feat(cloud): remove static credentials and add host console

packages/cloud-platform/cloud/internal_api/api.py

@@ -12,8 +12,6 @@ from fastapi.responses import JSONResponse
 
 from cloud.auth import (
     AuthProvider,
-    ConfiguredEnrollmentTokenProvider,
-    EnrollmentAuthProvider,
     HostAuthorizationError,
     digest_token,
 )
@@ -35,7 +33,6 @@ from cloud.internal_api.models import (
 )
 from cloud.repository import (
     DeviceEnrollmentConflictError,
-    EnrollmentTokenConflictError,
     HostEnrollmentConflictError,
 )
 from core.models import Device, utc_now
@@ -48,7 +45,6 @@ def create_internal_router(
     *,
     pool: DevicePool,
     auth_provider: AuthProvider,
-    enrollment_auth_provider: EnrollmentAuthProvider | None = None,
     version_prefix: str = "/internal/v1",
     claim_poll_interval_seconds: float = 0.1,
     lease_duration_seconds: float = 60.0,
@@ -59,8 +55,6 @@ def create_internal_router(
     if lease_duration_seconds <= 0:
         raise ValueError("lease_duration_seconds must be greater than zero")
     router = APIRouter(prefix=version_prefix, tags=["host-agent"])
-    enrollment_auth = enrollment_auth_provider or ConfiguredEnrollmentTokenProvider(())
-
     def authorize_host(request: Request, host_id: str) -> None:
         principal = auth_provider.authenticate(request)
         if principal is None:
@@ -84,25 +78,17 @@ def create_internal_router(
     )
     def enroll_host(
         payload: HostEnrollmentRequest,
-        request: Request,
     ) -> HostEnrollmentResponse:
-        enrollment_principal = enrollment_auth.authenticate(request)
-        if enrollment_principal is None:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="unauthorized",
-                headers={"WWW-Authenticate": "Bearer"},
-            )
         try:
             enrollment = pool.store.enroll_host(
                 host_id=f"host-{uuid4().hex}",
                 agent_instance_id=payload.agent_instance_id,
                 credential_digest=digest_token(payload.host_token),
-                enrollment_token_digest=enrollment_principal.token_digest,
+                enrollment_token_digest=None,
                 display_name=payload.display_name,
                 enrolled_at=utc_now(),
             )
-        except (EnrollmentTokenConflictError, HostEnrollmentConflictError) as exc:
+        except HostEnrollmentConflictError as exc:
             raise HTTPException(
                 status_code=status.HTTP_409_CONFLICT,
                 detail=str(exc),