auth: add community token service seam

2026-05-03 18:26:03 +00:00
parent 18b23fcc0d
commit ffcce360fc
10 changed files with 329 additions and 10 deletions
@@ -12,12 +12,13 @@ use crank_core::{
    AsyncJobHandle, AuthConfig, AuthKind, AuthProfile, AuthProfileId, ConfigExport,
    EditionCapabilities, EditionLimits, ExecutionMode, ExportMode, GeneratedDraft,
    GeneratedDraftStatus, InvitationId, InvitationStatus, InvitationToken, InvocationLevel,
-    InvocationLog, InvocationLogId, InvocationSource, InvocationStatus, JobStatus,
-    MachineAccessMode, MembershipRole, OperationId, OperationSecurityLevel, OperationStatus,
-    PlatformApiKey, PlatformApiKeyId, PlatformApiKeyScope, PlatformApiKeyStatus, ProductEdition,
-    Protocol, SampleId, Samples, Secret, SecretId, SecretKind, SecretStatus, StreamSession,
-    StreamStatus, Target, TransportBehavior, UsagePeriod, UserId, UserSessionId, Workspace,
-    WorkspaceId, WorkspaceStatus,
+    InvocationLog, InvocationLogId, InvocationSource, InvocationStatus, IssueAgentTokenRequest,
+    IssueOneTimeAgentTokenRequest, IssuedAgentTokenResponse, JobStatus, MachineAccessMode,
+    MembershipRole, OperationId, OperationSecurityLevel, OperationStatus, PlatformApiKey,
+    PlatformApiKeyId, PlatformApiKeyScope, PlatformApiKeyStatus, ProductEdition, Protocol,
+    SampleId, Samples, Secret, SecretId, SecretKind, SecretStatus, StreamSession, StreamStatus,
+    Target, TransportBehavior, UsagePeriod, UserId, UserSessionId, Workspace, WorkspaceId,
+    WorkspaceStatus,
 };
 use crank_mapping::{JsonPathRoot, MappingSet, infer_mapping_from_samples};
 use crank_proto::{ProtoService, services_from_descriptor_set_bytes};
@@ -1584,6 +1585,42 @@ impl AdminService {
        }
    }

+    pub async fn issue_agent_token(
+        &self,
+        payload: IssueAgentTokenRequest,
+    ) -> Result<IssuedAgentTokenResponse, ApiError> {
+        let edition = self.get_capabilities().await.edition;
+        let machine_access_mode = MachineAccessMode::ShortLivedToken;
+
+        Err(ApiError::forbidden_with_context(
+            "short-lived machine access is not available in Community",
+            json!({
+                "edition": edition,
+                "machine_access_mode": machine_access_mode,
+                "grant_type": payload.grant_type,
+                "upgrade_required": true,
+            }),
+        ))
+    }
+
+    pub async fn issue_one_time_agent_token(
+        &self,
+        payload: IssueOneTimeAgentTokenRequest,
+    ) -> Result<IssuedAgentTokenResponse, ApiError> {
+        let edition = self.get_capabilities().await.edition;
+        let machine_access_mode = MachineAccessMode::OneTimeToken;
+
+        Err(ApiError::forbidden_with_context(
+            "one-time machine access is not available in Community",
+            json!({
+                "edition": edition,
+                "machine_access_mode": machine_access_mode,
+                "operation_id": payload.operation_id,
+                "upgrade_required": true,
+            }),
+        ))
+    }
+
    #[instrument(skip(self))]
    pub async fn list_stream_sessions(
        &self,