cbc9ad73f7
Reference implementation of GCAP-SPEC-SHELLBOUND-BROKER-0001
in FastAPI. Designed for ISVs and enterprises implementing
the governed shell authorization protocol.
Architecture:
FastAPI + SQLModel + Pydantic + async SQLite
Single container deployment: Dockerfile included
OpenAPI schema at /docs is the machine-readable GSAP contract
Broker Interface (§5):
POST /governance/authorize/ — Issue AC
GET /governance/authorize/{p}/ — Poll elevation
POST /governance/complete/ — Receive CR
GET /governance/session/{id}/ — View chain of custody
POST /governance/elevate/ — JIT elevation
GET /governance/drivers/ — List drivers
Identity Driver Interface (§2.2):
IdentityDriver — abstract base (ISV extension point)
KeycloakDriver — Keycloak implementation
DriverRegistry — driver lookup and registration
Chronicle integration (§1.4):
Optional CloudEvents emission via CHRONICLE_WEBHOOK_URL
Forgejo push event format for receiver compatibility
Models:
Pydantic schemas for AC, CR, Principal, Accord, Operation
SQLModel DB models for persistence
Tests: 6 async tests including full AC→CR cycle
695 lines across 27 files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
17 lines
880 B
Python
17 lines
880 B
Python
"""POST /governance/elevate/ — JIT elevation"""
|
|
import uuid
|
|
from fastapi import APIRouter, Depends
|
|
from sqlmodel.ext.asyncio.session import AsyncSession
|
|
from gsap_broker.db import get_session
|
|
from gsap_broker.db_models import ElevationRequestDB
|
|
from gsap_broker.models import ElevateRequest, ElevateResponse
|
|
|
|
router = APIRouter()
|
|
|
|
@router.post("/elevate/", response_model=ElevateResponse, summary="Request JIT elevation")
|
|
async def elevate(request: ElevateRequest, db: AsyncSession = Depends(get_session)):
|
|
er = ElevationRequestDB(id=uuid.uuid4(), role_name=request.role_name,
|
|
justification=request.justification, duration_minutes=request.duration_minutes)
|
|
db.add(er); await db.commit()
|
|
return ElevateResponse(status="pending", elevation_id=str(er.id),
|
|
message=f"Elevation to '{request.role_name}' requested.")
|