119 lines
18 KiB
Plaintext
119 lines
18 KiB
Plaintext
|
+
|
|||
|
|
ž+…j—0 ã ó@ € R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI t ^ RI
|
|||
|
|
t
|
|||
|
|
^ RI t ^ RI
|
|||
|
|
t ^ RIHtHt ^ RIHtHt Rt]P( ! R4 tRt]P. ! R4 tRR ltR t ! R
|
|||
|
|
R 4 t ! R R
|
|||
|
|
]4 t R t R t ] R8X d
|
|||
|
|
] ! 4 R# R# )a granthi-link: provisioning service for the granthi-sync product spine.
|
|||
|
|
|
|||
|
|
Bridges shre-id (Zitadel) identity to a Granthi (Gitea) forge:
|
|||
|
|
|
|||
|
|
POST /v1/link {zitadel_access_token, device_name}
|
|||
|
|
-> validates the token against Zitadel userinfo
|
|||
|
|
-> ensures a Gitea user exists (admin API)
|
|||
|
|
-> mints a scoped Gitea token for that user (admin basic
|
|||
|
|
auth + `Sudo:` header -- the only mechanism that works
|
|||
|
|
on Gitea 1.27; token-authenticated sudo returns 401)
|
|||
|
|
-> {gitea_base, login, token, token_name}
|
|||
|
|
|
|||
|
|
POST /v1/repos {token, name, private} -> creates a user repo with the
|
|||
|
|
USER token, returns clone URLs rebased onto the public
|
|||
|
|
gitea_base (container ROOT_URL may not resolve for
|
|||
|
|
clients on the tailnet).
|
|||
|
|
|
|||
|
|
GET /health -> {"status": "ok", ...}
|
|||
|
|
|
|||
|
|
Design decisions (documented per spec):
|
|||
|
|
* User creation uses source_id 0 (local). Gitea 1.27.1 has no
|
|||
|
|
/api/v1/admin/identity-auth-sources endpoint (404); the shre-id OAuth2
|
|||
|
|
source is ID 1 (discovered via `gitea admin auth list`), but users
|
|||
|
|
created against an OAuth2 source cannot basic-auth and admin-created
|
|||
|
|
users get no external_login_user row anyway, so SSO linking happens on
|
|||
|
|
first OIDC web login (by email) regardless. Local + random password is
|
|||
|
|
the simplest correct v1.
|
|||
|
|
* Token minting NEEDS the admin password (basic auth + Sudo header).
|
|||
|
|
The admin API token alone cannot mint user tokens on 1.27. The config
|
|||
|
|
therefore carries admin_login/admin_password alongside admin_token;
|
|||
|
|
config must be root-owned 0600.
|
|||
|
|
* test_mode: when config "test_mode" is true, a /v1/link body may carry
|
|||
|
|
"test_userinfo" (dict) instead of a Zitadel round-trip. This exists so
|
|||
|
|
