perl_d
3ec2bc011b
Build and Publish / test (pull_request) Successful in 2m16s
Build and Publish / test (pull_request_target) Successful in 2m7s
Build and Publish / build (pull_request) Successful in 19s
Build and Publish / test (push) Successful in 2m28s
Build and Publish / build (pull_request_target) Successful in 19s
Build and Publish / Build and Deploy Docs (pull_request) Successful in 38s
Build and Publish / build (push) Successful in 18s
Build and Publish / Build and Deploy Docs (pull_request_target) Successful in 33s
Build and Publish / Build and Deploy Docs (push) Successful in 33s
79 lines
2.9 KiB
Python
79 lines
2.9 KiB
Python
import json
|
|
import subprocess
|
|
|
|
import jwt
|
|
from aarecommon.config.logger import setup_logger
|
|
from aarecommon.models.auth import get_user
|
|
from aarecommon.models.models import TokenData
|
|
|
|
from aare.gui.constants import LOGGER_NAME
|
|
|
|
logger = setup_logger(LOGGER_NAME)
|
|
|
|
|
|
def auth(base_url: str | None, cert_path: str | None) -> str:
|
|
curr_user = get_user()
|
|
if base_url is None:
|
|
token_data = TokenData(sub=curr_user, staff=True, session=15, pgroups=["p16371", "p22233"])
|
|
return jwt.encode(token_data.model_dump(), "ABC123")
|
|
|
|
# Single call: Kerberos SPNEGO through Apache, which proxies to the DAQ server.
|
|
# Apache injects X-Remote-User; the DAQ server reads it from the localhost-proxied request.
|
|
url = f"{base_url}/token"
|
|
cacert = f"{cert_path}"
|
|
try:
|
|
token_result = subprocess.run(
|
|
["curl", "-s", "--cacert", cacert, "--negotiate", "-u", ":", url, "-XPOST"],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=120.0,
|
|
)
|
|
except subprocess.TimeoutExpired as e:
|
|
logger.error(f"Token request curl timed out: {e}")
|
|
raise RuntimeError(
|
|
"Cannot reach AareDAQ server (timeout). "
|
|
"Please check the server is running and your connection."
|
|
) from e
|
|
except FileNotFoundError as e:
|
|
logger.error(f"curl not found: {e}")
|
|
raise RuntimeError("curl not found on this system.") from e
|
|
except OSError as e:
|
|
logger.error(f"Token request curl OS error: {e}")
|
|
raise RuntimeError(
|
|
"Cannot reach AareDAQ server (OS error). "
|
|
"Please check the server is running and your connection."
|
|
) from e
|
|
except Exception as e:
|
|
logger.error(f"Token request curl error: {e}")
|
|
raise RuntimeError("Cannot reach AareDAQ server (unknown error). ") from e
|
|
|
|
if token_result.returncode != 0:
|
|
logger.error(
|
|
f"Token curl exited {token_result.returncode}. stderr: {token_result.stderr[:500]}"
|
|
)
|
|
raise RuntimeError(
|
|
f"Token request failed (curl exit {token_result.returncode}). "
|
|
"Check Kerberos ticket is valid (kinit) and server is reachable."
|
|
)
|
|
|
|
try:
|
|
response_json = json.loads(token_result.stdout)
|
|
except json.JSONDecodeError as e:
|
|
logger.error(f"Token response not JSON. stdout: {token_result.stdout[:500]}")
|
|
raise RuntimeError(
|
|
"Authentication failed (invalid server response). "
|
|
"The server may be starting up or misconfigured."
|
|
) from e
|
|
|
|
token = response_json.get("access_token")
|
|
if not token or not isinstance(token, str):
|
|
logger.error(
|
|
f"Missing access_token. Keys: {list(response_json.keys())}. Server response {response_json}"
|
|
)
|
|
raise RuntimeError(
|
|
"Authentication failed (missing token in server response). "
|
|
"The server may be starting up."
|
|
)
|
|
|
|
return token
|