Spaces:
Running
Running
| """Resolve the deployment administrator credential once, without safe defaults.""" | |
| import logging | |
| import os | |
| import secrets | |
| from functools import lru_cache | |
| def _warn_legacy_alias(): | |
| logging.getLogger(__name__).warning( | |
| "BRAINPAT_TOKEN is deprecated; configure SYSTEM_PAT instead." | |
| ) | |
| def resolve_system_pat(environ=None) -> str | None: | |
| env = os.environ if environ is None else environ | |
| canonical = env.get("SYSTEM_PAT") or None | |
| legacy = env.get("BRAINPAT_TOKEN") or None | |
| if canonical and legacy and not secrets.compare_digest(canonical, legacy): | |
| raise ValueError("SYSTEM_PAT_CONFLICT: configure one administrator credential") | |
| if not canonical and legacy: | |
| _warn_legacy_alias() | |
| resolved = canonical or legacy | |
| if resolved == "brainpat_default_token": | |
| raise ValueError("SYSTEM_PAT_INVALID: default administrator credentials are forbidden") | |
| if not resolved and env.get("ENV", "production").lower() != "development": | |
| raise ValueError("SYSTEM_PAT_REQUIRED: configure an administrator credential") | |
| return resolved | |