                  gitea_base (container ROOT_URL may not resolve for
                  clients on the tailnet).

  GET  /health    -> {"status": "ok", ...}

Design decisions (documented per spec):
  * User creation uses source_id 0 (local). Gitea 1.27.1 has no
    /api/v1/admin/identity-auth-sources endpoint (404); the shre-id OAuth2
    source is ID 1 (discovered via `gitea admin auth list`), but users
    created against an OAuth2 source cannot basic-auth and admin-created
    users get no external_login_user row anyway, so SSO linking happens on
    first OIDC web login (by email) regardless. Local + random password is
    the simplest correct v1.
  * Token minting NEEDS the admin password (basic auth + Sudo header).
    The admin API token alone cannot mint user tokens on 1.27. The config
    therefore carries admin_login/admin_password alongside admin_token;
    config must be root-owned 0600.
  * test_mode: when config "test_mode" is true, a /v1/link body may carry
    "test_userinfo" (dict) instead of a Zitadel round-trip. This exists so
    E2E can exercise the ensure-user+mint path without a human OAuth login.
    NEVER enable in production config.

Stdlib only. Python 3.9+.
N)ÚdatetimeÚtimezone)ÚBaseHTTPRequestHandlerÚThreadingHTTPServerz1.0.0úgranthi-linkz/opt/granthi-link/config.jsonz[^a-zA-Z0-9._-]+cóx€R
p\
T;
'g/4
pVPRR\24Ve7\P!V4
P4pVPRR4\PPWW`R7p\PPWtR7;
_
uu_4pVP4p	VPp
R
R
R
4X
X	'd\P$!T	4
3#/3# +'giL4;i
 \PPd'pTP4p	TPp
R
p?LwR
p?i
\PP\ 3dpRR	\#T4
/
3uR
p?#R
p?i
i;i
 \&dX
R
X	P)RR7
/
3u#i;i
)
z@Minimal JSON-over-HTTP helper. Returns (status, parsed_or_text).Nz
User-Agentú
granthi-link/úContent-Typeúapplication/json)ÚdataÚheadersÚmethod)
ÚtimeoutiWÚerrorÚrawÚreplace)
Úerrors)ÚdictÚ
setdefaultÚVERSIONÚjsonÚdumpsÚencodeÚurllibÚrequestÚRequestÚurlopenÚreadÚstatusrÚ	HTTPErrorÚcodeÚURLErrorÚOSErrorÚstrÚloadsÚ
ValueErrorÚdecode)r
ÚurlrÚbodyrrÚhdrsÚreqÚresprrÚ
es&&&&&       Ú�/private/tmp/claude-502/-Users-aibot/7c1e3ba6-d022-4b1b-8026-9f6da66762d2/scratchpad/granthi-sync/tests/../server/granthi_link.pyÚ	http_jsonr.DsZ
€à€DÜ�—
�
˜2Ó€Dà‡O�O�L M´'°Ð";Ô<ØÒÜ�zŠz˜$Ó×&Ñ&Ó(ˆØ�‰˜Ð(:Ô;Ü
�.‰.×
 Ñ
