PTSIP 0.3.1__py3-none-any.whl

ptsip/__init__.py

@@ -0,0 +1,3 @@
+"""PTSIP reference development tooling."""
+
+__version__ = "0.2.0"

ptsip/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

ptsip/app/__init__.py

@@ -0,0 +1,5 @@
+from .client import ControlPlaneClient, ControlPlaneError
+from .service import DecisionService
+from .store import DecisionRecord, DecisionStore
+
+__all__ = ["ControlPlaneClient", "ControlPlaneError", "DecisionRecord", "DecisionService", "DecisionStore"]

ptsip/app/client.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.request
+from typing import Any
+
+
+class ControlPlaneError(RuntimeError):
+    pass
+
+
+class ControlPlaneClient:
+    def __init__(self, base_url: str | None = None, token: str | None = None):
+        self.base_url = (base_url or os.environ.get("PTSIP_CONTROL_PLANE_URL") or "").rstrip("/")
+        self.token = token or os.environ.get("PTSIP_CONTROL_PLANE_TOKEN")
+        if not self.base_url:
+            raise ControlPlaneError("PTSIP control plane URL is not configured; use --control-plane or PTSIP_CONTROL_PLANE_URL")
+        if not self.token:
+            raise ControlPlaneError("PTSIP_CONTROL_PLANE_TOKEN is required")
+
+    def _post(self, path: str, payload: dict[str, Any]) -> dict[str, Any]:
+        request = urllib.request.Request(
+            self.base_url + path,
+            data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
+            method="POST",
+            headers={"Authorization": f"Bearer {self.token}", "Content-Type": "application/json"},
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=30) as response:
+                raw = response.read()
+        except urllib.error.HTTPError as exc:
+            detail = exc.read().decode("utf-8", errors="replace")
+            raise ControlPlaneError(f"Control plane request failed: HTTP {exc.code}: {detail}") from exc
+        except OSError as exc:
+            raise ControlPlaneError(f"Control plane request failed: {exc}") from exc
+        parsed = json.loads(raw.decode("utf-8"))
+        if not isinstance(parsed, dict):
+            raise ControlPlaneError("Control plane returned a non-object response")
+        return parsed
+
+    def gate(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/v1/gate", payload)
+
+    def decision(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/v1/decision", payload)
+
+    def resolve(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/v1/resolve", payload)
+
+    def application(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/v1/application", payload)

