|
| 1 | +from __future__ import annotations |
| 2 | + |
| 3 | +import argparse |
| 4 | +import json |
| 5 | +import os |
| 6 | +import sys |
| 7 | +from pathlib import Path |
| 8 | + |
| 9 | + |
| 10 | +def _ensure_repo_root_on_syspath() -> None: |
| 11 | + repo_root = Path(__file__).resolve().parents[2] |
| 12 | + root = str(repo_root) |
| 13 | + if root not in sys.path: |
| 14 | + sys.path.insert(0, root) |
| 15 | + |
| 16 | + |
| 17 | +def run( |
| 18 | + issuer: str, |
| 19 | + client_id: str, |
| 20 | + client_secret: str, |
| 21 | + audience: str, |
| 22 | + scope: str, |
| 23 | + supports_token_exchange: bool, |
| 24 | + subject_token: str | None, |
| 25 | + timeout_s: float, |
| 26 | +) -> dict[str, object]: |
| 27 | + _ensure_repo_root_on_syspath() |
| 28 | + from predicate_authority import ( # pylint: disable=import-error |
| 29 | + OidcCompatibilityConfig, |
| 30 | + OidcProviderCapabilities, |
| 31 | + run_oidc_token_exchange_compatibility_check, |
| 32 | + ) |
| 33 | + |
| 34 | + result = run_oidc_token_exchange_compatibility_check( |
| 35 | + config=OidcCompatibilityConfig( |
| 36 | + issuer=issuer, |
| 37 | + client_id=client_id, |
| 38 | + client_secret=client_secret, |
| 39 | + audience=audience, |
| 40 | + scope=scope, |
| 41 | + ), |
| 42 | + capabilities=OidcProviderCapabilities(supports_token_exchange=supports_token_exchange), |
| 43 | + subject_token=subject_token, |
| 44 | + timeout_s=timeout_s, |
| 45 | + ) |
| 46 | + result["delegation_path"] = ( |
| 47 | + "idp_token_exchange" |
| 48 | + if bool(result.get("token_exchange_ok", False)) |
| 49 | + else "authority_mandate_delegation" |
| 50 | + ) |
| 51 | + return result |
| 52 | + |
| 53 | + |
| 54 | +def main() -> None: |
| 55 | + parser = argparse.ArgumentParser(description="OIDC token exchange compatibility demo.") |
| 56 | + parser.add_argument("--issuer", default=os.getenv("OIDC_ISSUER")) |
| 57 | + parser.add_argument("--client-id", default=os.getenv("OIDC_CLIENT_ID")) |
| 58 | + parser.add_argument("--client-secret", default=os.getenv("OIDC_CLIENT_SECRET")) |
| 59 | + parser.add_argument("--audience", default=os.getenv("OIDC_AUDIENCE")) |
| 60 | + parser.add_argument("--scope", default=os.getenv("OIDC_SCOPE", "authority:check")) |
| 61 | + parser.add_argument("--subject-token", default=os.getenv("OIDC_SUBJECT_TOKEN")) |
| 62 | + parser.add_argument("--supports-token-exchange", action="store_true") |
| 63 | + parser.add_argument("--timeout-s", type=float, default=5.0) |
| 64 | + args = parser.parse_args() |
| 65 | + |
| 66 | + missing = [ |
| 67 | + name |
| 68 | + for name, value in ( |
| 69 | + ("issuer", args.issuer), |
| 70 | + ("client_id", args.client_id), |
| 71 | + ("client_secret", args.client_secret), |
| 72 | + ("audience", args.audience), |
| 73 | + ) |
| 74 | + if value is None or str(value).strip() == "" |
| 75 | + ] |
| 76 | + if missing: |
| 77 | + raise SystemExit(f"Missing required arguments/env vars: {', '.join(missing)}") |
| 78 | + |
| 79 | + payload = run( |
| 80 | + issuer=str(args.issuer), |
| 81 | + client_id=str(args.client_id), |
| 82 | + client_secret=str(args.client_secret), |
| 83 | + audience=str(args.audience), |
| 84 | + scope=str(args.scope), |
| 85 | + supports_token_exchange=bool(args.supports_token_exchange), |
| 86 | + subject_token=(str(args.subject_token) if args.subject_token is not None else None), |
| 87 | + timeout_s=float(args.timeout_s), |
| 88 | + ) |
| 89 | + print(json.dumps(payload, indent=2, sort_keys=True)) |
| 90 | + |
| 91 | + |
| 92 | +if __name__ == "__main__": |
| 93 | + main() |
0 commit comments