q792602257
efeb3eb926
Tests / Test passed: 581
Host Agent: - One-time local operator account bootstrap (PBKDF2-HMAC-SHA256, atomic 0600-permission write) gating the daemon's first unattended start via a new `setup` CLI subcommand. - Default control-plane URL now https://amcp.home.jerryyan.top (env var override unchanged). - Enrollment no longer requires a pre-issued token; falls back to zero-token self-service enrollment when none is configured. Cloud control plane: - CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED (default false) opt-in flag. - SelfServiceEnrollmentAuthProvider + ChainedEnrollmentAuthProvider: configured tokens still take priority; self-service only applies when no token matches, preserving edge-host-enrollment's token-bound path. - Fixed a latent bug in sql_repository.py::enroll_host: the token-conflict lookup used `== enrollment_token_digest`, which SQLAlchemy compiles to `IS NULL` when the value is None, so every self-service enrollment after the first would have falsely collided with an existing NULL-digest host. Skipped that lookup entirely when the digest is None. Docs/deploy: .env.example, compose.yaml, compose.deploy.yaml, CLOUD_DEPLOYMENT.md, MACOS_IPHONE_SETUP.md updated for the new flag, URL default, and required `device-host-agent setup` step. Verification: 494 non-integration tests pass; openspec validate --strict passes. PostgreSQL-backed contract tests and full manual end-to-end verification were not run (no Postgres/Docker or reachable cloud-api in this environment); noted as unchecked in tasks.md 7.2/7.4.
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
from __future__ import annotations
|
|
|
|
import argparse
|
|
import getpass
|
|
import sys
|
|
from collections.abc import Sequence
|
|
from dataclasses import replace
|
|
|
|
from host_agent.app import create_application
|
|
from host_agent.config import load_host_agent_config
|
|
from host_agent.local_account import LocalAccountStore
|
|
|
|
|
|
class LocalAccountSetupError(RuntimeError):
|
|
"""Raised when local account bootstrap cannot proceed."""
|
|
|
|
|
|
def main(argv: Sequence[str] | None = None) -> None:
|
|
parser = argparse.ArgumentParser(description="Run the Device Host Agent")
|
|
subparsers = parser.add_subparsers(dest="command")
|
|
subparsers.add_parser("setup", help="Create the local operator account")
|
|
args = parser.parse_args(argv)
|
|
|
|
try:
|
|
if args.command == "setup":
|
|
_run_setup()
|
|
return
|
|
config = _resolve_config_with_local_account()
|
|
except LocalAccountSetupError as exc:
|
|
print(f"error: {exc}", file=sys.stderr)
|
|
raise SystemExit(1) from exc
|
|
|
|
create_application(config=config).run()
|
|
|
|
|
|
def _run_setup() -> None:
|
|
config = load_host_agent_config()
|
|
store = LocalAccountStore(config.local_account_path)
|
|
if store.load() is not None:
|
|
confirm = input(
|
|
"A local account already exists. Overwrite it? [y/N] "
|
|
).strip().lower()
|
|
if confirm != "y":
|
|
print("Setup cancelled; existing account left unchanged.")
|
|
return
|
|
account = _prompt_and_create(store)
|
|
print(f"Local account '{account.username}' created.")
|
|
|
|
|
|
def _resolve_config_with_local_account():
|
|
config = load_host_agent_config()
|
|
store = LocalAccountStore(config.local_account_path)
|
|
account = store.load()
|
|
if account is None:
|
|
if not sys.stdin.isatty():
|
|
raise LocalAccountSetupError(
|
|
"no local account configured; run `device-host-agent setup` "
|
|
"on an interactive terminal to create one"
|
|
)
|
|
account = _prompt_and_create(store)
|
|
if not config.display_name:
|
|
config = replace(config, display_name=account.username)
|
|
return config
|
|
|
|
|
|
def _prompt_and_create(store: LocalAccountStore):
|
|
username = input("Username: ").strip()
|
|
if not username:
|
|
raise LocalAccountSetupError("username must not be empty")
|
|
password = getpass.getpass("Password: ")
|
|
confirm = getpass.getpass("Confirm password: ")
|
|
if not password:
|
|
raise LocalAccountSetupError("password must not be empty")
|
|
if password != confirm:
|
|
raise LocalAccountSetupError("passwords do not match")
|
|
return store.create(username, password)
|