8cb5b13c77
The receipt stores only called, rejected, or opened. It does not store the address. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
122 lines
3.6 KiB
Python
Executable file
122 lines
3.6 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
"""Open the approved OpenBao login in a new empty browser profile.
|
|
|
|
The default Windows session is not used. A previous login stayed signed in
|
|
there as another account, so this launcher creates a fresh profile each time.
|
|
"""
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
from pathlib import Path
|
|
from urllib.parse import parse_qs, urlsplit
|
|
|
|
|
|
EDGE = "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
|
|
CHROME = "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"
|
|
|
|
|
|
def allowed(url):
|
|
try:
|
|
parsed = urlsplit(url)
|
|
query = parse_qs(parsed.query)
|
|
return (
|
|
parsed.scheme == "https"
|
|
and parsed.hostname == "kc.coulomb.social"
|
|
and parsed.port in (None, 443)
|
|
and parsed.username is None
|
|
and parsed.password is None
|
|
and not parsed.fragment
|
|
and not any(char in url for char in "\r\n\x00")
|
|
and query.get("redirect_uri")
|
|
in (
|
|
["http://localhost:8250/oidc/callback"],
|
|
["http://127.0.0.1:8250/oidc/callback"],
|
|
)
|
|
)
|
|
except ValueError:
|
|
return False
|
|
|
|
|
|
def browser_path():
|
|
for candidate in (EDGE, CHROME):
|
|
if Path(candidate).is_file():
|
|
return candidate
|
|
return ""
|
|
|
|
|
|
def launch_argv(browser, profile_dir, url):
|
|
return [
|
|
browser,
|
|
f"--user-data-dir={profile_dir}",
|
|
"--no-first-run",
|
|
"--no-default-browser-check",
|
|
"--new-window",
|
|
url,
|
|
]
|
|
|
|
|
|
def stamp(result):
|
|
path = Path("/home/worsch/.local/state/railiance/receipts/operator-browser-last.txt")
|
|
try:
|
|
path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
|
|
path.write_text(result + "\n", encoding="utf-8")
|
|
os.chmod(path, 0o600)
|
|
except OSError:
|
|
return
|
|
|
|
|
|
def main():
|
|
stamp("called")
|
|
if len(sys.argv) != 2 or not allowed(sys.argv[1]):
|
|
stamp("rejected")
|
|
return 1
|
|
browser = browser_path()
|
|
if not browser:
|
|
stamp("no-browser")
|
|
return 1
|
|
profile = Path(tempfile.mkdtemp(prefix="operator-browser-"))
|
|
os.chmod(profile, 0o700)
|
|
try:
|
|
windows_profile = subprocess.run(
|
|
["wslpath", "-w", str(profile)],
|
|
capture_output=True,
|
|
check=False,
|
|
timeout=10,
|
|
)
|
|
if windows_profile.returncode != 0:
|
|
return 1
|
|
profile_dir = windows_profile.stdout.decode().strip()
|
|
if not profile_dir or any(char in profile_dir for char in "\r\n"):
|
|
return 1
|
|
command = launch_argv(browser, profile_dir, sys.argv[1])
|
|
payload = "\n".join(command) + "\n"
|
|
opened = subprocess.run(
|
|
[
|
|
"/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe",
|
|
"-NoProfile",
|
|
"-NonInteractive",
|
|
"-Command",
|
|
"$ErrorActionPreference='Stop'; "
|
|
"$lines=@([Console]::In.ReadToEnd().Split(\"`n\") | "
|
|
"Where-Object { $_ -ne '' }); "
|
|
"if ($lines.Count -lt 2) { exit 1 }; "
|
|
"Start-Process -FilePath $lines[0] -ArgumentList $lines[1..($lines.Count-1)]",
|
|
],
|
|
input=payload.encode(),
|
|
stdout=subprocess.DEVNULL,
|
|
stderr=subprocess.DEVNULL,
|
|
timeout=20,
|
|
)
|
|
if opened.returncode != 0:
|
|
stamp("open-failed")
|
|
return 1
|
|
stamp("opened")
|
|
return 0
|
|
except (OSError, subprocess.SubprocessError):
|
|
stamp("open-failed")
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|