Jon Chery
14809327fb
---ci--- project: acdl phase: 4 milestone: v1.28 status: execute persona: cli-engineer ---
38 lines
1.3 KiB
Python
38 lines
1.3 KiB
Python
"""nova auth revoke --pat <jti> — revoke a PAT (REQ-344, D-229)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import sys
|
|
|
|
from core.auth_store import emit_revoke_audit
|
|
|
|
|
|
def add_parser(subparsers):
|
|
p = subparsers.add_parser("revoke", help="revoke a PAT by jti")
|
|
p.add_argument("--pat", required=True, help="PAT jti to revoke")
|
|
p.add_argument("--endpoint", default=os.environ.get("NOVA_TOKEN_VEND_URL", ""),
|
|
help="token-vend function URL (empty = local DDB)")
|
|
p.set_defaults(_run=run)
|
|
|
|
|
|
def _revoke_remote(jti: str, endpoint: str) -> dict:
|
|
import json, urllib.request
|
|
body = json.dumps({"action": "revoke_pat", "jti": jti}).encode()
|
|
req = urllib.request.Request(endpoint, data=body, headers={"Content-Type": "application/json"})
|
|
with urllib.request.urlopen(req, timeout=30) as r:
|
|
return json.loads(r.read())
|
|
|
|
|
|
def run(args) -> int:
|
|
try:
|
|
if args.endpoint and args.endpoint.startswith("http"):
|
|
_revoke_remote(args.pat, args.endpoint)
|
|
else:
|
|
from core.pat_lifecycle import revoke_pat
|
|
revoke_pat(args.pat)
|
|
emit_revoke_audit(args.pat)
|
|
print(f"revoked: jti={args.pat}")
|
|
return 0
|
|
except Exception as e:
|
|
print(f"error: {e}", file=sys.stderr); return 2 |