laniakea-api-server 0.2.4__tar.gz → 0.2.7__tar.gz

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: laniakea-api-server
-Version: 0.2.4
+Version: 0.2.7
 Summary: Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration
 Project-URL: Homepage, https://github.com/laniakea/laniakea-api
 Project-URL: Issues, https://github.com/laniakea/laniakea-api/issues

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/laniakea_api/auth.py

@@ -10,45 +10,34 @@ import httpx
 import jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from laniakea_api.config import (
-                                 SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
-                                 OIDC_DISCOVERY_URL, AGENT_MASTER_PASSWORD,
-                                )
+from laniakea_api.config import (SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
+                                 OIDC_DISCOVERY_URLS, AGENT_MASTER_PASSWORD)
+
 
 # Initialize security OAuth2 Bearer Token
 _bearer = HTTPBearer()
 
 async def fetch_userinfo(oidc_token: str) -> dict:
     """
-    Takes an authentication token provided by a user and asks an external identity server
-    (the OIDC Provider) who that user actually is, retriving user info
+    Validate the token against every trusted issuer, first match wins.
+    Supports federated logins (IAM ReCaS + Keycloak).
     """
-    try:
-        # asynchronous HTTP to avoid waste of server resources
-        async with httpx.AsyncClient(timeout=10) as client:
-            # OIDC discovery
-            discovery = await client.get(OIDC_DISCOVERY_URL)
-            discovery.raise_for_status()                         # status 200: OK
-            userinfo_url = discovery.json()["userinfo_endpoint"] # now final url is known
-            # USER info request
-            resp = await client.get(
-                userinfo_url,
-                headers={"Authorization": f"Bearer {oidc_token}"},
-            )
-        if resp.status_code != 200:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"OIDC userinfo returned {resp.status_code}",
-            )
-        return resp.json()
-    except HTTPException:
-        raise
-    except Exception as exc:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"OIDC validation failed: {exc}",
-        )
-
+    last_status = None
+    async with httpx.AsyncClient(timeout=10) as client:
+        for discovery_url in OIDC_DISCOVERY_URLS:
+            try:
+                discovery = await client.get(discovery_url)
+                discovery.raise_for_status()
+                userinfo_url = discovery.json()["userinfo_endpoint"]
+                resp = await client.get(userinfo_url,
+                                        headers={"Authorization": f"Bearer {oidc_token}"})
+                if resp.status_code == 200:
+                    return resp.json()
+                last_status = resp.status_code
+            except Exception:
+                continue
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                        detail=f"Token rejected by all trusted issuers (last: {last_status})")
 
 def create_session_token(user_info: dict) -> tuple:
     """

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/laniakea_api/config.py

@@ -9,7 +9,8 @@ import os
 SECRET_KEY          = os.getenv("SECRET_KEY", "")
 ALGORITHM           = "HS256"
 SESSION_TTL_MINUTES = int(os.getenv("SESSION_TTL_MINUTES", "60")) # NOTE: maybe longer
-OIDC_DISCOVERY_URL  = os.getenv("OIDC_DISCOVERY_URL", "")
+#OIDC_DISCOVERY_URL  = os.getenv("OIDC_DISCOVERY_URL", "")
+OIDC_DISCOVERY_URLS = [u.strip() for u in os.getenv("OIDC_DISCOVERY_URL", "").split(",") if u.strip()]
 
 # Agent pool password
 # to revoke ALL agents: change this value and restart API + all agents.
@@ -49,5 +50,8 @@ VALID_STATUSES = {
     "CREATE_FAILED",
     "UPDATE_IN_PROGRESS",
     "UPDATE_FAILED",
+    "DELETE_IN_PROGRESS", 
+    "DELETE_COMPLETE", 
+    "DELETE_FAILED",
 }
 

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/laniakea_api/queue.py

@@ -113,3 +113,39 @@ def check_vault() -> str:
     except Exception as exc:
         return f"error: {exc}"
 
