laniakea-api-server 0.2.6__tar.gz → 0.2.8__tar.gz

{laniakea_api_server-0.2.6 → laniakea_api_server-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: laniakea-api-server
-Version: 0.2.6
+Version: 0.2.8
 Summary: Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration
 Project-URL: Homepage, https://github.com/laniakea/laniakea-api
 Project-URL: Issues, https://github.com/laniakea/laniakea-api/issues

{laniakea_api_server-0.2.6 → laniakea_api_server-0.2.8}/laniakea_api/auth.py

@@ -10,45 +10,34 @@ import httpx
 import jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from laniakea_api.config import (
-                                 SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
-                                 OIDC_DISCOVERY_URL, AGENT_MASTER_PASSWORD,
-                                )
+from laniakea_api.config import (SECRET_KEY, ALGORITHM, SESSION_TTL_MINUTES,
+                                 OIDC_DISCOVERY_URLS, AGENT_MASTER_PASSWORD)
+
 
 # Initialize security OAuth2 Bearer Token
 _bearer = HTTPBearer()
 
 async def fetch_userinfo(oidc_token: str) -> dict:
     """
-    Takes an authentication token provided by a user and asks an external identity server
-    (the OIDC Provider) who that user actually is, retriving user info
+    Validate the token against every trusted issuer, first match wins.
+    Supports federated logins (IAM ReCaS + Keycloak).
     """
-    try:
-        # asynchronous HTTP to avoid waste of server resources
-        async with httpx.AsyncClient(timeout=10) as client:
-            # OIDC discovery
-            discovery = await client.get(OIDC_DISCOVERY_URL)
-            discovery.raise_for_status()                         # status 200: OK
-            userinfo_url = discovery.json()["userinfo_endpoint"] # now final url is known
-            # USER info request
-            resp = await client.get(
-                userinfo_url,
-                headers={"Authorization": f"Bearer {oidc_token}"},
-            )
-        if resp.status_code != 200:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"OIDC userinfo returned {resp.status_code}",
-            )
-        return resp.json()
-    except HTTPException:
-        raise
-    except Exception as exc:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"OIDC validation failed: {exc}",
-        )
-
+    last_status = None
+    async with httpx.AsyncClient(timeout=10) as client:
+        for discovery_url in OIDC_DISCOVERY_URLS:
+            try:
+                discovery = await client.get(discovery_url)
+                discovery.raise_for_status()
+                userinfo_url = discovery.json()["userinfo_endpoint"]
+                resp = await client.get(userinfo_url,
+                                        headers={"Authorization": f"Bearer {oidc_token}"})
+                if resp.status_code == 200:
+                    return resp.json()
+                last_status = resp.status_code
+            except Exception:
+                continue
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
+                        detail=f"Token rejected by all trusted issuers (last: {last_status})")
 
 def create_session_token(user_info: dict) -> tuple:
     """

{laniakea_api_server-0.2.6 → laniakea_api_server-0.2.8}/laniakea_api/config.py

@@ -9,7 +9,8 @@ import os
 SECRET_KEY          = os.getenv("SECRET_KEY", "")
 ALGORITHM           = "HS256"
 SESSION_TTL_MINUTES = int(os.getenv("SESSION_TTL_MINUTES", "60")) # NOTE: maybe longer
-OIDC_DISCOVERY_URL  = os.getenv("OIDC_DISCOVERY_URL", "")
+#OIDC_DISCOVERY_URL  = os.getenv("OIDC_DISCOVERY_URL", "")
+OIDC_DISCOVERY_URLS = [u.strip() for u in os.getenv("OIDC_DISCOVERY_URL", "").split(",") if u.strip()]
 
 # Agent pool password
 # to revoke ALL agents: change this value and restart API + all agents.

{laniakea_api_server-0.2.6 → laniakea_api_server-0.2.8}/laniakea_api/queue.py

@@ -120,7 +120,7 @@ def _sc_path(user_sub: str, name: str = "") -> str:
     return f"{base}/{name}" if name else base
 
 def vault_list_service_creds(user_sub: str) -> list:
-    client = get_vault_client()
+    client = vault_client()
     try:
         resp = client.secrets.kv.v2.list_secrets(path=_sc_path(user_sub), mount_point=VAULT_MOUNT)
         names = [k.rstrip("/") for k in resp["data"]["keys"]]
@@ -133,7 +133,7 @@ def vault_list_service_creds(user_sub: str) -> list:
     return out
 
 def vault_read_service_creds(user_sub: str, name: str) -> dict:
-    client = get_vault_client()
+    client = vault_client()
     try:
         resp = client.secrets.kv.v2.read_secret_version(path=_sc_path(user_sub, name), mount_point=VAULT_MOUNT)
         return resp["data"]["data"] or {}
@@ -141,11 +141,11 @@ def vault_read_service_creds(user_sub: str, name: str) -> dict:
         return {}
 
 def vault_write_service_creds(user_sub: str, name: str, data: dict) -> None:
-    client = get_vault_client()
+    client = vault_client()
     client.secrets.kv.v2.create_or_update_secret(
         path=_sc_path(user_sub, name), secret=data, mount_point=VAULT_MOUNT)
 
 def vault_delete_service_creds(user_sub: str, name: str) -> None:
-    client = get_vault_client()
+    client = vault_client()
     client.secrets.kv.v2.delete_metadata_and_all_versions(
         path=_sc_path(user_sub, name), mount_point=VAULT_MOUNT)

{laniakea_api_server-0.2.6 → laniakea_api_server-0.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "laniakea-api-server"
-version = "0.2.6"
+version = "0.2.8"
 description = "Laniakea Queue API — OIDC-authenticated gateway for cloud deployment orchestration"
 readme = "README.md"
 license = { text = "MIT" }