chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: log IAP token errors and OPAX_IAP_CLIENT_ID on startup
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
Details

Browse Source
This commit is contained in:
Chris Christiansen 2026-06-29 01:07:44 +00:00
parent 303f190c58
commit 637d3a2811
1 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
opax-mcp/server.py
View File

@ -12,8 +12,12 @@ import google.auth.transport.requests
from fastapi import FastAPI, Request, HTTPException
from fastapi.responses import JSONResponse
from typing import Any, Optional
import logging
app = FastAPI(title="opax-mcp", version="3.0.0")
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)
app = FastAPI(title="opax-mcp", version="3.0.1")
OPAX_BASE_URL = os.environ.get("OPAX_BASE_URL", "https://opax.vauco.no")
OPAX_IAP_CLIENT_ID = os.environ.get("OPAX_IAP_CLIENT_ID", "")
@ -23,6 +27,8 @@ GITEA_TOKEN = os.environ.get("GITEA_TOKEN", "")
GITEA_REPO = os.environ.get("GITEA_REPO", "chris/OSVauco")
GOOGLE_CLOUD_PROJECT = os.environ.get("GOOGLE_CLOUD_PROJECT", "propane-will-491900-m5")
logger.info(f"OPAX_IAP_CLIENT_ID: {OPAX_IAP_CLIENT_ID[:10]}...")
# ---------------------------------------------------------------------------
# Auth
@ -48,20 +54,21 @@ def _verify_auth(request: Request):
# ---------------------------------------------------------------------------
def _opax_identity_token() -> str:
metadata_url = (
"http://metadata.google.internal/computeMetadata/v1/instance"
f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID or OPAX_BASE_URL}&format=full"
)
"""Hent identity token for opax.vauco.no (Cloud Run IAP/IAM)."""
try:
metadata_url = (
"http://metadata.google.internal/computeMetadata/v1/instance"
f"/service-accounts/default/identity?audience={OPAX_IAP_CLIENT_ID}&format=full"
)
resp = httpx.get(metadata_url, headers={"Metadata-Flavor": "Google"}, timeout=5)
if resp.status_code == 200 and resp.text.strip():
return resp.text.strip()
except Exception:
pass
credentials, _ = google.auth.default()
credentials.refresh(google.auth.transport.requests.Request())
return credentials.token
resp.raise_for_status()
token = resp.text.strip()
if not token:
raise ValueError("Empty token returned from metadata server")
return token
except Exception as e:
logger.error(f"[IAP TOKEN ERROR] {type(e).__name__}: {e}")
raise
def _opax_headers() -> dict:
return {"Authorization": f"Bearer {_opax_identity_token()}", "Content-Type": "application/json"}