+#per-cloud credentials: secret/<sub>/service_creds/<name>
+
+def _sc_path(user_sub: str, name: str = "") -> str:
+    base = f"{user_sub}/service_creds"
+    return f"{base}/{name}" if name else base
+
+def vault_list_service_creds(user_sub: str) -> list:
+    client = get_vault_client()
+    try:
+        resp = client.secrets.kv.v2.list_secrets(path=_sc_path(user_sub), mount_point=VAULT_MOUNT)
+        names = [k.rstrip("/") for k in resp["data"]["keys"]]
+    except Exception:
+        return []
+    out = []
+    for n in names:
+        data = vault_read_service_creds(user_sub, n)
+        out.append({"name": n, "service_type": data.get("service_type", "openstack")})
+    return out
+
+def vault_read_service_creds(user_sub: str, name: str) -> dict:
+    client = get_vault_client()
+    try:
+        resp = client.secrets.kv.v2.read_secret_version(path=_sc_path(user_sub, name), mount_point=VAULT_MOUNT)
+        return resp["data"]["data"] or {}
+    except Exception:
+        return {}
+
+def vault_write_service_creds(user_sub: str, name: str, data: dict) -> None:
+    client = get_vault_client()
+    client.secrets.kv.v2.create_or_update_secret(
+        path=_sc_path(user_sub, name), secret=data, mount_point=VAULT_MOUNT)
+
+def vault_delete_service_creds(user_sub: str, name: str) -> None:
+    client = get_vault_client()
+    client.secrets.kv.v2.delete_metadata_and_all_versions(
+        path=_sc_path(user_sub, name), mount_point=VAULT_MOUNT)

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/laniakea_api/routers/agent.py

@@ -23,9 +23,13 @@ def _validate_transition(current: str, new_status: str, uuid: str) -> None:
         "QUEUED":              {"CREATE_IN_PROGRESS", "UPDATE_IN_PROGRESS"},
         "CREATE_IN_PROGRESS":  {"CREATE_COMPLETE", "CREATE_FAILED", "QUEUED"},
         "UPDATE_IN_PROGRESS":  {"UPDATE_FAILED"},
-        "CREATE_COMPLETE":     set(),
+        "CREATE_COMPLETE":     {"DELETE_IN_PROGRESS"},
+        "DELETE_IN_PROGRESS":  {"DELETE_COMPLETE", "DELETE_FAILED"},
+        "DELETE_FAILED":       {"DELETE_IN_PROGRESS"},
         "CREATE_FAILED":       set(),
-        "UPDATE_FAILED":       set(),}
+        "UPDATE_FAILED":       set(),
+        "DELETE_COMPLETE":     set(),
+        }
 
     permitted = allowed.get(current, set())
     if new_status not in permitted:

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/laniakea_api/routers/credentials.py

@@ -11,6 +11,8 @@ from laniakea_api.auth import fetch_userinfo, create_session_token, verify_sessi
 from laniakea_api.models import (OIDCLoginRequest, SessionTokenResponse,UserCredentials,
                     CredentialTestRequest, CredentialTestResponse,)
 from laniakea_api.queue import vault_write_credentials, VAULT_MOUNT
+from laniakea_api.queue import (vault_list_service_creds, vault_read_service_creds,
+                                vault_write_service_creds, vault_delete_service_creds)
 
 router = APIRouter()
 
@@ -96,3 +98,23 @@ async def test_openstack_credentials(body: CredentialTestRequest,
             detail=str(exc),
         )
 
+@router.get("/profile/service_creds")
+async def list_service_creds(caller: dict = Depends(verify_session_token)):
+    return vault_list_service_creds(caller["sub"])
+
+@router.get("/profile/service_creds/{name}")
+async def read_service_creds(name: str, caller: dict = Depends(verify_session_token)):
+    return vault_read_service_creds(caller["sub"], name)
+
+@router.put("/profile/service_creds/{name}")
+async def write_service_creds(name: str, body: dict, caller: dict = Depends(verify_session_token)):
+    if not name or "/" in name:
+        raise HTTPException(status_code=400, detail="Invalid credential name.")
+    body = {k: v for k, v in body.items() if v not in (None, "") and k != "name"}
+    vault_write_service_creds(caller["sub"], name, body)   # KV2: ogni write = nuova versione
+    return {"name": name, "saved": True}
+
+@router.delete("/profile/service_creds/{name}")
+async def delete_service_creds(name: str, caller: dict = Depends(verify_session_token)):
+    vault_delete_service_creds(caller["sub"], name)
+    return {"name": name, "deleted": True}

{laniakea_api_server-0.2.4 → laniakea_api_server-0.2.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "laniakea-api-server"
-version = "0.2.4"
+version = "0.2.7"
 description = "Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration"
 readme = "README.md"
 license = { text = "MIT" }