ptsip/app/github_client.py

@@ -0,0 +1,200 @@
+from __future__ import annotations
+
+import base64
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass(frozen=True)
+class GitHubIssue:
+    number: int
+    url: str
+
+
+class GitHubAPIError(RuntimeError):
+    pass
+
+
+class GitHubAppClient:
+    def __init__(self, app_id: str | None = None, private_key: str | None = None, api_url: str | None = None):
+        self.app_id = app_id or os.environ.get("PTSIP_GITHUB_APP_ID")
+        configured_key = private_key or os.environ.get("PTSIP_GITHUB_PRIVATE_KEY")
+        key_path = os.environ.get("PTSIP_GITHUB_PRIVATE_KEY_PATH")
+        if configured_key is None and key_path:
+            configured_key = Path(key_path).expanduser().read_text(encoding="utf-8")
+        self.private_key = configured_key
+        self.api_url = (api_url or os.environ.get("PTSIP_GITHUB_API_URL") or "https://api.github.com").rstrip("/")
+        self._tokens: dict[int, tuple[str, float]] = {}
+
+    def _app_jwt(self) -> str:
+        if not self.app_id or not self.private_key:
+            raise GitHubAPIError("GitHub App credentials are not configured")
+        try:
+            import jwt
+        except ImportError as exc:
+            raise GitHubAPIError("PyJWT[crypto] is required for GitHub App authentication; install ptsip[github-app]") from exc
+        now = int(time.time())
+        token = jwt.encode(
+            {"iat": now - 60, "exp": now + 9 * 60, "iss": self.app_id},
+            self.private_key,
+            algorithm="RS256",
+        )
+        return str(token)
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        token: str,
+        payload: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        data = json.dumps(payload).encode("utf-8") if payload is not None else None
+        request = urllib.request.Request(
+            self.api_url + path,
+            data=data,
+            method=method,
+            headers={
+                "Accept": "application/vnd.github+json",
+                "Authorization": f"Bearer {token}",
+                "X-GitHub-Api-Version": "2022-11-28",
+                "Content-Type": "application/json",
+                "User-Agent": "ptsip-github-app/0.3.1",
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=30) as response:
+                raw = response.read()
+        except urllib.error.HTTPError as exc:
+            detail = exc.read().decode("utf-8", errors="replace")
+            raise GitHubAPIError(f"GitHub API {method} {path} failed: HTTP {exc.code}: {detail}") from exc
+        if not raw:
+            return {}
+        parsed = json.loads(raw.decode("utf-8"))
+        if not isinstance(parsed, dict):
+            raise GitHubAPIError("GitHub API returned a non-object response")
+        return parsed
+
+    def repository_installation(self, repository: str) -> int:
+        if repository.count("/") != 1:
+            raise GitHubAPIError("repository must use owner/repository form")
+        owner, repo = repository.split("/", 1)
+        payload = self._request(
+            "GET",
+            f"/repos/{urllib.parse.quote(owner)}/{urllib.parse.quote(repo)}/installation",
+            self._app_jwt(),
+        )
+        installation_id = payload.get("id")
+        if not isinstance(installation_id, int):
+            raise GitHubAPIError("GitHub did not return a repository installation id")
+        return installation_id
+
+    def installation_token(self, installation_id: int) -> str:
+        cached = self._tokens.get(installation_id)
+        now = time.time()
+        if cached and cached[1] - 60 > now:
+            return cached[0]
+        payload = self._request(
+            "POST",
+            f"/app/installations/{installation_id}/access_tokens",
+            self._app_jwt(),
+            {},
+        )
+        token = str(payload.get("token", ""))
+        if not token:
+            raise GitHubAPIError("GitHub did not return an installation token")
+        self._tokens[installation_id] = (token, now + 50 * 60)
+        return token
+
+    def create_issue(self, repository: str, installation_id: int, title: str, body: str) -> GitHubIssue:
+        token = self.installation_token(installation_id)
+        payload = self._request("POST", f"/repos/{repository}/issues", token, {"title": title, "body": body})
+        return GitHubIssue(int(payload["number"]), str(payload["html_url"]))
+
+    def update_issue_state(self, repository: str, installation_id: int, issue_number: int, state: str) -> None:
+        token = self.installation_token(installation_id)
+        self._request("PATCH", f"/repos/{repository}/issues/{issue_number}", token, {"state": state})
+
+    def add_issue_comment(self, repository: str, installation_id: int, issue_number: int, body: str) -> None:
+        token = self.installation_token(installation_id)
+        self._request("POST", f"/repos/{repository}/issues/{issue_number}/comments", token, {"body": body})
+
+    def permission(self, repository: str, installation_id: int, username: str) -> str:
+        token = self.installation_token(installation_id)
+        payload = self._request(
+            "GET", f"/repos/{repository}/collaborators/{urllib.parse.quote(username)}/permission", token
+        )
+        return str(payload.get("permission", "none"))
+
+    def branch_head(self, repository: str, installation_id: int, branch: str) -> str:
+        token = self.installation_token(installation_id)
+        encoded = urllib.parse.quote(branch, safe="")
+        payload = self._request("GET", f"/repos/{repository}/git/ref/heads/{encoded}", token)
+        obj = payload.get("object")
+        if not isinstance(obj, dict) or not obj.get("sha"):
+            raise GitHubAPIError("GitHub branch ref did not contain a SHA")
+        return str(obj["sha"])
+
+    def file_text(self, repository: str, installation_id: int, path: str, ref: str) -> str | None:
+        token = self.installation_token(installation_id)
+        encoded_path = "/".join(urllib.parse.quote(part) for part in path.split("/"))
+        try:
+            payload = self._request(
+                "GET",
+                f"/repos/{repository}/contents/{encoded_path}?ref={urllib.parse.quote(ref, safe='')}",
+                token,
+            )
+        except GitHubAPIError as exc:
+            if "HTTP 404" in str(exc):
+                return None
+            raise
+        content = payload.get("content")
+        if not isinstance(content, str):
+            return None
+        return base64.b64decode(content.encode("ascii")).decode("utf-8-sig")
+
+    def commit_file_at_parent(
+        self,
+        repository: str,
+        installation_id: int,
+        branch: str,
+        parent_sha: str,
+        path: str,
+        content: str,
+        message: str,
+    ) -> str:
+        token = self.installation_token(installation_id)
+        parent = self._request("GET", f"/repos/{repository}/git/commits/{parent_sha}", token)
+        tree = parent.get("tree")
+        if not isinstance(tree, dict) or not tree.get("sha"):
+            raise GitHubAPIError("Parent commit did not contain a tree SHA")
+        created_tree = self._request(
+            "POST",
+            f"/repos/{repository}/git/trees",
+            token,
+            {
+                "base_tree": str(tree["sha"]),
+                "tree": [{"path": path, "mode": "100644", "type": "blob", "content": content}],
+            },
+        )
+        commit = self._request(
+            "POST",
+            f"/repos/{repository}/git/commits",
+            token,
+            {"message": message, "tree": str(created_tree["sha"]), "parents": [parent_sha]},
+        )
+        commit_sha = str(commit["sha"])
+        encoded_branch = urllib.parse.quote(branch, safe="")
+        self._request(
+            "PATCH",
+            f"/repos/{repository}/git/refs/heads/{encoded_branch}",
+            token,
+            {"sha": commit_sha, "force": False},
+        )
+        return commit_sha

