From 7f2acdecb94fc48ddac3b4a9d272ebab753d2793 Mon Sep 17 00:00:00 2001 From: github-ops Date: Thu, 14 May 2026 17:03:05 +0000 Subject: [PATCH] core: introduce public auth extension seam --- TASKS.md | 22 ++++++++++++--- apps/mcp-server/src/auth.rs | 36 ++++++------------------- crates/crank-core/src/ext/access.rs | 1 + crates/crank-core/src/ext/audit.rs | 1 + crates/crank-core/src/ext/auth.rs | 28 +++++++++++++++++++ crates/crank-core/src/ext/capability.rs | 1 + crates/crank-core/src/ext/mod.rs | 5 ++++ crates/crank-core/src/ext/protocol.rs | 1 + crates/crank-core/src/lib.rs | 5 ++++ 9 files changed, 68 insertions(+), 32 deletions(-) create mode 100644 crates/crank-core/src/ext/access.rs create mode 100644 crates/crank-core/src/ext/audit.rs create mode 100644 crates/crank-core/src/ext/auth.rs create mode 100644 crates/crank-core/src/ext/capability.rs create mode 100644 crates/crank-core/src/ext/mod.rs create mode 100644 crates/crank-core/src/ext/protocol.rs diff --git a/TASKS.md b/TASKS.md index 76c86c6..b66cc3a 100644 --- a/TASKS.md +++ b/TASKS.md @@ -115,19 +115,33 @@ Progress: ### `feat/common-public-improvements` -Status: ready +Status: in_progress Goal: - вносить общие улучшения в публичную базу, которые потом синхронно переносятся в `enterprise` и `cloud`. +- начать Wave 1 modularization из `modular_decomposition.xml` без изменения поведения Community runtime. Main code areas: - общий Community runtime/UI/API surface +- `crates/crank-core` +- `apps/mcp-server` +- `/home/github-ops/crank/docs/modular_decomposition.xml` Implementation slices: -1. делать изменение в `crank-community`; -2. переносить тот же change set в `crank-enterprise`; -3. переносить тот же change set в `crank-cloud`. +1. выполнять общие изменения сначала в `crank-community`; +2. брать архитектурные slices из `modular_decomposition.xml`, а не из legacy cleanup backlog; +3. после стабилизации базовой границы подтягивать ее в private repos по зафиксированной sync model. DoD: - общий функционал не расходится между тремя редакциями без необходимости; - Community остается source base для общей open-core логики. + +Verification: +- `cargo check --workspace` +- таргетные compile/test checks для затронутого бинаря или crate + +Progress: +- done: + - Phase 0 / task `0.1`: создан `crank-core::ext` module skeleton + - Phase 0 / task `0.2`: `MachineCredentialVerifier` и связанные типы вынесены из `apps/mcp-server` в public seam `crank_core::ext::auth` + - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено diff --git a/apps/mcp-server/src/auth.rs b/apps/mcp-server/src/auth.rs index b0a82c0..bd95f8a 100644 --- a/apps/mcp-server/src/auth.rs +++ b/apps/mcp-server/src/auth.rs @@ -1,36 +1,14 @@ -use std::sync::Arc; - use async_trait::async_trait; -use crank_core::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope}; - -#[derive(Clone, Debug, PartialEq, Eq)] -pub struct VerifiedMachineCredential { - pub machine_access_mode: MachineAccessMode, - pub max_security_level: OperationSecurityLevel, - pub scopes: Vec, -} - -#[async_trait] -pub trait MachineCredentialVerifier: Send + Sync { - async fn verify_bearer_token( - &self, - workspace_slug: &str, - agent_slug: &str, - token: &str, - ) -> Result, MachineCredentialVerifierError>; -} - -pub type SharedMachineCredentialVerifier = Arc; +pub use crank_core::{ + MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier, + VerifiedMachineCredential, +}; #[derive(Clone, Default)] -pub struct CommunityMachineCredentialVerifier; - -#[derive(Debug, thiserror::Error)] -#[error("machine credential verifier failed")] -pub struct MachineCredentialVerifierError; +pub struct StaticAgentKeyVerifier; #[async_trait] -impl MachineCredentialVerifier for CommunityMachineCredentialVerifier { +impl MachineCredentialVerifier for StaticAgentKeyVerifier { async fn verify_bearer_token( &self, _workspace_slug: &str, @@ -40,3 +18,5 @@ impl MachineCredentialVerifier for CommunityMachineCredentialVerifier { Ok(None) } } + +pub use StaticAgentKeyVerifier as CommunityMachineCredentialVerifier; diff --git a/crates/crank-core/src/ext/access.rs b/crates/crank-core/src/ext/access.rs new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/crates/crank-core/src/ext/access.rs @@ -0,0 +1 @@ + diff --git a/crates/crank-core/src/ext/audit.rs b/crates/crank-core/src/ext/audit.rs new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/crates/crank-core/src/ext/audit.rs @@ -0,0 +1 @@ + diff --git a/crates/crank-core/src/ext/auth.rs b/crates/crank-core/src/ext/auth.rs new file mode 100644 index 0000000..c182dd0 --- /dev/null +++ b/crates/crank-core/src/ext/auth.rs @@ -0,0 +1,28 @@ +use std::sync::Arc; + +use async_trait::async_trait; + +use crate::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope}; + +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct VerifiedMachineCredential { + pub machine_access_mode: MachineAccessMode, + pub max_security_level: OperationSecurityLevel, + pub scopes: Vec, +} + +#[derive(Debug, thiserror::Error)] +#[error("machine credential verifier failed")] +pub struct MachineCredentialVerifierError; + +#[async_trait] +pub trait MachineCredentialVerifier: Send + Sync { + async fn verify_bearer_token( + &self, + workspace_slug: &str, + agent_slug: &str, + token: &str, + ) -> Result, MachineCredentialVerifierError>; +} + +pub type SharedMachineCredentialVerifier = Arc; diff --git a/crates/crank-core/src/ext/capability.rs b/crates/crank-core/src/ext/capability.rs new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/crates/crank-core/src/ext/capability.rs @@ -0,0 +1 @@ + diff --git a/crates/crank-core/src/ext/mod.rs b/crates/crank-core/src/ext/mod.rs new file mode 100644 index 0000000..69d10c5 --- /dev/null +++ b/crates/crank-core/src/ext/mod.rs @@ -0,0 +1,5 @@ +pub mod access; +pub mod audit; +pub mod auth; +pub mod capability; +pub mod protocol; diff --git a/crates/crank-core/src/ext/protocol.rs b/crates/crank-core/src/ext/protocol.rs new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/crates/crank-core/src/ext/protocol.rs @@ -0,0 +1 @@ + diff --git a/crates/crank-core/src/lib.rs b/crates/crank-core/src/lib.rs index 2dde309..d268ed6 100644 --- a/crates/crank-core/src/lib.rs +++ b/crates/crank-core/src/lib.rs @@ -3,6 +3,7 @@ pub mod agent; pub mod auth; pub mod cache; pub mod edition; +pub mod ext; pub mod ids; pub mod observability; pub mod operation; @@ -31,6 +32,10 @@ pub use cache::{ pub use edition::{ EditionCapabilities, EditionLimits, MachineAccessMode, OperationSecurityLevel, ProductEdition, }; +pub use ext::auth::{ + MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier, + VerifiedMachineCredential, +}; pub use ids::{ AgentId, AsyncJobId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId, PlatformApiKeyId, SampleId, SecretId, StreamSessionId, ToolId, UserId, UserSessionId,