|
| 1 | +from __future__ import annotations |
| 2 | + |
| 3 | +__all__ = ( |
| 4 | + "DiracXClient", |
| 5 | + "diracxTokenFromPEM", |
| 6 | +) |
| 7 | + |
| 8 | +import base64 |
| 9 | +import json |
| 10 | +import re |
| 11 | +import textwrap |
| 12 | +from contextlib import contextmanager |
| 13 | +from pathlib import Path |
| 14 | +from tempfile import NamedTemporaryFile |
| 15 | +from typing import Any |
| 16 | + |
| 17 | +from diracx.client import DiracClient as _DiracClient |
| 18 | +from diracx.core.models import TokenResponse |
| 19 | +from diracx.core.preferences import DiracxPreferences |
| 20 | +from diracx.core.utils import serialize_credentials |
| 21 | + |
| 22 | +from DIRAC import gConfig |
| 23 | +from DIRAC.ConfigurationSystem.Client.Helpers import Registry |
| 24 | +from DIRAC.Core.Security.Locations import getDefaultProxyLocation |
| 25 | +from DIRAC.Core.Utilities.ReturnValues import convertToReturnValue, returnValueOrRaise |
| 26 | + |
| 27 | + |
| 28 | +PEM_BEGIN = "-----BEGIN DIRACX-----" |
| 29 | +PEM_END = "-----END DIRACX-----" |
| 30 | +RE_DIRACX_PEM = re.compile(rf"{PEM_BEGIN}\n(.*)\n{PEM_END}", re.MULTILINE | re.DOTALL) |
| 31 | + |
| 32 | + |
| 33 | +@convertToReturnValue |
| 34 | +def addProxyToPEM(pemPath, group): |
| 35 | + from DIRAC.Core.Base.Client import Client |
| 36 | + |
| 37 | + vo = Registry.getVOMSVOForGroup(group) |
| 38 | + disabledVOs = gConfig.getValue("/DiracX/DisabledVOs", []) |
| 39 | + if vo and vo not in disabledVOs: |
| 40 | + token_content = returnValueOrRaise( |
| 41 | + Client(url="Framework/ProxyManager", proxyLocation=pemPath).exchangeProxyForToken() |
| 42 | + ) |
| 43 | + |
| 44 | + diracxUrl = gConfig.getValue("/DiracX/URL") |
| 45 | + if not diracxUrl: |
| 46 | + return S_ERROR("Missing mandatory /DiracX/URL configuration") |
| 47 | + |
| 48 | + token = TokenResponse( |
| 49 | + access_token=token_content["access_token"], |
| 50 | + expires_in=token_content["expires_in"], |
| 51 | + token_type=token_content.get("token_type"), |
| 52 | + refresh_token=token_content.get("refresh_token"), |
| 53 | + ) |
| 54 | + |
| 55 | + token_pem = f"{PEM_BEGIN}\n" |
| 56 | + data = base64.b64encode(serialize_credentials(token).encode("utf-8")).decode() |
| 57 | + token_pem += textwrap.fill(data, width=64) |
| 58 | + token_pem += f"\n{PEM_END}\n" |
| 59 | + |
| 60 | + with open(pemPath, "a") as f: |
| 61 | + f.write(token_pem) |
| 62 | + |
| 63 | + |
| 64 | +def diracxTokenFromPEM(pemPath) -> dict[str, Any] | None: |
| 65 | + """Extract the DiracX token from the proxy PEM file""" |
| 66 | + pem = Path(pemPath).read_text() |
| 67 | + if match := RE_DIRACX_PEM.search(pem): |
| 68 | + match = match.group(1) |
| 69 | + return json.loads(base64.b64decode(match).decode("utf-8")) |
| 70 | + |
| 71 | + |
| 72 | +@contextmanager |
| 73 | +def DiracXClient() -> _DiracClient: |
| 74 | + """Get a DiracX client instance with the current user's credentials""" |
| 75 | + diracxUrl = gConfig.getValue("/DiracX/URL") |
| 76 | + if not diracxUrl: |
| 77 | + raise ValueError("Missing mandatory /DiracX/URL configuration") |
| 78 | + |
| 79 | + proxyLocation = getDefaultProxyLocation() |
| 80 | + diracxToken = diracxTokenFromPEM(proxyLocation) |
| 81 | + |
| 82 | + with NamedTemporaryFile(mode="wt") as token_file: |
| 83 | + token_file.write(json.dumps(diracxToken)) |
| 84 | + token_file.flush() |
| 85 | + token_file.seek(0) |
| 86 | + |
| 87 | + pref = DiracxPreferences(url=diracxUrl, credentials_path=token_file.name) |
| 88 | + with _DiracClient(diracx_preferences=pref) as api: |
| 89 | + yield api |
0 commit comments