E2E can exercise the ensure-user+mint path without a human OAuth login.
|
|||
|
|
NEVER enable in production config.
|
|||
|
|
|
|||
|
|
Stdlib only. Python 3.9+.
|
|||
|
|
N)ÚdatetimeÚtimezone)ÚBaseHTTPRequestHandlerÚThreadingHTTPServerz1.0.0ú granthi-linkz /opt/granthi-link/config.jsonz[^a-zA-Z0-9._-]+c óF € Rp\ T;' g / 4 pVe7 \ P ! V4 P 4 pVP RR4 \
|
|||
|
|
P P WW`R7 p \
|
|||
|
|
P P WtR7 ;_uu_ 4 pVP 4 p VP p
|
|||
|
|
RRR4 X
|
|||
|
|
X ' d \ P" ! T 4 3# / 3# + ' g i L4; i \
|
|||
|
|
P P d' p T P 4 p T P p
|
|||
|
|
Rp ? LwRp ? i\
|
|||
|
|
P P \ 3 d p RR\! T 4 /3u Rp ? # Rp ? ii ; i \$ d X
|
|||
|
|
RX P' R R
|
|||
|
|
7 /3u # i ; i) z@Minimal JSON-over-HTTP helper. Returns (status, parsed_or_text).Nú Content-Typeúapplication/json)ÚdataÚheadersÚmethod)ÚtimeoutiW ÚerrorÚrawÚreplace)Úerrors)ÚdictÚjsonÚdumpsÚencodeÚ
|
|||
|
|
setdefaultÚurllibÚrequestÚRequestÚurlopenÚreadÚstatusr Ú HTTPErrorÚcodeÚURLErrorÚOSErrorÚstrÚloadsÚ
|
|||
|
|
ValueErrorÚdecode) r Úurlr Úbodyr
|
|||
|
|
r
|
|||
|
|
ÚhdrsÚreqÚrespr r Úes &&&&& Ú�/private/tmp/claude-502/-Users-aibot/7c1e3ba6-d022-4b1b-8026-9f6da66762d2/scratchpad/granthi-sync/tests/../server/granthi_link.pyÚ http_jsonr, D sE € à €DÜ �—
|
|||
|
|
�
|
|||
|
|
˜2Ó €DØ ÒÜ�zŠz˜$Ó ×&Ñ&Ó(ˆØ �‰˜Ð(:Ô;Ü
|
|||
|
|
�.‰.×
|
|||
|
|
Ñ
|
|||
|
|
¸Ð
|
|||
|
|
Ó
|
|||
|
|
M€Cð&Ü
|
|||
|
|
�^‰^×
|
|||
|
|
#Ñ
|
|||
|
|
# CÐ
|
|||
|
|
#×
|
|||
|
|
9Ô
|
|||
|
|
9¸TØ—)‘)“+ˆCØ—[‘[ˆF÷ :ð=د#”t—z’z #“Ð5Ð5°2Ð5Ð5÷ :×
|
|||
|
|
9ûô �<‰<× !Ñ !ô Ø�f‰f‹hˆØ—‘�ûÜ �L‰L× !Ñ !¤7Ð +ô &Ø�Wœc !›fÐ%Ð%Õ%ûð&ûô ô =ؘ˜sŸz™z°˜zÓ ;Ð<Ð<Ò<ð=úsl Á4(C8  C%Â9C8 ÃE< à E< Ã"E< Ã% C5 Ã0C8 Ã5C8 Ã8 E9Ä D8Ä8&E9Å E9Å E4Å.E9Å4E9Å<!F Æ F c óz € \ P ! V R V 2P 4 4 P 4 pRV 2# )Ú:zBasic )Úbase64Ú b64encoder r$ )ÚloginÚpasswordÚtoks && r+ Ú_basicr4 [ s; € Ü
|
|||
|
|
×
|
|||
|
|
Ò
|
|||
|
|
˜e˜W A h ZÐ0×7Ñ7Ó9Ó
|
|||
|
|
:×
|
|||
|
|
AÑ
|
|||
|
|
AÓ
|
|||
|
|
C€CØ
|
|||
|
|
�C�5ˆ>Ðó c ó` a € ] tR t^dt o R tR t]R 4 tR tR t R t
|
|||
|
|
R t R t R t
|
|||
|
|
R
|
|||
|
|
tV tR # ) Ú LinkServicec óÚ € Wn VR , P R4 V n VP RV P 4 P R4 V n VP RR4 V n R# )Ú
|
|||
|
|
gitea_baseÚ/Úpublic_gitea_baseÚzitadel_userinfoz#https://id.shre.ai/oidc/v1/userinfoN)ÚcfgÚrstripÚgiteaÚgetÚ public_giteaÚ userinfo_url)ÚselfÚconfigs &&r+ Ú__init__ÚLinkService.__init__e s[ € ØŒð ˜LÕ)×0Ñ0°Ó5ˆŒ
