scripts.mint_gateway_token

Reference › scripts › mint_gateway_token

scripts/mint_gateway_token.py is a thin command-line shim that mints a signed gateway JWT and prints it to standard output, so a client (the default subject is emacs-client) can authenticate to the gateway. A human runs it; tests/scripts/test_mint_gateway_token.py covers it. It delegates to TokenAuthenticator.create_token in orchestrata_ultimate.gateway.auth, with settings from GatewayConfig in orchestrata_ultimate.gateway.config, and see orchestrata_ultimate.gateway.exceptions for the error type.

build_parser defines one option, --user, the subject (user_id) claim. main loads the RUL-019 dotenv contract through load_env_contract (from orchestrata_ultimate.core.env_bootstrap) unless a caller passes an explicit environment mapping; in that case the configuration resolves entirely from the mapping and no file is loaded, which is how tests stay hermetic. A GatewayError or RuntimeError is reported as mint_gateway_token: on standard error with exit 1.

At a glance

Class diagram

No classes; see Functions.

Dependency diagram

API

Functions

Source

Permalink: https://gitlab.com/MSamy/orchestrata-ultimate-architecture/-/blob/a4cbc2bdf/scripts/mint_gateway_token.py

#!/usr/bin/env python3
"""Thin CLI shim: mint a gateway JWT via ``TokenAuthenticator.create_token``.

Zero business logic lives here -- see
``orchestrata_ultimate.gateway.auth.TokenAuthenticator`` for the actual
signing. This exists so out-of-band callers (e.g. Emacs's ``ou-net.el``,
which shells out to this script through the repo's own venv Python) can mint
a token that validates against the running gateway without duplicating the
env-lookup ``TokenAuthenticator._get_secret``'s docstring warns against.

Usage:
    scripts/mint_gateway_token.py [--user USER_ID]

Prints the signed token to stdout and exits 0 on success. On any minting
failure (e.g. a required infra endpoint key -- JWT_SECRET, REDIS_HOST,
REDIS_PORT -- is unset in the environment, RUL-003 no-literal-fallback) the
token is never printed: a clear message goes to stderr and the process exits
1.
"""

from __future__ import annotations

import argparse
import sys
from collections.abc import Mapping

from orchestrata_ultimate.core.env_bootstrap import load_env_contract
from orchestrata_ultimate.gateway.auth import TokenAuthenticator
from orchestrata_ultimate.gateway.config import GatewayConfig
from orchestrata_ultimate.gateway.exceptions import GatewayError


def build_parser() -> argparse.ArgumentParser:
    """Build the CLI argument parser.

    Returns:
        Configured ArgumentParser with a single ``--user`` option.
    """
    parser = argparse.ArgumentParser(
        prog="mint_gateway_token.py",
        description=(
            "Mint a signed gateway JWT via TokenAuthenticator.create_token "
            "and print it to stdout."
        ),
    )
    parser.add_argument(
        "--user",
        default="emacs-client",
        help="Subject (user_id) claim for the token (default: %(default)s)",
    )
    return parser


def main(argv: list[str] | None = None, env: Mapping[str, str] | None = None) -> None:
    """CLI entry point.

    Args:
        argv: Command-line arguments (defaults to sys.argv[1:]).
        env: Optional explicit environment mapping. When provided,
            ``GatewayConfig`` resolves entirely from this mapping instead of
            the real process environment, and the RUL-019 dotenv contract is
            NOT loaded -- tests pass a hermetic mapping and must not mutate
            ``os.environ`` or depend on files on disk.
    """
    args = build_parser().parse_args(argv)
    if env is None:
        load_env_contract()
    try:
        config = GatewayConfig(environ=env)
        token = TokenAuthenticator(config).create_token(args.user)
    except (GatewayError, RuntimeError) as exc:
        print(f"mint_gateway_token: {exc}", file=sys.stderr)
        sys.exit(1)
    print(token)


if __name__ == "__main__":
    main()