feat(cloud): remove static credentials and add host console

packages/cloud-platform/cloud/control_config.py

@@ -1,13 +1,10 @@
 from __future__ import annotations
 
-import json
 import os
 from collections.abc import Mapping
 from dataclasses import dataclass
 from typing import Literal
 
-from cloud.auth import BearerCredential, EnrollmentCredential
-
 
 EnvironmentName = Literal["local", "test", "production"]
 SUPPORTED_DATABASE_PREFIXES = (
@@ -30,9 +27,6 @@ class CloudControlConfig:
     lease_duration_seconds: float = 60.0
     max_task_attempts: int = 3
     allow_insecure_anonymous: bool = False
-    credentials: tuple[BearerCredential, ...] = ()
-    enrollment_credentials: tuple[EnrollmentCredential, ...] = ()
-    self_service_enrollment_enabled: bool = False
     cors_allowed_origins: tuple[str, ...] = ()
     console_static_dir: str | None = None
     user_session_idle_seconds: int = 28_800
@@ -90,20 +84,6 @@ def load_control_config(
             values.get("CLOUD_ALLOW_INSECURE_ANONYMOUS"),
             default=False,
         ),
-        credentials=(
-            *_parse_credentials(values.get("CLOUD_PUBLIC_CREDENTIALS_JSON")),
-            *_parse_credentials(
-                values.get("CLOUD_HOST_CREDENTIALS_JSON"),
-                require_host_id=True,
-            ),
-        ),
-        enrollment_credentials=_parse_enrollment_credentials(
-            values.get("CLOUD_ENROLLMENT_TOKENS_JSON")
-        ),
-        self_service_enrollment_enabled=_parse_bool(
-            values.get("CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED"),
-            default=False,
-        ),
         cors_allowed_origins=_parse_cors_origins(
             values.get("CLOUD_CONSOLE_CORS_ORIGINS")
         ),
@@ -145,10 +125,6 @@ def validate_control_config(config: CloudControlConfig) -> None:
         raise CloudConfigurationError(
             "anonymous access cannot be enabled in production"
         )
-    if config.environment == "production" and not config.credentials:
-        raise CloudConfigurationError(
-            "production requires at least one configured bearer credential"
-        )
     if config.user_session_absolute_seconds < config.user_session_idle_seconds:
         raise CloudConfigurationError(
             "CLOUD_USER_SESSION_ABSOLUTE_SECONDS must be at least the idle TTL"
@@ -159,76 +135,6 @@ def validate_control_config(config: CloudControlConfig) -> None:
         )
 
 
-def _parse_credentials(
-    raw_value: str | None,
-    *,
-    require_host_id: bool = False,
-) -> tuple[BearerCredential, ...]:
-    if raw_value is None or not raw_value.strip():
-        return ()
-    try:
-        payload = json.loads(raw_value)
-        if not isinstance(payload, list):
-            raise TypeError
-        credentials: list[BearerCredential] = []
-        for item in payload:
-            if not isinstance(item, dict):
-                raise TypeError
-            principal_id = item.get("principal_id")
-            token = item.get("token")
-            scopes = item.get("scopes", [])
-            host_id = item.get("host_id")
-            if (
-                not isinstance(principal_id, str)
-                or not isinstance(token, str)
-                or not isinstance(scopes, list)
-                or not all(isinstance(scope, str) for scope in scopes)
-                or (host_id is not None and not isinstance(host_id, str))
-                or (require_host_id and not isinstance(host_id, str))
-            ):
-                raise TypeError
-            credentials.append(
-                BearerCredential(
-                    principal_id=principal_id,
-                    token=token,
-                    scopes=frozenset(scopes),
-                    host_id=host_id,
-                )
-            )
-        return tuple(credentials)
-    except (TypeError, ValueError, json.JSONDecodeError) as exc:
-        raise CloudConfigurationError(
-            "configured bearer credentials are invalid"
-        ) from exc
-
-
-def _parse_enrollment_credentials(
-    raw_value: str | None,
-) -> tuple[EnrollmentCredential, ...]:
-    if raw_value is None or not raw_value.strip():
-        return ()
-    try:
-        payload = json.loads(raw_value)
-        if not isinstance(payload, list):
-            raise TypeError
-        credentials: list[EnrollmentCredential] = []
-        for item in payload:
-            if not isinstance(item, dict):
-                raise TypeError
-            principal_id = item.get("principal_id")
-            token = item.get("token")
-            if not isinstance(principal_id, str) or not isinstance(token, str):
-                raise TypeError
-            credentials.append(
-                EnrollmentCredential(principal_id=principal_id, token=token)
-            )
-        return tuple(credentials)
-    except (TypeError, ValueError, json.JSONDecodeError) as exc:
-        raise CloudConfigurationError(
-            "configured enrollment credentials are invalid"
-        ) from exc
-
-
 def _positive_float(
     values: Mapping[str, str],
     name: str,