laniakea-api-server 0.1.2__tar.gz → 0.2.0__tar.gz

laniakea_api_server-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Riccardo Caccia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/PKG-INFO

@@ -1,11 +1,12 @@
 Metadata-Version: 2.4
 Name: laniakea-api-server
-Version: 0.1.2
+Version: 0.2.0
 Summary: Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration
 Project-URL: Homepage, https://github.com/laniakea/laniakea-api
 Project-URL: Issues, https://github.com/laniakea/laniakea-api/issues
-Author: Laniakea Team
+Author: Riccardo Caccia
 License: MIT
+License-File: LICENSE
 Keywords: aws,cloud,deployment,fastapi,openstack,orchestration,redis
 Classifier: Development Status :: 3 - Alpha
 Classifier: Framework :: FastAPI

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/__init__.py

@@ -2,4 +2,4 @@
 OIDC-authenticated gateway for enqueuing cloud deployment jobs.
 """
 
-__version__ = "0.0.1"
+__version__ = "0.1.4"

laniakea_api_server-0.2.0/laniakea_api/auth.py

@@ -0,0 +1,134 @@
+"""
+Authentication helpers
+
+It is responsible for verifying the identity of those who knock on 
+the server's door distinguishing between two types of users: 
+human users (who pass through an OIDC Sign-in system) and worker agents
+"""
+import time
+import httpx
+import jwt
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from laniakea_api.config import (
+                                 SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
+                                 OIDC_DISCOVERY_URL, AGENT_MASTER_PASSWORD,
+                                )
+
+# Initialize security OAuth2 Bearer Token
+_bearer = HTTPBearer()
+
+async def fetch_userinfo(oidc_token: str) -> dict:
+    """
+    Takes an authentication token provided by a user and asks an external identity server 
+    (the OIDC Provider) who that user actually is, retriving user info
+    """
+    try:
+        # asynchronous HTTP to avoid waste of server resources
+        async with httpx.AsyncClient(timeout=10) as client:
+            # OIDC discovery
+            discovery = await client.get(OIDC_DISCOVERY_URL)    
+            discovery.raise_for_status()                         # status 200: OK
+            userinfo_url = discovery.json()["userinfo_endpoint"] # now final url is known
+            # USER info request
+            resp = await client.get(
+                userinfo_url,
+                headers={"Authorization": f"Bearer {oidc_token}"},
+            )
+        if resp.status_code != 200:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"OIDC userinfo returned {resp.status_code}",
+            )
+        return resp.json()
+    except HTTPException:
+        raise
+    except Exception as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"OIDC validation failed: {exc}",
+        )
+
+
+def create_session_token(user_info: dict) -> tuple:
+    """
+    Querying the external OIDC server for every single request would slow down the API. 
+    To avoid this behaviour, once the user has been verified by fetch_userinfo, this function 
+    generates an internal JWT token:
+ 
+             It takes the user's data (sub, username, email, groups).
+             It adds an expiration date based on the minutes configured in SESSION_TTL_MINUTES.
+             It cryptographically signs everything with a secret key (SECRET_KEY)
+             It returns a compact token that the user will use for subsequent requests.
+    """
+    #NOTE: act here for expiration
+    expires_in = SESSION_TTL_MINUTES * 60
+    now = int(time.time())
+    #NOTE: PAYLOAD 
+    payload = {
+        "sub":      user_info.get("sub"),
+        "username": user_info.get("preferred_username") or user_info.get("sub"),
+        "email":    user_info.get("email"),
+        "groups":   user_info.get("groups", []),
+        "iat":      now,
+        "exp":      now + expires_in,
+    }
+    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM), expires_in
+
+
+async def verify_session_token(credentials: HTTPAuthorizationCredentials = Depends(_bearer),) -> dict:
+    """
+    Check that the HTTP request contains an authorization header.
+    Takes the internal JWT token created in the previous step and checks 
+    whether the signature is authentic (using the SECRET_KEY).
+    """
+    try:
+        return jwt.decode(credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM])
+
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Session token expired",
+        )
+
+    except jwt.InvalidTokenError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Invalid session token: {exc}",
+        )
+
+
+async def verify_agent_token(credentials: HTTPAuthorizationCredentials = Depends(_bearer),) -> str:
+    """
+    This function validates the tokens used by workers.
+    It doesn't use the user's key, but a dedicated secret key 
+    called AGENT_MASTER_PASSWORD.
+    If the worker sends a valid token signed with this master password, 
+    the API trusts the worker and allows it to fetch or update the status of deployment jobs.
+
+    HTCondor pool-password like.
+    """
+    if not AGENT_MASTER_PASSWORD:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="AGENT_MASTER_PASSWORD not configured, set it as an ambient variable or in the .env",
+        )
+    try:
+        payload = jwt.decode(
+            credentials.credentials,
+            AGENT_MASTER_PASSWORD,
+            algorithms=["HS256"],
+        )
+        # NOTE: unknown-agent default value
+        return payload.get("sub", "unknown-agent")
+
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Agent token expired.",
+        )
+    except jwt.InvalidTokenError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Invalid agent token: {exc}",
+        )

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/cli.py

@@ -1,5 +1,5 @@
 """
-after pip install laniakea-api-server, the user throw:
+after pip install laniakea-api-server, the user can throw:
     laniakea-api
     laniakea-api --port 8000          # HTTP, no TLS (test)
     laniakea-api --port 8443 --ssl    # HTTPS con TLS
@@ -12,14 +12,19 @@ import sys
 
 
 def main():
+    """
+    Which option is accepted in the cli
+    """
     parser = argparse.ArgumentParser(
         prog="laniakea-api",
         description="Laniakea Queue API server.",
     )
+    
     parser.add_argument("--host",    default="0.0.0.0",  help="Bind host (default: 0.0.0.0)")
     parser.add_argument("--port",    default=8443, type=int, help="Bind port (default: 8443)")
     parser.add_argument("--env",     default=".env", metavar="FILE", help="Path to .env file")
     parser.add_argument("--ssl",     action="store_true", help="Enable TLS (requires SSL_KEYFILE and SSL_CERTFILE in .env)")
+    #FIXME: reload to be mantained? 
     parser.add_argument("--reload",  action="store_true", help="Enable auto-reload (development only)")
     parser.add_argument("--version", action="store_true", help="Print version and exit.")
     args = parser.parse_args()
@@ -30,15 +35,17 @@ def main():
         sys.exit(0)
 
     # load .env
+    # NOTE: if .env not specified local ambient variable are used
     env_path = os.path.abspath(args.env)
     if os.path.exists(env_path):
         from dotenv import load_dotenv
         load_dotenv(env_path)
         print(f"[config] loaded {env_path}")
     else:
-        print(f"[config] .env not found at {env_path} — using environment variables")
+        print(f"[config] .env not found at {env_path}... using environment variables")
 
     # validate required env vars
+    # NOTE: Check if all required vars
     required = [
         "SECRET_KEY", "AGENT_MASTER_PASSWORD",
         "REDIS_HOST", "REDIS_PASSWORD",
@@ -48,24 +55,26 @@ def main():
     ]
     missing = [v for v in required if not os.getenv(v)]
     if missing:
-        print(f"[error] missing required environment variables: {', '.join(missing)}")
+        print(f"[error] missing required variables: {', '.join(missing)}")
         sys.exit(1)
 
-    # create log dir if needed
+    # FIXME: check if the destination for this dir is ok
+    # create a log dir
     log_dir = os.getenv("DEPLOYMENT_LOG_DIR", "/var/log/laniakea-agent")
     os.makedirs(log_dir, exist_ok=True)
 
     import uvicorn
 
     uvicorn_kwargs = dict(
-        app="laniakea_api.main:app",
+        app="laniakea_api.main:app",  # App instance in the main file
         host=args.host,
         port=args.port,
         log_level="info",
-        reload=args.reload,
+        reload=args.reload,           # NOTE: To be removed if argparse removed
     )
 
     if args.ssl:
+        # if ssl option specified searches for SSL certificates and private key
         ssl_key  = os.getenv("SSL_KEYFILE",  "certs/api.key")
         ssl_cert = os.getenv("SSL_CERTFILE", "certs/api.crt")
         if not os.path.exists(ssl_key) or not os.path.exists(ssl_cert):
@@ -77,6 +86,7 @@ def main():
     else:
         print(f"[api] HTTP on {args.host}:{args.port} (no TLS)")
 
