Spaces:
Paused
Paused
| """Manage tester API keys in testers.yaml. | |
| python -m api.keys add NAME [--note TEXT] create a key (printed once) | |
| python -m api.keys list show testers (never keys) | |
| python -m api.keys revoke NAME deactivate a tester | |
| """ | |
| from __future__ import annotations | |
| import argparse | |
| import datetime as dt | |
| import secrets | |
| import sys | |
| from pathlib import Path | |
| import yaml | |
| from .auth import hash_key | |
| from .config import get_settings | |
| def _read(path: Path) -> dict: | |
| if path.is_file(): | |
| return yaml.safe_load(path.read_text()) or {} | |
| return {} | |
| def _write(path: Path, data: dict) -> None: | |
| header = "# Stage 1 tester allowlist. Manage with `python -m api.keys`; keys are stored as SHA-256 only.\n" | |
| path.write_text(header + yaml.safe_dump(data, sort_keys=False)) | |
| path.chmod(0o600) | |
| def add(path: Path, name: str, note: str = "") -> str: | |
| data = _read(path) | |
| testers = data.setdefault("testers", []) or [] | |
| data["testers"] = testers | |
| if any(t["name"] == name and t.get("active", True) for t in testers): | |
| raise ValueError(f"an active tester named {name!r} already exists (revoke it first)") | |
| key = "rd_" + secrets.token_urlsafe(24) | |
| testers.append( | |
| { | |
| "name": name, | |
| "key_sha256": hash_key(key), | |
| "active": True, | |
| "added": dt.date.today().isoformat(), | |
| "note": note, | |
| } | |
| ) | |
| _write(path, data) | |
| return key | |
| def revoke(path: Path, name: str) -> int: | |
| data = _read(path) | |
| n = 0 | |
| for t in data.get("testers") or []: | |
| if t["name"] == name and t.get("active", True): | |
| t["active"] = False | |
| t["revoked"] = dt.date.today().isoformat() | |
| n += 1 | |
| if n: | |
| _write(path, data) | |
| return n | |
| def main(argv: list[str] | None = None) -> int: | |
| parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) | |
| parser.add_argument("--file", type=Path, help="default: $ROSDIFF_TESTERS_FILE or ./testers.yaml") | |
| sub = parser.add_subparsers(dest="cmd", required=True) | |
| p = sub.add_parser("add") | |
| p.add_argument("name") | |
| p.add_argument("--note", default="") | |
| sub.add_parser("list") | |
| p = sub.add_parser("revoke") | |
| p.add_argument("name") | |
| args = parser.parse_args(argv) | |
| path = args.file or get_settings().testers_file | |
| if args.cmd == "add": | |
| try: | |
| key = add(path, args.name, args.note) | |
| except ValueError as e: | |
| print(f"error: {e}", file=sys.stderr) | |
| return 1 | |
| print(f"Added tester {args.name!r} to {path}.") | |
| print(f"API key (shown once, send it to the tester privately):\n\n {key}\n") | |
| return 0 | |
| if args.cmd == "list": | |
| for t in _read(path).get("testers") or []: | |
| state = "active " if t.get("active", True) else "revoked" | |
| print(f"{state} {t['name']:<20} added {t.get('added', '?')} {t.get('note', '')}") | |
| return 0 | |
| n = revoke(path, args.name) | |
| print(f"revoked {n} key(s) for {args.name!r}" if n else f"no active tester named {args.name!r}") | |
| return 0 if n else 1 | |
| if __name__ == "__main__": | |
| sys.exit(main()) | |