thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
95 lines
3.0 KiB
Python
95 lines
3.0 KiB
Python
#!/usr/bin/env python3
|
|
import json
|
|
import os
|
|
import time
|
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
from urllib.parse import urlparse
|
|
|
|
import jwt
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
|
|
|
|
PORT = int(os.environ.get("CASAN_IDP_PORT", "8080"))
|
|
ISSUER = os.environ.get("CASAN_IDP_ISSUER", f"http://127.0.0.1:{PORT}")
|
|
KID = "casan-local-prod-idp"
|
|
KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
|
|
|
|
|
|
def b64u_int(value: int) -> str:
|
|
raw = value.to_bytes((value.bit_length() + 7) // 8, "big")
|
|
import base64
|
|
|
|
return base64.urlsafe_b64encode(raw).decode().rstrip("=")
|
|
|
|
|
|
def jwk():
|
|
numbers = KEY.public_key().public_numbers()
|
|
return {
|
|
"kty": "RSA",
|
|
"use": "sig",
|
|
"alg": "RS256",
|
|
"kid": KID,
|
|
"n": b64u_int(numbers.n),
|
|
"e": b64u_int(numbers.e),
|
|
}
|
|
|
|
|
|
class Handler(BaseHTTPRequestHandler):
|
|
def send_json(self, code, payload):
|
|
body = json.dumps(payload).encode()
|
|
self.send_response(code)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.send_header("Content-Length", str(len(body)))
|
|
self.end_headers()
|
|
self.wfile.write(body)
|
|
|
|
def do_GET(self): # noqa: N802
|
|
path = urlparse(self.path).path
|
|
if path == "/healthz":
|
|
self.send_json(200, {"status": "ok", "issuer": ISSUER})
|
|
elif path == "/.well-known/openid-configuration":
|
|
self.send_json(
|
|
200,
|
|
{
|
|
"issuer": ISSUER,
|
|
"jwks_uri": f"{ISSUER}/.well-known/jwks.json",
|
|
"token_endpoint": f"{ISSUER}/token",
|
|
"id_token_signing_alg_values_supported": ["RS256"],
|
|
},
|
|
)
|
|
elif path == "/.well-known/jwks.json":
|
|
self.send_json(200, {"keys": [jwk()]})
|
|
else:
|
|
self.send_json(404, {"error": "not_found"})
|
|
|
|
def do_POST(self): # noqa: N802
|
|
if urlparse(self.path).path != "/token":
|
|
self.send_json(404, {"error": "not_found"})
|
|
return
|
|
size = int(self.headers.get("Content-Length", "0"))
|
|
try:
|
|
payload = json.loads(self.rfile.read(size) or b"{}")
|
|
except json.JSONDecodeError:
|
|
self.send_json(400, {"error": "invalid_json"})
|
|
return
|
|
now = int(time.time())
|
|
claims = {
|
|
"iss": ISSUER,
|
|
"sub": payload.get("sub", "oidc-ops"),
|
|
"role": payload.get("role", "ops"),
|
|
"action": payload.get("action", "deploy"),
|
|
"actor": payload.get("actor", "alice"),
|
|
"input_sha256": payload.get("input_sha256", ""),
|
|
"iat": now,
|
|
"exp": now + int(payload.get("ttl_s", 300)),
|
|
}
|
|
token = jwt.encode(claims, KEY, algorithm="RS256", headers={"kid": KID})
|
|
self.send_json(200, {"access_token": token, "token_type": "Bearer", "expires_in": claims["exp"] - now})
|
|
|
|
def log_message(self, *args):
|
|
pass
|
|
|
|
|
|
if __name__ == "__main__":
|
|
HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
|