chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(opax-mcp): add Cloud Run identity token for agent calls

Browse Source
This commit is contained in:
Chris Christiansen 2026-09-19 02:11:47 +00:00
parent fceec08823
commit 6f6189adfa
1 changed files with 25 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
opax-mcp/server.py
View File

@ -531,18 +531,35 @@ async def _verify_auth(request: Request) -> None:
# Backend Agent helpers (for kall VIDERE til osvauco-agent) # Backend Agent helpers (for kall VIDERE til osvauco-agent)
# --------------------------------------------------------------------------- # ---------------------------------------------------------------------------
def _agent_headers() -> dict: def _fetch_id_token_sync(audience: str) -> str:
"""Headers for maskin-til-maskin kall videre til osvauco-agent via X-Internal-Key.""" """Fetch a Cloud Run identity token outside the event loop."""
return { auth_req = google.auth.transport.requests.Request()
"X-Internal-Key": INTERNAL_API_KEY, # Bruker den nye delte nøkkelen return google.oauth2.id_token.fetch_id_token(auth_req, audience)
"Content-Type": "application/json"
} async def _agent_headers() -> dict:
"""Headers for machine-to-machine calls to osvauco-agent."""
if not OSVAUCO_AGENT_URL:
raise ValueError("OSVAUCO_AGENT_URL is not configured.")
headers = {"Content-Type": "application/json"}
if INTERNAL_API_KEY:
headers["X-Internal-Key"] = INTERNAL_API_KEY
try:
audience = OSVAUCO_AGENT_URL.rstrip("/")
token = await asyncio.to_thread(_fetch_id_token_sync, audience)
headers["Authorization"] = f"Bearer {token}"
except Exception:
logger.error("Failed to generate Cloud Run identity token for downstream agent.")
raise RuntimeError("Could not generate identity token for downstream service.") from None
return headers
async def _agent_get(path: str) -> Any: async def _agent_get(path: str) -> Any:
"""GET-kall til osvauco-agent.""" """GET-kall til osvauco-agent."""
url = f"{OSVAUCO_AGENT_URL}{path}" url = f"{OSVAUCO_AGENT_URL}{path}"
async with httpx.AsyncClient(timeout=30) as c: async with httpx.AsyncClient(timeout=30) as c:
r = await c.get(url, headers=_agent_headers()) r = await c.get(url, headers=await _agent_headers())
r.raise_for_status() r.raise_for_status()
return r.json() return r.json()
@ -550,7 +567,7 @@ async def _agent_post(path: str, body: dict) -> Any:
"""POST-kall til osvauco-agent.""" """POST-kall til osvauco-agent."""
url = f"{OSVAUCO_AGENT_URL}{path}" url = f"{OSVAUCO_AGENT_URL}{path}"
async with httpx.AsyncClient(timeout=45) as c: async with httpx.AsyncClient(timeout=45) as c:
r = await c.post(url, json=body, headers=_agent_headers()) r = await c.post(url, json=body, headers=await _agent_headers())
r.raise_for_status() r.raise_for_status()
return r.json() return r.json()