Latte
b82e2866cb
Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes and toolsets, the argparse CLI skeleton, catalog.model, identity and GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
"""Identity a tool call runs as.
|
|
|
|
Admin-token mode uses the configured ``GITEA_TOKEN`` (stdio, or the static MCP
|
|
bearer on HTTP). OAuth mode uses the signed-in user's own Gitea token. The
|
|
identity travels with each call so the executor can pick the right token and the
|
|
result envelope and audit log can name who acted.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
from typing import Any, Literal
|
|
|
|
IdentityMode = Literal["admin-token", "oauth"]
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Identity:
|
|
"""Who a tool call acts as.
|
|
|
|
Attributes:
|
|
login: Gitea login when known (``None`` until resolved).
|
|
mode: ``admin-token`` or ``oauth``.
|
|
token: Gitea token for this identity. Excluded from ``repr`` and never
|
|
part of :meth:`metadata`.
|
|
"""
|
|
|
|
login: str | None
|
|
mode: IdentityMode
|
|
token: str = field(repr=False)
|
|
|
|
def metadata(self, sudo: str | None = None) -> dict[str, Any]:
|
|
"""Return result and audit metadata: ``{"login", "mode", "sudo"}``, never the token."""
|
|
return {"login": self.login, "mode": self.mode, "sudo": sudo}
|