feat(cloud): add edge host enrollment

packages/cloud-platform/cloud/control_config.py

@@ -6,7 +6,7 @@ from collections.abc import Mapping
 from dataclasses import dataclass
 from typing import Literal
 
-from cloud.auth import BearerCredential
+from cloud.auth import BearerCredential, EnrollmentCredential
 
 
 EnvironmentName = Literal["local", "test", "production"]
@@ -31,6 +31,7 @@ class CloudControlConfig:
     max_task_attempts: int = 3
     allow_insecure_anonymous: bool = False
     credentials: tuple[BearerCredential, ...] = ()
+    enrollment_credentials: tuple[EnrollmentCredential, ...] = ()
 
 
 def load_control_config(
@@ -86,6 +87,9 @@ def load_control_config(
                 require_host_id=True,
             ),
         ),
+        enrollment_credentials=_parse_enrollment_credentials(
+            values.get("CLOUD_ENROLLMENT_TOKENS_JSON")
+        ),
     )
     validate_control_config(config)
     return config
@@ -145,6 +149,33 @@ def _parse_credentials(
         ) from exc
 
 
+def _parse_enrollment_credentials(
+    raw_value: str | None,
+) -> tuple[EnrollmentCredential, ...]:
+    if raw_value is None or not raw_value.strip():
+        return ()
+    try:
+        payload = json.loads(raw_value)
+        if not isinstance(payload, list):
+            raise TypeError
+        credentials: list[EnrollmentCredential] = []
+        for item in payload:
+            if not isinstance(item, dict):
+                raise TypeError
+            principal_id = item.get("principal_id")
+            token = item.get("token")
+            if not isinstance(principal_id, str) or not isinstance(token, str):
+                raise TypeError
+            credentials.append(
+                EnrollmentCredential(principal_id=principal_id, token=token)
+            )
+        return tuple(credentials)
+    except (TypeError, ValueError, json.JSONDecodeError) as exc:
+        raise CloudConfigurationError(
+            "configured enrollment credentials are invalid"
+        ) from exc
+
+
 def _positive_float(
     values: Mapping[str, str],
     name: str,