|
|||
|
|
Ø "ŸJ™JÐ':¸D¿J¹JÓ G× NÑ NÈsÓ SˆÔØ "ŸJ™JØ Ð Eó GˆÖr5 c ó¤ € \ R V P RRV 2/R7 w r#V^È8w d RRV R23# \ V\ 4 ' d RV9 d R# VR3# ) ÚGETÚ
|
|||
|
|
AuthorizationzBearer ©r Nz&zitadel userinfo rejected token (HTTP Ú)Úsub)Nz zitadel userinfo returned no sub)r, rB Ú
|
|||
|
|
isinstancer )rC Ú access_tokenr Úinfos && r+ Úvalidate_tokenÚLinkService.validate_tokeno sk € Ü Ø �4×$Ñ$Ø$¨° ¨~Ð&>Ð?ôA‰ ˆð �SŒ=ØÐAÀ&ÀÈÐKÐKÐ Kܘ$¤×%Ò%¨°dÔ):Ø;Ð ;Ø�TˆzÐr5 c ó` € V P R 4 ;' g RpV' g5 V P R4 ;' g RpVP R^4 ^ , pVP R^4 ^ , p\ P RV4 P R4 P 4 pT;' g R# )Úpreferred_usernameÚ ÚemailÚ@Ú-z-._N)r@ ÚsplitÚ
|
|||
|
|
LOGIN_SAFErL ÚstripÚlower)ÚuserinfoÚcandrU s & r+ Ú derive_loginÚLinkService.derive_loginy sŒ € à�|‰|Ð 0Ó1×7Ð7°RˆßØ —L‘L Ó)×/Ð/¨RˆEØ—;‘;˜s AÓ& qÕ)ˆDØ�z‰z˜#˜qÓ! !Õ$ˆÜ�~‰~˜c 4Ó(×.Ñ.¨uÓ5×;Ñ;Ó=ˆØ�|ˆ|�tÐr5 c ó2 € R RV P R, 2/# )rI útoken Ú admin_token)r= ©rC s &r+ Ú
|
|||
|
|
_admin_hdrÚLinkService._admin_hdr„ s € Ø 6¨$¯(©(°=Õ*AÐ)BÐ!CÐDÐDr5 c óf € \ R V P RV 2V P 4 R7 w r#V^È8H # )rH ú/api/v1/users/rJ )r, r? rd )rC r1 r Ú_s && r+ Ú user_existsÚLinkService.user_exists‡ s6 € Ü Ø �d—j‘j�\ °¨wÐ7ÀÇ Á ÓARôT‰ ˆà˜‰}Ð r5 c óˆ a€ \ P \ P , oR P V3R l\ ^ 4 4 4 pVP R4 ;' g V R2pRVRVRVRRRR R
|
|||
|
|
VP R R 4 /p\
|
|||
|
|
R V P R
|
|||
|
|
2V P 4 VR7 w rgV^É8w d RV RV 2# R# )rT c 3 óP <" € T F p\ P ! S4 x € K R # 5i)N)ÚsecretsÚchoice)Ú.0rh Ú pw_alphabets & €r+ Ú <genexpr>Ú*LinkService.create_user.<locals>.<genexpr>Ž s øé € ÐJÁ ¸1œ7Ÿ>š>¨+×6Ð6à ùs ƒ#&rU z @users.noreply.granthi.shre.aiÚusernamer2 Úmust_change_passwordFÚ
|
|||
|
|
visibilityÚprivateÚ full_nameÚnameÚPOSTz/api/v1/admin/users©r r& z%gitea admin user create failed (HTTP ú): N) ÚstringÚ
|
|||
|
|
ascii_lettersÚdigitsÚjoinÚranger@ r, r? rd ) rC r1 r\ r2 rU r& r r) rp s &&& @r+ Ú create_userÚLinkService.create_userŒ sÇ ø€ Ü ×*Ñ*¬V¯]©]Õ:ˆ Ø—7‘7ÔJÄÀbÄ ÓJÓJˆØ— ‘ ˜WÓ%×QÐQ¨E¨7Ð2PÐ)Qˆà ˜Ø �UØ ˜Ø " EØ ˜)Ø ˜Ÿ ™ f¨bÓ1ð
|
|||
|
|
|
|||
|
|
ˆô !Ø �t—z‘z�lÐ"5Ð6Ø—O‘OÓ%¨Dô2‰ ˆð �SŒ=Ø:¸6¸(À#ÀdÀVÐLÐ LÙr5 c
|
|||
|
|
óÐ € \ P RT;' g R4 R, pRP V\ P ! \
|
|||
|
|
P 4 P R4 4 p\ RV P RV R2R \ V P R
|
|||
|
|
, V P R , 4 R V/R
|
|||
|
|
VRRR./R7 w rVV^É8w d RRRV RV 23# VP R4 VR3# )zwAdmin basic auth + Sudo header. Verified on Gitea 1.27.1:
|
|||
|
|