+    # Starting the application
     uvicorn.run(**uvicorn_kwargs)
 
 

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/config.py

@@ -1,5 +1,5 @@
 """
-Import the .env
+Import the .env vars
 Inizialize all the service: Redis, Vault, Posgre
 """
 
@@ -17,7 +17,7 @@ AGENT_MASTER_PASSWORD = os.getenv("AGENT_MASTER_PASSWORD", "")
 
 # Redis
 REDIS_HOST     = os.getenv("REDIS_HOST", "")
-# NOTE: Idk port
+# NOTE: mod. port
 REDIS_PORT     = int(os.getenv("REDIS_PORT", "1908"))
 REDIS_PASSWORD = os.getenv("REDIS_PASSWORD", "")
 

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/credential_parser.py

@@ -27,7 +27,8 @@ except ImportError:
     HAS_YAML = False
 
 # RC file parser
-# Maps RC env var names needed for internal credential field names
+# This dictionary is used to translate the names of standard OpenStack variables (left) 
+# into the internal names used by the Laniakea database and APIs (right).
 _RC_FIELD_MAP = {
     "OS_AUTH_URL":                      "openstack_auth_url",
     "OS_APPLICATION_CREDENTIAL_ID":     "openstack_app_credential_id",
@@ -44,7 +45,9 @@ def _parse_rc_file(path: Path) -> dict:
         export OS_APPLICATION_CREDENTIAL_ID=abc123
     """
     result = {}
-    # matches: export KEY=value or KEY=value (with optional ecport and quotes)
+    # matches: export KEY=value or KEY=value
+    # This regex can clean up and capture lines whether they are written as export KEY="value", 
+    # or as KEY='value' or simply KEY=value.
     pattern = re.compile(r"""^\s*(?:export\s+)?(\w+)=["\']?([^"\';\n]*)["\']?\s*$""")
 
     for line in path.read_text().splitlines():
@@ -58,14 +61,11 @@ def _parse_rc_file(path: Path) -> dict:
             result[field] = value
     return result
 
-#clouds.yaml parser
-
 def _parse_clouds_yaml(path: Path, cloud_name: Optional[str] = None) -> dict:
     """
     Parse a clouds.yaml file.
     If cloud_name is None and there is only one cloud entry, use that one.
-    """
-    # NOTE: put it in the requirement 
+    """ 
     if not HAS_YAML:
         raise ImportError("PyYAML is required to parse clouds.yaml. Run: pip install pyyaml")
 
@@ -76,8 +76,7 @@ def _parse_clouds_yaml(path: Path, cloud_name: Optional[str] = None) -> dict:
         raise ValueError("No 'clouds' section found in the file.")
 
     # auto-select if only one cloud
-    # if user hasn't specifyed with parser
-    # NOTE: to be removed outside test 
+    # if user hasn't specifyed with parser 
     if cloud_name is None:
         if len(clouds) == 1:
             cloud_name = next(iter(clouds))
@@ -96,7 +95,7 @@ def _parse_clouds_yaml(path: Path, cloud_name: Optional[str] = None) -> dict:
     result = {}
 
     # auth block
-    # add fields to the result
+    # NOTE: add fields to the result
     if auth.get("auth_url"):
         result["openstack_auth_url"] = auth["auth_url"]
     if auth.get("application_credential_id"):
@@ -109,11 +108,8 @@ def _parse_clouds_yaml(path: Path, cloud_name: Optional[str] = None) -> dict:
         result["openstack_interface"] = entry["interface"]
     if entry.get("identity_api_version"):
         result["openstack_identity_api_version"] = str(entry["identity_api_version"])
-
     return result
 
-# Public API
-
 def parse_credential_file(path: str, cloud_name: Optional[str] = None) -> dict:
     """
     Auto-detect file type (.sh / .yaml / .yml) and return a dict of credentials.
@@ -137,7 +133,7 @@ def parse_credential_file(path: str, cloud_name: Optional[str] = None) -> dict:
     elif suffix in (".sh", ".env", ""):
         creds = _parse_rc_file(p)
     else:
-        # try RC first, fall back to YAML
+        # ambiguous suffix: try RC first, fall back to YAML
         try:
             creds = _parse_rc_file(p)
             if not creds:

