fix(opax-mcp): use OIDC token for agent authentication

opax-mcp/server.py

@@ -72,11 +72,35 @@ def _verify_auth(request: Request):
 # ---------------------------------------------------------------------------
 # Backend Agent helpers (for kall VIDERE til osvauco-agent)
 # ---------------------------------------------------------------------------
+def _get_oidc_token(audience: str) -> str:
+    """Fetches an OIDC token for a given audience."""
+    try:
+        # First, try the metadata server (for VM/Cloud Run environment)
+        token_url = f"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience={audience}&format=full"
+        r = httpx.get(token_url, headers={"Metadata-Flavor": "Google"})
+        if r.is_success:
+            return r.text
+        
+        # Fallback to application default credentials (for local dev)
+        logging.info("Metadata server failed, falling back to ADC for OIDC token.")
+        creds, project = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
+        auth_req = google.auth.transport.requests.Request()
+        creds.refresh(auth_req)
+        id_token = google.oauth2.id_token.fetch_id_token(auth_req, audience)
+        return id_token
+
+    except Exception as e:
+        logging.error(f"Failed to get OIDC token for audience {audience}: {e}", exc_info=True)
+        raise HTTPException(status_code=500, detail=f"Could not obtain OIDC token for backend service. Error: {e}")
+
 
 def _agent_headers() -> dict:
-    """Headers for maskin-til-maskin kall videre til osvauco-agent via X-Internal-Key."""
+    """Headers for M2M calls to osvauco-agent, authenticated with OIDC token."""
+    # Ensure audience is the base URL, without any path
+    audience = OSVAUCO_AGENT_URL.split('/')[0] + '//' + OSVAUCO_AGENT_URL.split('/')[2]
+    token = _get_oidc_token(audience=audience)
     return {
-        "X-Internal-Key": INTERNAL_API_KEY, # Bruker den nye delte nøkkelen
+        "Authorization": f"Bearer {token}",
         "Content-Type": "application/json"
     }