Harden production workflows and agent admission

server/monlet_server/agent_auth.py

@@ -0,0 +1,30 @@
+from dataclasses import dataclass
+from hashlib import sha256
+
+from fastapi import Request
+
+
+@dataclass(frozen=True)
+class AgentCredential:
+    key_hash: str
+    key_fingerprint: str
+
+
+def hash_agent_key(token: str) -> str:
+    return sha256(token.encode("utf-8")).hexdigest()
+
+
+def fingerprint_from_hash(key_hash: str) -> str:
+    return key_hash[:16]
+
+
+def credential_from_token(token: str) -> AgentCredential:
+    key_hash = hash_agent_key(token)
+    return AgentCredential(key_hash=key_hash, key_fingerprint=fingerprint_from_hash(key_hash))
+
+
+def get_agent_credential(request: Request) -> AgentCredential:
+    cred = getattr(request.state, "agent_credential", None)
+    if not isinstance(cred, AgentCredential):
+        raise RuntimeError("agent credential missing")
+    return cred