  ¸Ð
 Ó
M€Cð&Ü
�^‰^×
#Ñ
# CÐ
#×
9Ô
9¸TØ—)‘)“+ˆCØ—[‘[ˆF÷:ð=د#”t—z’z #“Ð5Ð5°2Ð5Ð5÷:×
9ûô�<‰<×!Ñ!ôØ�f‰f‹hˆØ—‘�ûÜ�L‰L×!Ñ!¤7Ð+ô
&Ø�Wœc !›fÐ%Ð%Õ%ûð
&ûôô
=ؘ˜sŸz™z°˜zÓ;Ð<Ð<Ò<ð
=úslÂ
(DÂ5C>ÃDÃFÃ$FÃ;FÃ>D	Ä	DÄDÄFÄ0EÅ&FÅ8
FÅ9F
Æ
FÆ
FÆ!F9Æ8
F9cóz€\P!VRV
2P44
P4pR
V2#)Ú
:zBasic )Úbase64Ú	b64encoderr&)ÚloginÚpasswordÚtoks&& r-Ú_basicr6]s;€Ü
×
Ò
˜e˜W A h ZÐ0×7Ñ7Ó9Ó
:×
AÑ
AÓ
C€CØ
�C�5ˆ>Ðócó`a€]t
Rt^ftoR
tRt]R4tRtRt	Rt
RtRtR	t
R
tVtR#)ÚLinkServicecóÚ€WnV
R,PR
4
VnV
PRVP4PR
4
VnV
PRR4VnR#)Ú
gitea_baseÚ
/Úpublic_gitea_baseÚzitadel_userinfoz#https://id.shre.ai/oidc/v1/userinfoN)ÚcfgÚrstripÚgiteaÚgetÚpublic_giteaÚuserinfo_url)ÚselfÚconfigs&&r-Ú__init__ÚLinkService.__init__gs[€ØŒð˜LÕ)×0Ñ0°Ó5ˆŒ
Ø"ŸJ™JÐ':¸D¿J¹JÓG×NÑNÈsÓSˆÔØ"ŸJ™JØÐ Eó
G
ˆÖr7có¤€\
RVPR
RV
2/
R7wr#V^È8wd	RRVR23#\V\4'dRV9
dR#VR3#)	ÚGETÚ
AuthorizationzBearer ©
rNz&zitadel userinfo rejected token (HTTP Ú
)Úsub)Nz zitadel userinfo returned no sub)r.rDÚ
isinstancer)rEÚaccess_tokenrÚinfos&&  r-Úvalidate_tokenÚLinkService.validate_tokenqsk€Ü Ø�4×$Ñ$Ø$¨°¨~Ð&>Ð?ôA
‰ˆð�SŒ=ØÐAÀ&ÀÈÐKÐKÐKܘ$¤×%Ò%¨°dÔ):Ø;Ð;Ø�TˆzÐr7c
ó`
€VP
R4
;
'gR
p
V
'g5VP
R4
;
'gR
pVPR^
4^,p
V
PR^
4^,p
\PRV
4P	R4
P4p
T
;
'gR#)Úpreferred_usernameÚÚemailÚ
@Ú
-z-._N)rBÚsplitÚ
LOGIN_SAFErNÚstripÚlower)ÚuserinfoÚcandrWs&  r-Úderive_loginÚLinkService.derive_login{sŒ€à�|‰|Ð0Ó1×7Ð7°RˆßØ—L‘L Ó)×/Ð/¨RˆEØ—;‘;˜s AÓ& qÕ)ˆDØ�z‰z˜#˜qÓ! !Õ$ˆÜ�~‰~˜c 4Ó(×.Ñ.¨uÓ5×;Ñ;Ó=ˆØ�|ˆ|�tÐr7c
ó2€RR
VPR,2/
#)rKútoken Úadmin_token)
r?©
rEs
&r-Ú
_admin_hdrÚLinkService._admin_hdr†s€Ø 6¨$¯(©(°=Õ*AÐ)BÐ!CÐDÐDr7cóf€\
RVPR
V
2VP4R7wr#V^È8H#)rJú/api/v1/users/rL)r.rArf)rEr3rÚ
_s&&  r-Úuser_existsÚLinkService.user_exists‰s6€ÜØ�d—j‘j�\ °¨wÐ7ÀÇÁÓARô
T
‰	ˆà˜‰}Ðr7cóˆ
a€\P\P,oRPV3
R
l\	^4
44
pVPR4
;
'gV
R2pRV
RVRVRRRR	R
VPRR4/p\
RVPR
2VP4VR7wrgV^É8wd	RVRV2#R#)rVc
3óP<
"€TFp
\P!S4
x€K	R#5i
)
N)ÚsecretsÚchoice)Ú.0rjÚpw_alphabets& €r-Ú	<genexpr>Ú*LinkService.create_user.<locals>.<genexpr>�søé€ÐJÁ	¸1œ7Ÿ>š>¨+×6Ð6Ã	ùsƒ#&
rWz@users.noreply.granthi.shre.aiÚusernamer4Úmust_change_passwordFÚ
visibilityÚprivateÚ	full_nameÚnameÚPOSTz/api/v1/admin/users©rr(z%gitea admin user create failed (HTTP ú): N)	ÚstringÚ
