feat(cloud): remove static credentials and add host console

apps/cloud-api/cloud_api/app.py

@@ -18,10 +18,7 @@ from starlette.types import Scope
 
 from cloud.auth import (
     ChainedAuthProvider,
-    ChainedEnrollmentAuthProvider,
-    ConfiguredEnrollmentTokenProvider,
     RepositoryHostAuthProvider,
-    SelfServiceEnrollmentAuthProvider,
     UserSessionAuthProvider,
     create_auth_provider,
 )
@@ -110,7 +107,6 @@ def create_app(
     validate_control_config(control_config)
     build_database = database_factory or _default_database_factory
     configured_auth_provider = create_auth_provider(
-        control_config.credentials,
         allow_insecure_anonymous=control_config.allow_insecure_anonymous,
     )
     repository = _RepositoryProxy()
@@ -132,18 +128,8 @@ def create_app(
     auth_provider = ChainedAuthProvider(
         (
             configured_auth_provider,
-            UserSessionAuthProvider(user_auth_service),
             RepositoryHostAuthProvider(repository),  # type: ignore[arg-type]
-        )
-    )
-    enrollment_auth_provider = ChainedEnrollmentAuthProvider(
-        (
-            ConfiguredEnrollmentTokenProvider(control_config.enrollment_credentials),
-            *(
-                (SelfServiceEnrollmentAuthProvider(),)
-                if control_config.self_service_enrollment_enabled
-                else ()
-            ),
+            UserSessionAuthProvider(user_auth_service),
         )
     )
     domain_config = CloudConfig(
@@ -306,7 +292,6 @@ def create_app(
         create_internal_router(
             pool=pool,
             auth_provider=auth_provider,
-            enrollment_auth_provider=enrollment_auth_provider,
             lease_duration_seconds=control_config.lease_duration_seconds,
         )
     )

apps/cloud-api/tests/test_app.py

@@ -9,7 +9,7 @@ from fastapi.testclient import TestClient
 
 import cloud_api.app as app_module
 from cloud_api.app import create_app
-from cloud.auth import BearerCredential, EnrollmentCredential, digest_token
+from cloud.auth import digest_token
 from cloud.control_config import CloudConfigurationError, CloudControlConfig
 from cloud.database import CloudDatabase
 from cloud.pool import PooledDevice
@@ -33,24 +33,8 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
     tmp_path,
 ) -> None:
     database_url = f"sqlite:///{(tmp_path / 'enrollment.sqlite3').as_posix()}"
-    enrollment_token = "one-time-enrollment-token"
     host_token = "host-token-" + ("x" * 40)
-    config = CloudControlConfig(
-        database_url=database_url,
-        credentials=(
-            BearerCredential(
-                principal_id="operator",
-                token="operator-token",
-                scopes=frozenset({"pool:read"}),
-            ),
-        ),
-        enrollment_credentials=(
-            EnrollmentCredential(
-                principal_id="installer-a",
-                token=enrollment_token,
-            ),
-        ),
-    )
+    config = CloudControlConfig(database_url=database_url)
     enrollment_payload = {
         "agent_instance_id": "agent-instance-a",
         "host_token": host_token,
@@ -61,7 +45,6 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
     with TestClient(app) as client:
         enrolled = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json=enrollment_payload,
         )
         assert enrolled.status_code == 201
@@ -70,21 +53,21 @@ def test_managed_host_enrollment_device_mapping_and_restart_authentication(
 
         retried = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json=enrollment_payload,
         )
         assert retried.status_code == 201
         assert retried.json()["host_id"] == host_id
 
-        reused = client.post(
+        another_host = client.post(
             "/internal/v1/enrollments",
-            headers={"Authorization": f"Bearer {enrollment_token}"},
             json={
                 **enrollment_payload,
                 "agent_instance_id": "agent-instance-b",
+                "host_token": "host-token-" + ("y" * 40),
             },
         )
-        assert reused.status_code == 409
+        assert another_host.status_code == 201
+        assert another_host.json()["host_id"] != host_id
 
         device = client.post(
             f"/internal/v1/hosts/{host_id}/devices/enroll",
@@ -601,14 +584,16 @@ def _wait_until(predicate, timeout_seconds: float = 1.0) -> bool:
     return False
 
 
-def test_production_app_rejects_missing_credentials() -> None:
-    with pytest.raises(CloudConfigurationError, match="credential"):
-        create_app(
-            config=CloudControlConfig(
-                environment="production",
-                database_url="postgresql://db/cloud",
-            )
+def test_production_app_allows_no_static_credentials() -> None:
+    app = create_app(
+        config=CloudControlConfig(
+            environment="production",
+            database_url="postgresql://db/cloud",
+            session_cookie_secure=True,
         )
+    )
+
+    assert app.title == "Device Cloud API"
 
 
 def test_cors_headers_are_absent_when_allow_list_is_empty() -> None: