feat(cloud): remove static credentials and add host console

packages/cloud-platform/cloud/auth.py

@@ -84,29 +84,6 @@ class _StoredBearerCredential:
     token_digest: bytes = field(repr=False)
 
 
-@dataclass(frozen=True)
-class EnrollmentCredential:
-    principal_id: str
-    token: str = field(repr=False)
-
-    def __post_init__(self) -> None:
-        if not self.principal_id.strip():
-            raise ValueError("enrollment credential principal_id must not be empty")
-        if not self.token:
-            raise ValueError("enrollment credential token must not be empty")
-
-
-@dataclass(frozen=True)
-class EnrollmentPrincipal:
-    id: str
-    token_digest: str | None = field(default=None, repr=False)
-
-
-@runtime_checkable
-class EnrollmentAuthProvider(Protocol):
-    def authenticate(self, request: object) -> EnrollmentPrincipal | None: ...
-
-
 class ConfiguredBearerAuthProvider:
     """Authenticate configured bearer tokens without exposing credential text."""
 
@@ -136,50 +113,6 @@ class ConfiguredBearerAuthProvider:
         return matched_principal
 
 
-class ConfiguredEnrollmentTokenProvider:
-    def __init__(self, credentials: Iterable[EnrollmentCredential]) -> None:
-        self._credentials = tuple(
-            EnrollmentPrincipal(
-                id=credential.principal_id,
-                token_digest=digest_token(credential.token),
-            )
-            for credential in credentials
-        )
-
-    def authenticate(self, request: object) -> EnrollmentPrincipal | None:
-        candidate = bearer_token_digest(request)
-        if candidate is None:
-            return None
-        candidate_bytes = bytes.fromhex(candidate)
-        matched: EnrollmentPrincipal | None = None
-        for credential in self._credentials:
-            if compare_digest(
-                candidate_bytes,
-                bytes.fromhex(credential.token_digest),
-            ):
-                matched = credential
-        return matched
-
-
-class SelfServiceEnrollmentAuthProvider:
-    """Unconditionally authorizes Host enrollment with no pre-issued token."""
-
-    def authenticate(self, request: object) -> EnrollmentPrincipal | None:
-        return EnrollmentPrincipal(id="self-service", token_digest=None)
-
-
-class ChainedEnrollmentAuthProvider:
-    def __init__(self, providers: Iterable[EnrollmentAuthProvider]) -> None:
-        self.providers = tuple(providers)
-
-    def authenticate(self, request: object) -> EnrollmentPrincipal | None:
-        for provider in self.providers:
-            principal = provider.authenticate(request)
-            if principal is not None:
-                return principal
-        return None
-
-
 class RepositoryHostAuthProvider:
     def __init__(self, repository: CloudRepository) -> None:
         self.repository = repository
@@ -230,17 +163,17 @@ class ChainedAuthProvider:
         return None
 
 
-def create_auth_provider(
-    credentials: Iterable[BearerCredential],
-    *,
-    allow_insecure_anonymous: bool,
-) -> AuthProvider:
-    configured = list(credentials)
-    if configured:
-        return ConfiguredBearerAuthProvider(configured)
+class RejectingAuthProvider:
+    """Safe default for deployments that do not configure static API tokens."""
+
+    def authenticate(self, request: object) -> Principal | None:
+        return None
+
+
+def create_auth_provider(*, allow_insecure_anonymous: bool) -> AuthProvider:
     if allow_insecure_anonymous:
         return NullAuthProvider()
-    return ConfiguredBearerAuthProvider([])
+    return RejectingAuthProvider()
 
 
 def _extract_bearer_token(request: object) -> str | None: