c89ac18d24
The default Windows session stayed signed in as another account, so the attended launcher now starts Edge or Chrome with a fresh profile. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
67 lines
2 KiB
Python
Executable file
67 lines
2 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
"""Keep Warden containment and open the login in an empty browser profile."""
|
|
import os
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
|
|
LANES = (
|
|
'openbao-platform-admin-login',
|
|
'informed-decision-sitting-requester-login',
|
|
)
|
|
|
|
|
|
def reviewed_command(args):
|
|
if args and args[0] == '--':
|
|
args = args[1:]
|
|
if not args:
|
|
raise SystemExit('A reviewed silent owner command is required')
|
|
command = Path(args[0]).expanduser()
|
|
if not command.is_absolute():
|
|
command = Path.cwd() / command
|
|
try:
|
|
command = command.resolve(strict=True)
|
|
except OSError:
|
|
raise SystemExit('Reviewed owner command is missing')
|
|
if not os.access(command, os.X_OK):
|
|
raise SystemExit('Reviewed owner command is not executable')
|
|
return [str(command), *args[1:]]
|
|
|
|
|
|
def parse_argv(argv):
|
|
args = list(argv)
|
|
lane = 'openbao-platform-admin-login'
|
|
if args[:1] == ['--lane']:
|
|
if len(args) < 2:
|
|
raise SystemExit('lane required')
|
|
lane, args = args[1], args[2:]
|
|
elif args and args[0].startswith('--lane='):
|
|
lane, args = args[0].split('=', 1)[1], args[1:]
|
|
if lane not in LANES:
|
|
raise SystemExit('unsupported attended login lane')
|
|
return lane, reviewed_command(args)
|
|
|
|
|
|
TUNNEL = 'http://127.0.0.1:18200'
|
|
|
|
|
|
def contained_env():
|
|
env = os.environ.copy()
|
|
env['BAO_ADDR'] = TUNNEL
|
|
env['VAULT_ADDR'] = TUNNEL
|
|
env.pop('BAO_TOKEN', None)
|
|
env.pop('VAULT_TOKEN', None)
|
|
env['WARDEN_ROUTING_CATALOG'] = '/home/worsch/ops-warden/registry/routing/catalog.yaml'
|
|
# Always win over ~/.local/bin/xdg-open. That shim opens the default Windows
|
|
# session, which can already be signed in as another account.
|
|
env['PATH'] = str(Path(__file__).resolve().parent / 'operator-browser') + os.pathsep + env.get('PATH', '')
|
|
return env
|
|
|
|
|
|
def main():
|
|
lane, args = parse_argv(sys.argv[1:])
|
|
os.execvpe('warden', ['warden', 'access', lane, '--exec', '--', *args], contained_env())
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|