bvandeusen
b255a0f90e
Renames src/fabledassistant -> src/scribe and all imports, plus the default DB name and DB user/password (fabled -> scribe) in config + compose. 952 refs / 154 files. Reverses the old 'internal name stays fabledassistant' convention. Code-only: live databases are still physically named 'fabledassistant'. Deployed environments must set POSTGRES_DB / POSTGRES_USER (or rename the DB) since the defaults now resolve to 'scribe'. Repo (FabledScribe), git host (fabledsword), MCP (fabled-git) and the image name (fabledscribe) are intentionally unchanged. ruff check src/ clean locally; CI (typecheck + pytest) is the gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.4 KiB
Python
38 lines
1.4 KiB
Python
"""MCP-side Bearer token resolution. Reuses the existing api_keys infrastructure."""
|
|
from __future__ import annotations
|
|
|
|
from scribe.services.api_keys import lookup_key
|
|
|
|
|
|
async def resolve_bearer_to_user_id(auth_header: str | None) -> int | None:
|
|
"""Parse an `Authorization: Bearer <token>` header and return the user_id.
|
|
|
|
Returns None if the header is missing, malformed, or the token is invalid
|
|
or revoked. The underlying lookup_key already updates last_used_at on hit.
|
|
"""
|
|
if not auth_header or not auth_header.startswith("Bearer "):
|
|
return None
|
|
raw_token = auth_header[len("Bearer "):].strip()
|
|
if not raw_token:
|
|
return None
|
|
api_key = await lookup_key(raw_token)
|
|
return api_key.user_id if api_key else None
|
|
|
|
|
|
async def resolve_bearer(auth_header: str | None) -> tuple[int, str] | None:
|
|
"""Resolve a Bearer token to (user_id, scope).
|
|
|
|
scope is 'read' or 'write'. Returns None for a missing/malformed/invalid
|
|
token. The MCP dispatch layer uses scope to deny write-class tool calls
|
|
from read-only keys — the same read/write boundary the REST API enforces.
|
|
"""
|
|
if not auth_header or not auth_header.startswith("Bearer "):
|
|
return None
|
|
raw_token = auth_header[len("Bearer "):].strip()
|
|
if not raw_token:
|
|
return None
|
|
api_key = await lookup_key(raw_token)
|
|
if api_key is None:
|
|
return None
|
|
return api_key.user_id, (api_key.scope or "write")
|