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/database.py

@@ -1,6 +1,8 @@
 """
 PostgreSQL connection.
-The agent has NO direct DB access, **all writes go through the API**
+The agent has NO direct DB access:
+                  **all writes go through the API**
+The Dashboard is stateless.
 """
 
 import os
@@ -35,6 +37,8 @@ def create_deployment(
     conn = get_conn()
     try:
         with conn.cursor() as cur:
+            # If the user making the request doesn't yet exist in the local database, it inserts them. 
+            #if they already exist (subprimary key conflict), it does nothing.
             cur.execute(
                 """
                 INSERT INTO users (sub, username, email, role, active)
@@ -43,6 +47,8 @@ def create_deployment(
                 """,
                 (user_sub, username, ""),
             )
+            #Create a row in the deployments table with the initial state set to "QUEUED." 
+            # if, by chance, that UUID already exists, simply update the state and date.
             cur.execute(
                 """
                 INSERT INTO deployments (
@@ -69,6 +75,8 @@ def update_status(
     conn = get_conn()
     try:
         with conn.cursor() as cur:
+            # COALESCE causes the database to keep old value already present 
+            # without overwriting them with an empty value.
             cur.execute(
                 """
                 UPDATE deployments

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/installer.py

@@ -16,6 +16,11 @@ import sys
 
 
 def _add_to_path():
+    """
+    This function opens your Bash shell configuration file (~/.bashrc).
+    It checks whether the ~/.local/bin folder is already present. If it isn't, 
+    it adds the following line to the bottom of the file: export PATH=$HOME/.local/bin:$PATH
+    """
     bashrc = os.path.expanduser("~/.bashrc")
     line = 'export PATH=$HOME/.local/bin:$PATH'
 
@@ -33,26 +38,34 @@ def _add_to_path():
 
 
 def _create_workdir(workdir: str):
+    """
+    Create the main folder where the application will run (by default, ~/laniakea-api) 
+    and create a certs subfolder within it to host future (optional) SSL certificates.
+    
+    The most important part is generating the .env file. If the file doesn't already exist, it will 
+    be created using the default values managed in the CONFIG.py
+    """
     os.makedirs(workdir, exist_ok=True)
     os.makedirs(os.path.join(workdir, "certs"), exist_ok=True)
 
     env_path = os.path.join(workdir, ".env")
     if os.path.exists(env_path):
-        print(f"[workdir] .env already exists — skip")
+        print(f"[workdir] .env already exists... skipping the creation")
     else:
+        # NOTE: MOD. HERE THE TEMPLATE
         template = """\
 # ── Auth ──────────────────────────────────────────────────────────────────────
 # Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=
 SESSION_TTL_MINUTES=60
-OIDC_DISCOVERY_URL=https://iam.recas.ba.infn.it/.well-known/openid-configuration
+OIDC_DISCOVERY_URL=https://example.it/.well-known/openid-configuration
 
 # ── Agent pool password (must match the agent .env) ───────────────────────────
 AGENT_MASTER_PASSWORD=
 
 # ── Redis ─────────────────────────────────────────────────────────────────────
 REDIS_HOST=127.0.0.1
-REDIS_PORT=1908
+REDIS_PORT=
 REDIS_PASSWORD=
 
 # ── PostgreSQL ────────────────────────────────────────────────────────────────
@@ -83,20 +96,28 @@ DEPLOYMENT_LOG_DIR=/var/log/laniakea-agent
 
 
 def _create_log_dir():
+    """
+    The API and agents need to write deployment logs to /var/log/laniakea-agent.
+    The script create this system folder if needed.
+    """
     log_dir = "/var/log/laniakea-agent"
     if os.path.exists(log_dir):
-        print(f"[logs] {log_dir} already exists — skip")
+        print(f"[logs] {log_dir} already exists... skipping the creation")
         return
     try:
         os.makedirs(log_dir, exist_ok=True)
         os.chown(log_dir, os.getuid(), os.getgid())
         print(f"[logs] log directory created: {log_dir}")
     except PermissionError:
-        print(f"[logs] insufficient permissions — please run:")
+        print(f"[logs] insufficient permissions! Please run:")
         print(f"       sudo mkdir -p {log_dir} && sudo chown $USER:$USER {log_dir}")
 