ascii_lettersÚdigitsÚjoinÚrangerBr.rArf)	rEr3r^r4rWr(rr+rrs	&&&     @r-Úcreate_userÚLinkService.create_userŽsÇø€Ü×*Ñ*¬V¯]©]Õ:ˆØ—7‘7ÔJÄÀbÄ	ÓJÓJˆØ—‘˜WÓ%×QÐQ¨E¨7Ð2PÐ)Qˆà˜Ø�UØ˜Ø" EØ˜)Ø˜Ÿ™ f¨bÓ1ð

ˆô!Ø�t—z‘z�lÐ"5Ð6Ø—O‘OÓ%¨Dô2‰ˆð�SŒ=Ø:¸6¸(À#ÀdÀVÐLÐLÙr7c
óÐ
€\PR
T;
'gR4R,pRPV\P!\
P4
PR4
4p\RVPRV
R2R	\VPR
,VPR,4RV
/R
VRRR./R7wrVV^É8wdRRRVRV23#VPR4
VR3#)zwAdmin basic auth + Sudo header. Verified on Gitea 1.27.1:
token-auth sudo (header or ?sudo=) -> 401; basic+Sudo -> 201.rYÚdevice:Né(Nzgranthi-sync-{}-{}z%Y%m%dT%H%M%SZr{riz/tokensrKÚadmin_loginÚadmin_passwordÚSudorzÚscopeszwrite:repositoryz
write:userr|Nztoken mint failed (HTTP r}Úsha1)
r[rNÚformatrÚnowrÚutcÚstrftimer.rAr6r?rB)rEr3Údevice_nameÚsafe_devÚ
token_namerr+s&&&    r-Ú
mint_tokenÚLinkService.mint_token¢sò€ô—>‘> # {×'>Ð'>°hÓ?ÀÕDˆØ)×0Ñ0Ø”h—l’l¤8§<¡<Ó0×9Ñ9Ð:JÓKó
M
ˆ
ä Ø�t—z‘z�l .°°°wÐ?à¤Ø—H‘H˜]Õ+¨T¯X©XÐ6FÕ-Gó
"I
à˜ðð
˜*ØÐ/°Ð>ð
@
ôA
‰ˆð�SŒ=ؘÐ!9¸&¸ÀÀTÀFÐKÐKÐKØ�x‰x˜Ó ¨TÐ1Ð1r7c	óô€V
P
R4
;
'gR
pVPP
R4
'dE\V
P
R4
\4'd \PR4
V
R,pM@V
P
R4
pV'gRRR/
3#VP
V4
wr5V'dR	RV/
3#VPV4
pV'gR
RR/
3#VPV4
'g6VPWc4pV'dRRV/
3#\PR
V4VPWb4wrxpV'dRRV/
3#\PRW†4^ÈRVPRVRVRV/3#)r‘r†Ú	test_modeÚ
test_userinfoz)TEST-MODE link request (stubbed userinfo)Úzitadel_access_tokené�
rzzitadel_access_token requiredi‘
i¦
z&could not derive a login from userinfoéö
zcreated gitea user %szminted token %s for %sr;r3Útokenr“)
rBr?rOrÚLOGÚwarningrRr`rkrƒrQr”rC)	rEr(r‘r^rœÚerrr3Úgitea_tokenr“s	&&       r-ÚlinkÚLinkService.link¶sd
€Ø—h‘h˜}Ó-×9Ð9°ˆØ�8‰8�<‰<˜×$Ò$¬°D·H±H¸_Ó4MÌt×)TÒ)TÜ�K‰KÐCÔDؘOÕ,‰Hà—H‘HÐ3Ó4ˆEßؘWÐ&EÐFÐFÐFØ ×/Ñ/°Ó6‰MˆHßؘW c˜NÐ*Ð*Ø×!Ñ! (Ó+ˆßؘÐ"JÐKÐKÐKØ×Ñ ×&Ò&Ø×"Ñ" 5Ó3ˆCßؘW c˜NÐ*Ð*Ü�H‰HÐ,¨eÔ4Ø'+§¡°uÓ'JÑ$ˆ ßؘ #˜Ð&Ð&Ü�‰Ð)¨:Ô=Ø�\ 4×#4Ñ#4°g¸uؘk¨<¸ð
E
ð
E
ð
	E
r7cóü
€V
P
R4
pV
P
R
4
pV'd	V'gRRR/
3#\RVPR2RRV2/
R
VR	\V
P
R	R
44
RRR
R/R7wrEVR8XdRRRVR2/
3#V^É8wd
RRRVRV2/
3#VP
RR4p^ÈR
VP
R
4
RVR	VP
R	4
RVPRVR2RVPRV2/3#)rœrzršrztoken and name requiredr{z/api/v1/user/reposrKrcrxTÚdefault_branchÚmainÚ	auto_initFr|i™
zrepo z already existsr›zrepo create failed (HTTP r}ryrVÚ	clone_urlr<z.gitÚhtml_url)rBr.rAÚboolrC)rEr(rœrzrr+rys&&     r-ÚreposÚLinkService.reposÑsB
€Ø—‘˜Ó!ˆØ�x‰x˜ÓˆßŸDؘÐ";Ð<Ð<Ð<Ü Ø�t—z‘z�lÐ"4Ð5Ø$¨¨u¨gÐ&6Ð7ؘ$ 	¬4°·±¸ÀDÓ0IÓ+JØ" F¨K¸ð
@
ôA
‰ˆð