gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
48 lines
2.1 KiB
Python
48 lines
2.1 KiB
Python
"""FastAPI application factory."""
|
|
|
|
import logging
|
|
from collections.abc import Callable
|
|
|
|
from fastapi import FastAPI, HTTPException
|
|
from fastapi.staticfiles import StaticFiles
|
|
from .config import settings
|
|
from .db import SessionLocal, database_is_available
|
|
from .api import router
|
|
from .agent_distribution import router as agent_distribution_router
|
|
from .control_api import router as control_api_router
|
|
from .web import router as web_router
|
|
from .version import GTI_FISCAL_VERSION
|
|
|
|
logging.basicConfig(level=getattr(logging, settings.log_level.upper(), logging.INFO))
|
|
logger = logging.getLogger("gti_fiscal_hub")
|
|
|
|
|
|
def create_app(database_probe: Callable[[], bool] = database_is_available, session_factory=SessionLocal, bootstrap_token: str | None = None) -> FastAPI:
|
|
app = FastAPI(title="GTI Fiscal Hub", version=GTI_FISCAL_VERSION)
|
|
if settings.environment == "production" and settings.agent_dev_token:
|
|
raise RuntimeError("AGENT_DEV_TOKEN must not be set when APP_ENV=production (register real Agents with central/scripts/register_agent.py)")
|
|
logger.info("starting GTI Fiscal Hub (environment=%s)", settings.environment)
|
|
|
|
@app.get("/health")
|
|
def health() -> dict[str, str]:
|
|
if not database_probe():
|
|
logger.warning("health check failed: postgres unavailable")
|
|
raise HTTPException(status_code=503, detail="postgres unavailable")
|
|
return {"status": "ok"}
|
|
|
|
@app.get("/version")
|
|
def version() -> dict[str, str]:
|
|
from .classification import DECISION_VERSION, ENGINE_VERSION
|
|
from .version import API_COMPAT_MAJOR_MINOR, GTI_FISCAL_VERSION
|
|
return {"version": GTI_FISCAL_VERSION, "api_compat": API_COMPAT_MAJOR_MINOR, "engine_version": ENGINE_VERSION, "decision_version": DECISION_VERSION}
|
|
|
|
app.include_router(router(session_factory, settings.agent_dev_token if bootstrap_token is None else bootstrap_token))
|
|
app.include_router(control_api_router(session_factory))
|
|
app.include_router(agent_distribution_router(session_factory))
|
|
app.include_router(web_router(session_factory))
|
|
app.mount("/static", StaticFiles(directory="central/static"), name="static")
|
|
return app
|
|
|
|
|
|
app = create_app()
|