feat(auth): updates templates to align with keycloak, .env variables

Author: Matt-Carre

.devcontainer/devcontainer.json

@@ -49,7 +49,9 @@
         // Allow the container to access the host X11 display and EPICS CA
         // "--net=host",
         // Make sure SELinux does not disable with access to host filesystems like tmp
-        "--security-opt=label=disable"
+        "--security-opt=label=disable",
+        "--env-file",
+        "src/.env"
     ],
     "forwardPorts": [
         5173

pyproject.toml

@@ -19,6 +19,11 @@ dependencies = [
     "hera",
     "requests",
     "PyYAML",
+    "pillow",
+    "numpy",
+    "h5py",
+    "dotenv",
+    "python-keycloak",
 ] # Add project dependencies here, e.g. ["click", "numpy"]
 dynamic = ["version"]
 license.file = "LICENSE"
@@ -39,6 +44,8 @@ dev = [
     "pillow",
     "numpy",
     "h5py",
+    "dotenv",
+    "python-keycloak",
 ]
 
 [project.scripts]

src/copier_template/.devcontainer/devcontainer.json

@@ -49,7 +49,9 @@
         // Allow the container to access the host X11 display and EPICS CA
         // "--net=host",
         // Make sure SELinux does not disable with access to host filesystems like tmp
-        "--security-opt=label=disable"
+        "--security-opt=label=disable",
+        "--env-file",
+        "src/.env"
     ],
     "forwardPorts": [
         5173

src/copier_template/pyproject.toml.jinja

@@ -19,6 +19,11 @@ dependencies = [
     "hera",
     "requests",
     "PyYAML",
+    "pillow",
+    "numpy",
+    "h5py",
+    "dotenv",
+    "python-keycloak",
 ] # Add project dependencies here, e.g. ["click", "numpy"]
 dynamic = ["version"]
 license.file = "LICENSE"
@@ -36,8 +41,14 @@ dev = [
     "tox-uv",
     "types-mock",
     "PyYAML",
+    "pillow",
+    "numpy",
+    "h5py",
+    "dotenv",
+    "python-keycloak",
 ]
 
+
 [project.scripts]
 {{repo_name}} = "{{project_name}}.__main__:main"
 

src/copier_template/src/.env-sample

@@ -0,0 +1,5 @@
+HOST=
+IMAGE=
+TOKEN=
+NAMESPACE=
+AUTH=

src/copier_template/src/{{ project_name }}/auth/get_token.py

@@ -0,0 +1,47 @@
+import os
+
+import dotenv
+from keycloak import KeycloakOpenID
+from keycloak.pkce_utils import generate_code_challenge, generate_code_verifier
+
+from python_interface_to_workflows.auth.open_auth_url import open_auth_url
+
+
+def set_token_env_variable(staging: bool) -> str:
+    match staging:
+        case True:
+            keycloak_openid = KeycloakOpenID(
+                server_url="https://identity-test.diamond.ac.uk/",
+                client_id="workflows-ui-dev",
+                realm_name="dls",
+                client_secret_key="",
+                pool_maxsize=1,
+            )
+        case False:
+            keycloak_openid = KeycloakOpenID(
+                client_id="workflows-dashboard",
+                server_url="https://identity.diamond.ac.uk/",
+                realm_name="dls",
+                client_secret_key="",
+                pool_maxsize=1,
+            )
+    code_verifier = generate_code_verifier()
+    code_challenge, code_challenge_method = generate_code_challenge(code_verifier)
+    auth_url = keycloak_openid.auth_url(
+        redirect_uri="http://localhost:5173/",
+        scope="openid posix-uid profile email fedid",
+        state="",
+        code_challenge=code_challenge,
+        code_challenge_method=code_challenge_method,
+    )
+    open_auth_url(auth_url)
+    token: dict[str, str] = (  # pyright: ignore[reportUnknownVariableType]
+        keycloak_openid.token(  # pyright: ignore[reportUnknownMemberType]
+            grant_type="authorization_code",
+            code=os.environ["AUTH"],
+            redirect_uri="http://localhost:5173/",
+            code_verifier=code_verifier,
+        )
+    )
+    dotenv.set_key("src/.env", "TOKEN", token["access_token"].strip("'"))
+    return token["access_token"]  # pyright: ignore[reportUnknownArgumentType]

src/copier_template/src/{{ project_name }}/auth/keycloak_checker.py

@@ -0,0 +1,44 @@
+import os
+import socket
+import urllib.parse
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import cast
+
+import dotenv
+
+
+class _ReusingHTTPServer(HTTPServer):
+    allow_reuse_address = True
+    auth_code: str
+
+
+class CallbackHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        query = urllib.parse.urlparse(self.path).query
+        params = urllib.parse.parse_qs(query)
+        if "code" in params:
+            cast(_ReusingHTTPServer, self.server).auth_code = params["code"][0]
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"Authorization successful. You can close this window.")
+        else:
+            self.send_response(400)
+            self.end_headers()
+            self.wfile.write(b"Missing authorization code.")
+
+
+def open_auth_url(auth_url: str):
+    httpd = _ReusingHTTPServer(("localhost", 5173), CallbackHandler)
+    webbrowser.open(auth_url)
+    try:
+        httpd.handle_request()
+        os.environ["AUTH"] = httpd.auth_code
+        dotenv.set_key("src/.env", "AUTH", httpd.auth_code)
+    except OSError:
+        os.environ["AUTH"] = ""
+        print("ERROR: Port in use. Please restart your terminal.")
+        exit(1)
+    finally:
+        httpd.socket.shutdown(socket.SHUT_RDWR)
+        httpd.server_close()

src/copier_template/src/{{ project_name }}/auth/open_auth_url.py

@@ -0,0 +1,14 @@
+import os
+
+import dotenv
+from hera.shared import global_config
+
+from {{ project_name }}.auth.keycloak_checker import set_token_env_variable
+
+
+def prepare_to_submit(staging: bool):
+    set_token_env_variable(staging=staging)
+    dotenv.load_dotenv(dotenv_path="src/.env", override=True)
+    global_config.host = str(os.environ.get("HOST"))
+    global_config.image = str(os.environ.get("IMAGE"))
+    global_config.token = str(os.environ.get("TOKEN"))

src/copier_template/src/{{ project_name }}/submit_to_argo.py.jinja

@@ -5,8 +5,8 @@ metadata:
   namespace: ks10000-3
   annotations:
     workflows.argoproj.io/description: |-
-      Takes a numerical input and returns the
-               remainder, output float, and output string to a json file
+      Takes a numerical input and returns
+              the remainder, output float, and output string to a json file
     workflows.argoproj.io/title: Division via hera test
     workflows.diamond.ac.uk/repository: https://github.com/{{github_org}}/{{repo_name}}
   labels: