From 637d3a28114aba74c4e89ffbf9ea417d754432e3 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Mon, 29 Jun 2026 01:07:44 +0000 Subject: [PATCH] fix: log IAP token errors and OPAX_IAP_CLIENT_ID on startup --- opax-mcp/server.py | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/opax-mcp/server.py b/opax-mcp/server.py index 4b3f357..40e47f1 100644 --- a/opax-mcp/server.py +++ b/opax-mcp/server.py @@ -12,8 +12,12 @@ import google.auth.transport.requests from fastapi import FastAPI, Request, HTTPException from fastapi.responses import JSONResponse from typing import Any, Optional +import logging -app = FastAPI(title="opax-mcp", version="3.0.0") +logging.basicConfig(level=logging.INFO) +logger = logging.getLogger(__name__) + +app = FastAPI(title="opax-mcp", version="3.0.1") OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no") OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "") @@ -23,6 +27,8 @@ GITEA_TOKEN = os.environ.get("GITEA_TOKEN", "") GITEA_REPO = os.environ.get("GITEA_REPO", "chris/OSVauco") GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5") +logger.info(f"OPAX_IAP_CLIENT_ID: {OPAX_IAP_CLIENT_ID[:10]}...") + # --------------------------------------------------------------------------- # Auth @@ -48,20 +54,21 @@ def _verify_auth(request: Request): # --------------------------------------------------------------------------- def _opax_identity_token() -> str: - metadata_url = ( - "http://metadata.google.internal/computeMetadata/v1/instance" - f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full" - ) + """Hent identity token for opax.vauco.no (Cloud Run IAP/IAM).""" try: + metadata_url = ( + "http://metadata.google.internal/computeMetadata/v1/instance" + f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID}&format=full" + ) resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5) - if resp.status_code == 200 and resp.text.strip(): - return resp.text.strip() - except Exception: - pass - credentials, _ = google.auth.default() - credentials.refresh(google.auth.transport.requests.Request()) - return credentials.token - + resp.raise_for_status() + token = resp.text.strip() + if not token: + raise ValueError("Empty token returned from metadata server") + return token + except Exception as e: + logger.error(f"[IAP TOKEN ERROR] {type(e).__name__}: {e}") + raise def _opax_headers() -> dict: return {"Authorization": f"Bearer {_opax_identity_token()}", "Content-Type": "application/json"}