token-auth sudo (header or ?sudo=) -> 401; basic+Sudo -> 201.rW Údevice:Né( Nzgranthi-sync-{}-{}z%Y%m%dT%H%M%SZry rg z/tokensrI Ú admin_loginÚadmin_passwordÚSudorx Úscopeszwrite:repositoryz
|
|||
|
|
write:userrz Nztoken mint failed (HTTP r{ Úsha1)
|
|||
|
|
rY rL Úformatr Únowr ÚutcÚstrftimer, r? r4 r= r@ )rC r1 Ú device_nameÚsafe_devÚ
|
|||
|
|
token_namer r) s &&& r+ Ú
|
|||
|
|
mint_tokenÚLinkService.mint_token sò € ô —>‘> # {×'>Ð'>°hÓ?ÀÕDˆØ)×0Ñ0Ø ”h—l’l¤8§<¡<Ó0×9Ñ9Ð:JÓKóMˆ
|
|||
|
|
ä Ø �t—z‘z�l .°°°wÐ?à ¤Ø—H‘H˜]Õ+¨T¯X©XÐ6FÕ-Gó"Ià˜ðð
|
|||
|
|
˜*ØÐ /° Ð >ð@ôA‰ ˆð �SŒ=ؘÐ!9¸&¸ÀÀTÀFÐ KÐKÐ KØ�x‰x˜Ó ¨TÐ1Ð1r5 c óô € VP R 4 ;' g RpV P P R4 ' dE \ VP R4 \ 4 ' d \ P R4 VR, pM@VP R4 pV' g RRR/3# V P
|
|||
|
|
V4 w r5V' d R RV/3# V P V4 pV' g R
|
|||
|
|
RR /3# V P V4 ' g6 V P Wc4 pV' d R RV/3# \ P R
|
|||
|
|
V4 V P Wb4 w rxpV' d R RV/3# \ P RW†4 ^ÈRV P RVRVRV/3# )r� r„ Ú test_modeÚ
|
|||
|
|
test_userinfoz)TEST-MODE link request (stubbed userinfo)Úzitadel_access_tokené� r z zitadel_access_token requiredi‘ i¦ z&could not derive a login from userinfoéö zcreated gitea user %szminted token %s for %sr9 r1 Útokenr‘ )
|
|||
|
|
r@ r= rM r ÚLOGÚwarningrP r^ ri r� rO r’ rA ) rC r& r� r\ rš Úerrr1 Ú gitea_tokenr‘ s && r+ ÚlinkÚLinkService.link´ sd € Ø—h‘h˜}Ó-×9Ð9°ˆ Ø �8‰8�<‰<˜ × $Ò $¬°D·H±H¸_Ó4MÌt×)TÒ)TÜ �K‰KÐCÔ DؘOÕ,‰Hà—H‘HÐ 3Ó4ˆEßؘWÐ&EÐ FÐFÐFØ × /Ñ /°Ó 6‰MˆHßؘW c˜NÐ*Ð*Ø×!Ñ! (Ó+ˆßؘÐ"JÐKÐKÐ KØ× Ñ ×&Ò&Ø×"Ñ" 5Ó3ˆCßؘW c˜NÐ*Ð*Ü �H‰HÐ,¨eÔ 4Ø'+§¡°uÓ'JÑ$ˆ ß Ø˜ #˜Ð&Ð &Ü �‰Ð)¨:Ô=Ø�\ 4×#4Ñ#4°g¸uØ ˜k¨<¸ðEð Eð Er5 c óü € VP R 4 pVP R4 pV' d V' g RRR/3# \ RV P R2RRV 2/RVR \ VP R R
|
|||
|
|
4 4 R R R
|
|||
|
|
R/R7 w rEVR8X d RRRV R2/3# V^É8w d
|
|||
|
|
RRRV RV 2/3# VP RR4 p^ÈRVP R4 RVR VP R 4 RV P RV R2RV P RV 2/3# ) rš rx r˜ r ztoken and name requiredry z/api/v1/user/reposrI ra rv TÚdefault_branchÚmainÚ auto_initFrz i™ zrepo z already existsr™ zrepo create failed (HTTP r{ rw rT Ú clone_urlr: z.gitÚhtml_url)r@ r, r? ÚboolrA )rC r& rš rx r r) rw s && r+ ÚreposÚLinkService.reposÏ sB € Ø—‘˜Ó!ˆØ�x‰x˜Ó ˆßŸDؘÐ";Ð<Ð<Ð <Ü Ø �t—z‘z�lÐ"4Ð5Ø$¨¨u¨gÐ&6Ð7ؘ$ ¬4°·±¸ÀDÓ0IÓ+JØ" F¨K¸ð@ôA‰ ˆð
|
|||
|
|
�SŒ=ؘ E¨$¨¨Ð"?Ð@Ð@Ð @Ø �SŒ=ؘÐ$=¸f¸XÀSÈÈÐ"OÐPÐPÐ PØ—H‘H˜[¨"Ó-ˆ ØØ �D—H‘H˜VÓ$ k°9Ø �t—x‘x Ó*Ø ˜D× -Ñ -Ð.¨a° ¨{¸$Ð?Ø ˜4×,Ñ,Ð-¨Q¨y¨kÐ:ð
|
|||
|
|
ð
|
|||
|
|
ð
|
|||
|
|
r5 )r= r? rA rB N)Ú__name__Ú
|