ptsip/app/server.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any
+
+from .github_client import GitHubAppClient
+from .service import DecisionService
+from .store import DecisionStore
+
+MAX_REQUEST_BYTES = 1024 * 1024
+
+
+class _Handler(BaseHTTPRequestHandler):
+    server_version = "PTSIPControlPlane/0.3.1"
+
+    @property
+    def service(self) -> DecisionService:
+        return self.server.service  # type: ignore[attr-defined]
+
+    @property
+    def agent_token(self) -> str:
+        return self.server.agent_token  # type: ignore[attr-defined]
+
+    @property
+    def webhook_secret(self) -> bytes:
+        return self.server.webhook_secret  # type: ignore[attr-defined]
+
+    def _json(self, code: int, payload: dict[str, object]) -> None:
+        raw = json.dumps(payload, ensure_ascii=False).encode("utf-8")
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+
+    def _body(self) -> bytes:
+        length = int(self.headers.get("Content-Length", "0"))
+        if length < 0 or length > MAX_REQUEST_BYTES:
+            raise ValueError("request body is too large")
+        return self.rfile.read(length)
+
+    def _authorized(self) -> bool:
+        header = self.headers.get("Authorization", "")
+        return bool(self.agent_token) and hmac.compare_digest(header, f"Bearer {self.agent_token}")
+
+    def do_GET(self) -> None:
+        if self.path == "/healthz":
+            self._json(200, {"status": "ok", "service": "ptsip-control-plane", "version": "0.3.1"})
+            return
+        self._json(404, {"error": "not found"})
+
+    def do_POST(self) -> None:
+        try:
+            raw = self._body()
+            if self.path == "/github/webhook":
+                signature = self.headers.get("X-Hub-Signature-256", "")
+                expected = "sha256=" + hmac.new(self.webhook_secret, raw, hashlib.sha256).hexdigest()
+                if not self.webhook_secret or not hmac.compare_digest(signature, expected):
+                    self._json(401, {"error": "invalid webhook signature"})
+                    return
+                payload = json.loads(raw.decode("utf-8"))
+                if not isinstance(payload, dict):
+                    raise ValueError("webhook payload must be an object")
+                event = self.headers.get("X-GitHub-Event", "")
+                self.service.register_installation_event(payload)
+                result = self.service.issue_comment(payload) if event == "issue_comment" else {"status": "ACCEPTED"}
+                self._json(200, result)
+                return
+
+            if not self._authorized():
+                self._json(401, {"error": "unauthorized"})
+                return
+            payload = json.loads(raw.decode("utf-8"))
+            if not isinstance(payload, dict):
+                raise ValueError("request body must be an object")
+            if self.path == "/v1/gate":
+                self._json(200, self.service.gate(payload))
+            elif self.path == "/v1/decision":
+                self._json(200, self.service.decision(payload))
+            elif self.path == "/v1/resolve":
+                self._json(200, self.service.resolve_agent(payload))
+            elif self.path == "/v1/application":
+                self._json(200, self.service.application(payload))
+            else:
+                self._json(404, {"error": "not found"})
+        except (KeyError, ValueError) as exc:
+            self._json(400, {"error": str(exc)})
+        except Exception as exc:
+            self._json(500, {"error": str(exc)})
+
+    def log_message(self, format: str, *args: Any) -> None:
+        if os.environ.get("PTSIP_APP_QUIET") != "1":
+            super().log_message(format, *args)
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="ptsip-app", description="PTSIP GitHub App decision control plane")
+    parser.add_argument("--host", default=os.environ.get("PTSIP_APP_HOST", "127.0.0.1"))
+    parser.add_argument("--port", type=int, default=int(os.environ.get("PTSIP_APP_PORT", "8080")))
+    parser.add_argument("--db", default=os.environ.get("PTSIP_APP_DB", "ptsip-control-plane.sqlite3"))
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+    agent_token = os.environ.get("PTSIP_CONTROL_PLANE_TOKEN", "")
+    webhook_secret = os.environ.get("PTSIP_GITHUB_WEBHOOK_SECRET", "")
+    if not agent_token:
+        raise SystemExit("PTSIP_CONTROL_PLANE_TOKEN is required")
+    if not webhook_secret:
+        raise SystemExit("PTSIP_GITHUB_WEBHOOK_SECRET is required")
+    store = DecisionStore(Path(args.db))
+    service = DecisionService(store, GitHubAppClient())
+    server = ThreadingHTTPServer((args.host, args.port), _Handler)
+    server.service = service  # type: ignore[attr-defined]
+    server.agent_token = agent_token  # type: ignore[attr-defined]
+    server.webhook_secret = webhook_secret.encode("utf-8")  # type: ignore[attr-defined]
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        pass
+    finally:
+        server.server_close()
+    return 0