tegwick
48a75b1a54
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
39 lines
1.6 KiB
Python
39 lines
1.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Fixed Vergabe registration using the existing guarded KeyCape rollout lane."""
|
|
import importlib.util
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
spec = importlib.util.spec_from_file_location('portal_rollout', ROOT / 'portal-client-rollout.py')
|
|
rollout = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(rollout)
|
|
CLIENT = {
|
|
'clientId': 'vergabe-demo-company',
|
|
'displayName': 'Vergabe Demo Company',
|
|
'redirectUris': ['https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/'],
|
|
'allowedScopes': ['openid', 'profile', 'groups'],
|
|
'grantTypes': ['authorization_code'],
|
|
'clientType': 'public',
|
|
}
|
|
# Reuse the owner's byte-preserving insertion, CAS, cluster pin and safe receipts.
|
|
# The portal-specific legacy migration branch is explicitly unreachable here.
|
|
original_replacement = rollout.replacement
|
|
rollout.portal = SimpleNamespace(CLIENT_ID=CLIENT['clientId'], CLIENT=CLIENT)
|
|
|
|
|
|
def replacement(secret):
|
|
_, config, _ = rollout.pin.issuer_document(secret)
|
|
for client in config.get('clients', []):
|
|
if 'client_credentials' not in client.get('grantTypes', []):
|
|
rollout.require(not client.get('roles') and not client.get('serviceSubject'),
|
|
'browser_service_identity_fields_block_new_binary')
|
|
if client.get('clientId') == CLIENT['clientId']:
|
|
rollout.require(client == CLIENT, 'existing_vergabe_registration_differs')
|
|
return original_replacement(secret)
|
|
|
|
|
|
rollout.replacement = replacement
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(rollout.main())
|