gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
20 lines
462 B
TOML
20 lines
462 B
TOML
[project]
|
|
name = "gti-fiscal-hub"
|
|
version = "1.1.0"
|
|
requires-python = ">=3.10"
|
|
dependencies = [
|
|
"fastapi>=0.115,<1",
|
|
"jinja2>=3.1,<4",
|
|
"uvicorn[standard]>=0.30,<1",
|
|
"sqlalchemy>=2.0,<3",
|
|
"psycopg[binary]>=3.2,<4",
|
|
"alembic>=1.13,<2",
|
|
"httpx>=0.27,<1",
|
|
"openpyxl>=3.1,<4",
|
|
"pypdf>=4.0,<6",
|
|
"pdfplumber>=0.11,<1",
|
|
# SSO from GTI Gerenciador (central/app/sso.py): Ed25519-signed JWT assertions.
|
|
"pyjwt>=2.14,<3",
|
|
"cryptography>=50,<51",
|
|
]
|