fix(opax-mcp): add Cloud Run identity token for agent calls

opax-mcp/server.py

@@ -531,18 +531,35 @@ async def _verify_auth(request: Request) -> None:
 # Backend Agent helpers (for kall VIDERE til osvauco-agent)
 # ---------------------------------------------------------------------------
 
-def _agent_headers() -> dict:
-    """Headers for maskin-til-maskin kall videre til osvauco-agent via X-Internal-Key."""
-    return {
-        "X-Internal-Key": INTERNAL_API_KEY, # Bruker den nye delte nøkkelen
-        "Content-Type": "application/json"
-    }
+def _fetch_id_token_sync(audience: str) -> str:
+    """Fetch a Cloud Run identity token outside the event loop."""
+    auth_req = google.auth.transport.requests.Request()
+    return google.oauth2.id_token.fetch_id_token(auth_req, audience)
+
+async def _agent_headers() -> dict:
+    """Headers for machine-to-machine calls to osvauco-agent."""
+    if not OSVAUCO_AGENT_URL:
+        raise ValueError("OSVAUCO_AGENT_URL is not configured.")
+
+    headers = {"Content-Type": "application/json"}
+    if INTERNAL_API_KEY:
+        headers["X-Internal-Key"] = INTERNAL_API_KEY
+
+    try:
+        audience = OSVAUCO_AGENT_URL.rstrip("/")
+        token = await asyncio.to_thread(_fetch_id_token_sync, audience)
+        headers["Authorization"] = f"Bearer {token}"
+    except Exception:
+        logger.error("Failed to generate Cloud Run identity token for downstream agent.")
+        raise RuntimeError("Could not generate identity token for downstream service.") from None
+
+    return headers
 
 async def _agent_get(path: str) -> Any:
     """GET-kall til osvauco-agent."""
     url = f"{OSVAUCO_AGENT_URL}{path}"
     async with httpx.AsyncClient(timeout=30) as c:
-        r = await c.get(url, headers=_agent_headers())
+        r = await c.get(url, headers=await _agent_headers())
         r.raise_for_status()
         return r.json()
 
@@ -550,7 +567,7 @@ async def _agent_post(path: str, body: dict) -> Any:
     """POST-kall til osvauco-agent."""
     url = f"{OSVAUCO_AGENT_URL}{path}"
     async with httpx.AsyncClient(timeout=45) as c:
-        r = await c.post(url, json=body, headers=_agent_headers())
+        r = await c.post(url, json=body, headers=await _agent_headers())
         r.raise_for_status()
         return r.json()