chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: log IAP token errors and OPAX_IAP_CLIENT_ID on startup
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
Details

Browse Source
This commit is contained in:
Chris Christiansen 2026-06-29 01:07:44 +00:00
parent 303f190c58
commit 637d3a2811
1 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
opax-mcp/server.py
View File

@ -12,8 +12,12 @@ import google.auth.transport.requests
from fastapi import FastAPI, Request, HTTPException from fastapi import FastAPI, Request, HTTPException
from fastapi.responses import JSONResponse from fastapi.responses import JSONResponse
from typing import Any, Optional from typing import Any, Optional
import logging
app = FastAPI(title="opax-mcp", version="3.0.0") logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)
app = FastAPI(title="opax-mcp", version="3.0.1")
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no") OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "") OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
@ -23,6 +27,8 @@ GITEA_TOKEN = os.environ.get("GITEA_TOKEN", "")
GITEA_REPO = os.environ.get("GITEA_REPO", "chris/OSVauco") GITEA_REPO = os.environ.get("GITEA_REPO", "chris/OSVauco")
GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5") GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
logger.info(f"OPAX_IAP_CLIENT_ID: {OPAX_IAP_CLIENT_ID[:10]}...")
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
# Auth # Auth
@ -48,20 +54,21 @@ def _verify_auth(request: Request):
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
def _opax_identity_token() -> str: def _opax_identity_token() -> str:
"""Hent identity token for opax.vauco.no (Cloud Run IAP/IAM)."""
try:
metadata_url = ( metadata_url = (
"http://metadata.google.internal/computeMetadata/v1/instance" "http://metadata.google.internal/computeMetadata/v1/instance"
f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full" f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID}&format=full"
) )
try:
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5) resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
if resp.status_code == 200 and resp.text.strip(): resp.raise_for_status()
return resp.text.strip() token = resp.text.strip()
except Exception: if not token:
pass raise ValueError("Empty token returned from metadata server")
credentials, _ = google.auth.default() return token
credentials.refresh(google.auth.transport.requests.Request()) except Exception as e:
return credentials.token logger.error(f"[IAP TOKEN ERROR] {type(e).__name__}: {e}")
raise
def _opax_headers() -> dict: def _opax_headers() -> dict:
return {"Authorization": f"Bearer {_opax_identity_token()}", "Content-Type": "application/json"} return {"Authorization": f"Bearer {_opax_identity_token()}", "Content-Type": "application/json"}