chore: import upstream snapshot with attribution

2026-07-13 12:11:14 +08:00
commit 39a1aa29cb
373 changed files with 46576 additions and 0 deletions
@@ -0,0 +1,48 @@
+"""
+Mint a self-signed dev token for local testing of app.py.
+
+First run generates dev_private.pem + dev_jwks.json in the current directory.
+Subsequent runs reuse them.
+
+    python mint_dev_token.py --oid alice --group <gid> --group <gid2>
+"""
+import argparse, json, os, time, base64
+import jwt
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+PRIV = "dev_private.pem"
+JWKS = "dev_jwks.json"
+AUDIENCE = "c2995f31-11e7-4882-b7a7-ef9def0a0266"
+TENANT_ID = os.getenv("TENANT_ID", "dev-tenant")
+ISSUER = f"https://login.microsoftonline.com/{TENANT_ID}/v2.0"
+
+def b64u(n: int) -> str:
+    raw = n.to_bytes((n.bit_length() + 7) // 8, "big")
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+if not os.path.exists(PRIV):
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    with open(PRIV, "wb") as f:
+        f.write(key.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.PKCS8,
+            serialization.NoEncryption(),
+        ))
+    nums = key.public_key().public_numbers()
+    jwk = {"kty": "RSA", "kid": "dev", "alg": "RS256", "use": "sig",
+           "n": b64u(nums.n), "e": b64u(nums.e)}
+    with open(JWKS, "w") as f:
+        json.dump({"keys": [jwk]}, f, indent=2)
+
+ap = argparse.ArgumentParser()
+ap.add_argument("--oid", default="alice")
+ap.add_argument("--group", action="append", default=[])
+args = ap.parse_args()
+
+with open(PRIV, "rb") as f:
+    priv = serialization.load_pem_private_key(f.read(), password=None)
+
+claims = {"aud": AUDIENCE, "iss": ISSUER, "oid": args.oid,
+          "groups": args.group, "exp": int(time.time()) + 3600}
+print(jwt.encode(claims, priv, algorithm="RS256", headers={"kid": "dev"}))