871541f0eb
Implements ConnectorPlugin for Intune Graph API operations. Governed invocation: every Intune call requires an active AC and emits a Chronicle CONNECTOR_INVOKED event. Operations: list, get, compliance check, sync, lock, retire, wipe. In-memory compliance cache with configurable TTL. Conditional registration via intune_enabled setting. Signed-off-by: Tyler King <tking@guildhouse.dev>
49 lines
2 KiB
Python
49 lines
2 KiB
Python
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
from typing import Optional
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", case_sensitive=False, extra="ignore")
|
|
broker_did: str = "did:web:gsap-broker.example.com"
|
|
broker_name: str = "fastapi-gsap"
|
|
ac_ttl_minutes: int = 30
|
|
chronicle_webhook_url: Optional[str] = None
|
|
keycloak_domain: str = "example.com"
|
|
keycloak_did_template: str = "did:web:{domain}/principal/{alias}"
|
|
keycloak_elevated_role_suffix: str = "-elevated"
|
|
database_url: str = "sqlite+aiosqlite:///./gsap_broker.db"
|
|
cors_origins: list[str] = ["http://localhost:3000", "http://localhost:8000"]
|
|
|
|
# ─── Delegation lifecycle (absorbed from llm-principal-broker) ───
|
|
# The delegation router lives in gsap_broker/delegations/ and shares
|
|
# the same async engine as the rest of GSAP. It used to be a separate
|
|
# service (llm-principal-broker) that called this broker over HTTP;
|
|
# now it's an in-process router that invokes the authorize handler
|
|
# directly. See gsap_broker/delegations/router.py.
|
|
|
|
# Keycloak Admin API (for the Keycloak agent registrar)
|
|
keycloak_url: str = "http://localhost:8080"
|
|
keycloak_realm: str = "substrate"
|
|
keycloak_admin_client_id: str = "llm-broker-admin"
|
|
keycloak_admin_client_secret: str = ""
|
|
|
|
# Agent registrar driver: auto | keycloak | entra | stub
|
|
agent_registrar: str = "auto"
|
|
|
|
# Microsoft Entra Agent ID
|
|
entra_tenant_id: str = ""
|
|
entra_client_id: str = ""
|
|
entra_client_secret: str = ""
|
|
entra_agent_blueprint_id: str = ""
|
|
|
|
# ── Intune / Device Management ──
|
|
intune_enabled: bool = False
|
|
intune_compliance_required: bool = False # global default for accord templates
|
|
intune_compliance_strict: bool = False # reject if no device_id present
|
|
intune_compliance_cache_ttl: int = 300 # seconds
|
|
|
|
# Delegation defaults
|
|
default_delegation_ttl_minutes: int = 60
|
|
default_max_commands: int = 500
|
|
max_delegation_depth: int = 1
|
|
|
|
settings = Settings()
|