 
 def main():
+    """
+    Once the installation is completed this function print
+    a guide for the user.
+    """
     parser = argparse.ArgumentParser(
         prog="laniakea-api-install",
         description="Initial setup of the VM for laniakea-api-server.",
@@ -114,6 +135,7 @@ def main():
     _create_log_dir()
     _create_workdir(args.workdir)
 
+    # FIXME: implement a guide for certifacete (non-self-signed)
     print(f"""
 === Setup completed ===
 

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/main.py

@@ -1,5 +1,8 @@
 """
-Registers all routers and starts uvicorn
+Registers all routers and starts uvicorn.
+
+Create the FastAPI application instance and map the various groups of 
+endpoints (the "routers") to their respective URL addresses (the "prefixes").
 """
 
 import os
@@ -8,11 +11,11 @@ from fastapi import FastAPI
 from laniakea_api.routers import agent, agents,credentials, deployments, health
 
 # FastAPI App
-
 app = FastAPI(
     title="Laniakea Queue API",
     description="OIDC-authenticated gateway for enqueuing cloud deployment jobs.",
-    version="1.4.0",
+    # FIXME: automatizza versione
+    version="0.1.4",
 )
 
 # NOTE: CHANGE HERE for path
@@ -24,8 +27,8 @@ app.include_router(credentials.router, prefix=BASE)
 app.include_router(deployments.router, prefix=BASE)
 app.include_router(agent.router, prefix=INTERNAL)
 app.include_router(agents.router, prefix=INTERNAL)   # POST /internal/agents/heartbeat
-app.include_router(agents.router, prefix=BASE)        # GET /api/agents/status
-app.include_router(health.router)       # /health:no prefix
+app.include_router(agents.router, prefix=BASE)       # GET /api/agents/status
+app.include_router(health.router)                    # /health:no prefix
 
 ############ Routes registered ############################
 #NOTE: Add or remove every new modification
@@ -47,6 +50,7 @@ app.include_router(health.router)       # /health:no prefix
 #   GET    /health
 
 # Entry point uvicorn 
+# skipped
 if __name__ == "__main__":
     uvicorn.run(
         "main:app",

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/models.py

@@ -1,5 +1,7 @@
 """
-all Pydantic models used across the api.
+All Pydantic models used across the api.
+
+Defines the data structure of everything that enters/exits from the API 
 """
 
 from typing import Optional
@@ -9,13 +11,14 @@ from pydantic import BaseModel
 class OIDCLoginRequest(BaseModel):
     """
     Only the aai token is needed.
+    From idp.
     """
     oidc_token: str
 
 
 class SessionTokenResponse(BaseModel):
     """
-    If the token check is OK returns:
+    If the token check is OK returns a JWT containing:
     """
     session_token: str
     token_type:    str = "bearer" # checks if the user has the correct permission
@@ -55,7 +58,7 @@ class DeploymentRequest(BaseModel):
     """
     deployment_uuid:   str    # NOTE: the dashboard needs to create a uuid for each job
     timestamp:         str
-    description:       str    # optional or mandatory? check teams
+    description:       str    # NOTE: optional or mandatory? check teams
     auth:              dict   # { aai_token, sub, group }
     orchestrator:      dict   # target_provider, desired_orchestrator, endpoint
     selected_provider: str    # OpenStack | AWS

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/routers/agent.py

@@ -21,7 +21,7 @@ def _validate_transition(current: str, new_status: str, uuid: str) -> None:
     """
     allowed = {
         "QUEUED":              {"CREATE_IN_PROGRESS", "UPDATE_IN_PROGRESS"},
-        "CREATE_IN_PROGRESS":  {"CREATE_COMPLETE", "CREATE_FAILED"},
+        "CREATE_IN_PROGRESS":  {"CREATE_COMPLETE", "CREATE_FAILED", "QUEUED"},
         "UPDATE_IN_PROGRESS":  {"UPDATE_FAILED"},
         "CREATE_COMPLETE":     set(),
         "CREATE_FAILED":       set(),

