swf-remote/scripts/issue_teamcomms_service_tokens.py

0001 #!/usr/bin/env python3
0002 """Issue program/connector tokens through existing account login and token UI."""
0003
0004 import argparse
0005 import json
0006 import os
0007 from pathlib import Path
0008 import stat
0009
0010 import httpx
0011 from check_teamcomms import issue, login
0012
0013
0014 def main():
0015     parser = argparse.ArgumentParser(description=__doc__)
0016     parser.add_argument('--base', default='https://epic-devcloud.org/prod')
0017     parser.add_argument('--credentials', type=Path, default=Path('/home/admin/.swf-remote-claude-ec2dev.env'))
0018     parser.add_argument('--output-dir', type=Path, required=True)
0019     args = parser.parse_args()
0020     directory = args.output_dir.expanduser().resolve()
0021     directory.mkdir(mode=0o700, parents=True, exist_ok=True)
0022     info = directory.stat()
0023     if info.st_uid != os.getuid() or stat.S_IMODE(info.st_mode) & 0o077:
0024         raise ValueError('Output directory must be private and owned by this user')
0025     for name in ('program-token', 'connector-token', 'token-records.json'):
0026         if (directory / name).exists():
0027             raise ValueError('Output already exists; retain existing tokens or choose a new directory')
0028     records = {}
0029     with httpx.Client(follow_redirects=True, timeout=35) as client:
0030         login(client, args.base, args.credentials)
0031         for kind in ('program', 'connector'):
0032             raw, token_id = issue(client, args.base + '/account/tokens/', ai=False, service_kind=kind)
0033             path = directory / (kind + '-token')
0034             fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
0035             with os.fdopen(fd, 'w') as stream:
0036                 stream.write(raw + '\n')
0037             records[kind] = {'token_id': token_id, 'file': str(path)}
0038             # Retain revocation references even if later issuance fails.
0039             record_path = directory / 'token-records.json'
0040             fd = os.open(record_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
0041             with os.fdopen(fd, 'w') as stream:
0042                 json.dump(records, stream, indent=2)
0043             print(f'Issued {kind} token into private file {path}')
0044
0045
0046 if __name__ == '__main__':
0047     main()