mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
cf765ee00c
SPOT: declare the var-lib base once in default.env as INFINITO_DIR_VAR_LIB; the env build derives INFINITO_PLAYWRIGHT_REPORTS_BASE_DIR from it; reference it everywhere (utils/paths.py, scripts via ${...:?}, tests, the dev inventory's DIR_VAR_LIB injection) instead of hardcoding the literal. group_vars keeps the literal default; the env-lookup lives in the dev inventory per the no-ansible-env-lookups lint rule. pull_specific_host.py --folder is now required and the role passes {{ DIR_BACKUPS }}.
Swarm e2e: collect_playwright_reports.sh docker-cp's the reports off the manager plus a workflow upload step, so swarm Playwright traces reach CI artifacts (was compose-only).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
2.2 KiB
Python
77 lines
2.2 KiB
Python
"""Token-store wipe helper.
|
|
|
|
The token store at ``/var/lib/infinito/secrets/tokens.yml`` survives
|
|
compose+volumes purges. Matrix-deploy variant transitions wipe an app's
|
|
persistent state but the stale token would otherwise be reused on the next
|
|
round (for example matomo's API probe in ``sys-front-inj-matomo``, whose
|
|
token-empty guard never fires while the prior round's token is still
|
|
present). The purge orchestrator invokes this module to drop the matching
|
|
``users.<user>.tokens.<app_id>`` entries alongside the entity-level wipe.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
from utils.cache.yaml import dump_yaml, load_yaml_any
|
|
from utils.paths import FILE_TOKENS
|
|
|
|
DEFAULT_TOKENS_FILE = FILE_TOKENS
|
|
|
|
|
|
def _resolve_tokens_file() -> Path:
|
|
env_path = os.environ.get("FILE_TOKENS")
|
|
return Path(env_path) if env_path else DEFAULT_TOKENS_FILE
|
|
|
|
|
|
def wipe_tokens(app_ids: list[str], tokens_file: Path | None = None) -> list[str]:
|
|
"""Remove ``users.<user>.tokens.<app_id>`` entries for *app_ids*.
|
|
|
|
Returns the list of removed ``<user>.<app_id>`` keys (empty when the
|
|
file is missing or no entries matched). The file is rewritten only
|
|
when at least one entry was removed.
|
|
"""
|
|
path = tokens_file or _resolve_tokens_file()
|
|
if not path.exists():
|
|
return []
|
|
|
|
data = load_yaml_any(str(path), default_if_missing={}) or {}
|
|
users = data.get("users") or {}
|
|
|
|
removed: list[str] = []
|
|
for user_key, user_data in users.items():
|
|
if not isinstance(user_data, dict):
|
|
continue
|
|
tokens = user_data.get("tokens") or {}
|
|
for app_id in app_ids:
|
|
if app_id in tokens:
|
|
del tokens[app_id]
|
|
removed.append(f"{user_key}.{app_id}")
|
|
|
|
if removed:
|
|
dump_yaml(path, data)
|
|
|
|
return removed
|
|
|
|
|
|
def main(argv: list[str]) -> int:
|
|
if not argv:
|
|
print(
|
|
"usage: python -m utils.cleanup.tokens <APP_ID> [APP_ID ...]",
|
|
file=sys.stderr,
|
|
)
|
|
return 2
|
|
|
|
removed = wipe_tokens(argv)
|
|
if removed:
|
|
print(f">>> Wiped token entries: {', '.join(removed)}")
|
|
else:
|
|
print(">>> No token entries to wipe")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main(sys.argv[1:]))
|