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/laniakea_api/routers/agents.py

@@ -26,6 +26,7 @@ class QuotaInfo(BaseModel):
     floating_ips_available: Optional[int] = None
 
 
+# NOTE: is it ok every 30 sec? 
 class HeartbeatRequest(BaseModel):
     """
     Sent by the agent every 30 seconds
@@ -53,7 +54,7 @@ async def agent_heartbeat(
 ):
     """
     Called by laniakea-agent every 30 seconds.
-    Stores the agent's quota info in Redis with a 60-second TTL.
+    Stores the agent's quota info in Redis with a 60 second TTL.
     If the agent stops sending heartbeats, the key expires and the
     dashboard shows the agent as offline.
     """

{laniakea_api_server-0.1.2 → laniakea_api_server-0.2.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "laniakea-api-server"
-version = "0.1.2"
+version = "0.2.0"
 description = "Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration"
 readme = "README.md"
 license = { text = "MIT" }
 requires-python = ">=3.10"
 
 authors = [
-  { name = "Laniakea Team" }
+  { name = "Riccardo Caccia" }
 ]
 
 keywords = ["cloud", "deployment", "openstack", "aws", "fastapi", "redis", "orchestration"]

laniakea_api_server-0.1.2/laniakea_api/auth.py

@@ -1,103 +0,0 @@
-"""
-Authentication helpers.
-"""
-import time
-import httpx
-import jwt
-from fastapi import Depends, HTTPException, status
-from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from laniakea_api.config import (
-    SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
-    OIDC_DISCOVERY_URL, AGENT_MASTER_PASSWORD,
-)
-
-_bearer = HTTPBearer()
-
-
-async def fetch_userinfo(oidc_token: str) -> dict:
-    try:
-        async with httpx.AsyncClient(timeout=10) as client:
-            discovery = await client.get(OIDC_DISCOVERY_URL)
-            discovery.raise_for_status()
-            userinfo_url = discovery.json()["userinfo_endpoint"]
-            resp = await client.get(
-                userinfo_url,
-                headers={"Authorization": f"Bearer {oidc_token}"},
-            )
-        if resp.status_code != 200:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"OIDC userinfo returned {resp.status_code}",
-            )
-        return resp.json()
-    except HTTPException:
-        raise
-    except Exception as exc:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"OIDC validation failed: {exc}",
-        )
-
-
-def create_session_token(user_info: dict) -> tuple:
-    expires_in = SESSION_TTL_MINUTES * 60
-    now = int(time.time())
-    payload = {
-        "sub":      user_info.get("sub"),
-        "username": user_info.get("preferred_username") or user_info.get("sub"),
-        "email":    user_info.get("email"),
-        "groups":   user_info.get("groups", []),
-        "iat":      now,
-        "exp":      now + expires_in,
-    }
-    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM), expires_in
-
-
-async def verify_session_token(
-    credentials: HTTPAuthorizationCredentials = Depends(_bearer),
-) -> dict:
-    try:
-        return jwt.decode(
-            credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM]
-        )
-    except jwt.ExpiredSignatureError:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Session token expired.",
-        )
-    except jwt.InvalidTokenError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"Invalid session token: {exc}",
-        )
-
-
-async def verify_agent_token(
-    credentials: HTTPAuthorizationCredentials = Depends(_bearer),
-) -> str:
-    """
-    Validates the agent JWT signed with AGENT_MASTER_PASSWORD.
-    HTCondor pool-password model — one shared secret for all agents.
-    """
-    if not AGENT_MASTER_PASSWORD:
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail="AGENT_MASTER_PASSWORD not configured.",
-        )
-    try:
-        payload = jwt.decode(
-            credentials.credentials,
-            AGENT_MASTER_PASSWORD,
-            algorithms=["HS256"],
-        )
-        return payload.get("sub", "unknown-agent")
-    except jwt.ExpiredSignatureError:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Agent token expired.",
-        )
-    except jwt.InvalidTokenError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"Invalid agent token: {exc}",
-        )