cbc9ad73f7
Reference implementation of GCAP-SPEC-SHELLBOUND-BROKER-0001
in FastAPI. Designed for ISVs and enterprises implementing
the governed shell authorization protocol.
Architecture:
FastAPI + SQLModel + Pydantic + async SQLite
Single container deployment: Dockerfile included
OpenAPI schema at /docs is the machine-readable GSAP contract
Broker Interface (§5):
POST /governance/authorize/ — Issue AC
GET /governance/authorize/{p}/ — Poll elevation
POST /governance/complete/ — Receive CR
GET /governance/session/{id}/ — View chain of custody
POST /governance/elevate/ — JIT elevation
GET /governance/drivers/ — List drivers
Identity Driver Interface (§2.2):
IdentityDriver — abstract base (ISV extension point)
KeycloakDriver — Keycloak implementation
DriverRegistry — driver lookup and registration
Chronicle integration (§1.4):
Optional CloudEvents emission via CHRONICLE_WEBHOOK_URL
Forgejo push event format for receiver compatibility
Models:
Pydantic schemas for AC, CR, Principal, Accord, Operation
SQLModel DB models for persistence
Tests: 6 async tests including full AC→CR cycle
695 lines across 27 files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
16 lines
701 B
Python
16 lines
701 B
Python
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
from typing import Optional
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", case_sensitive=False)
|
|
broker_did: str = "did:web:gsap-broker.example.com"
|
|
broker_name: str = "fastapi-gsap"
|
|
ac_ttl_minutes: int = 30
|
|
chronicle_webhook_url: Optional[str] = None
|
|
keycloak_domain: str = "example.com"
|
|
keycloak_did_template: str = "did:web:{domain}/principal/{alias}"
|
|
keycloak_elevated_role_suffix: str = "-elevated"
|
|
database_url: str = "sqlite+aiosqlite:///./gsap_broker.db"
|
|
cors_origins: list[str] = ["http://localhost:3000", "http://localhost:8000"]
|
|
|
|
settings = Settings()
|