mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
19fdf55ceb
A key now opens with what it is allowed to touch. `pk-` is publishable and safe in a browser; `sk-` is secret and never leaves a server. The five marks it replaces all began `ph` -- the upstream's initials -- and they were the last of its brand a customer read back to us, in every SDK snippet. No word rule could reach them, because `ph` is not a word. The marks were also not telling the truth. The constant said `phc_` while every live project token said `hi_`, so the middleware that routes on the constant matched no real token at all. Two spellings existed and one was fiction. Minting now happens in exactly one function and reading in exactly one, so a second spelling has nowhere to live. `phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark now says only that a value is secret; which store holds it is settled by asking. That was already how personal keys worked -- keys minted before the marks carry none, so the store always decided -- and both secret resolvers already returned None on a miss and fell through, so one shared extractor replaces the two that could drift apart. OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`, because the parser tells them apart before either is looked up, and the domain-verification token becomes `vt-` rather than keeping a sixth mint of its own. `bin/debrand --check` now refuses the marks as a shape, so a seventh cannot be coined. Two rules that were about to rename things that are not ours to spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow` rules no longer reach a Postgres table, a Datastore table or a route. Keys are stored hashed, so a mark cannot be rewritten in place: the three live project tokens have to be reminted.
72 lines
2.9 KiB
Bash
Executable File
72 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# insightscli `ai_gateway` capability entry — one-shot local ai-gateway in resolver
|
|
# mode with a real sk- credential.
|
|
#
|
|
# Provisioning lives in bin/setup-gateway-e2e: enable the team, mint the sk-,
|
|
# publish the credential blob to the gateway's valkey, set resolver mode, fund
|
|
# the ledger. We run it (retried until Insights's DB/migrations are ready), start
|
|
# the gateway on the host under air, then once it's up — and has created its
|
|
# ledger schema on first boot — re-run setup so the topup lands on a truly fresh
|
|
# stack. The runner picks up the gateway from its dev config defaults (no
|
|
# .env.local needed); with the ai_gateway capability disabled this is unused.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
AI_GATEWAY_REPO="${AI_GATEWAY_REPO:-$HOME/Development/ai-gateway}"
|
|
GATEWAY_URL="${AI_GATEWAY_LOCAL_URL:-http://localhost:8080}"
|
|
|
|
if [ ! -d "$AI_GATEWAY_REPO" ]; then
|
|
cat >&2 <<EOF
|
|
[start-ai-gateway] No sibling clone at $AI_GATEWAY_REPO.
|
|
git clone [email protected]:Insights/ai-gateway.git "$AI_GATEWAY_REPO"
|
|
Or disable the ai_gateway capability — the runner falls back to direct providers.
|
|
Override the path with AI_GATEWAY_REPO=... if your clone lives elsewhere.
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
# Pin the sibling gateway's compose project to its own name — Insights's dev env
|
|
# exports COMPOSE_PROJECT_NAME=insights, which would otherwise scope the gateway's
|
|
# containers under the insights project. Inherited by setup-gateway-e2e and the
|
|
# sibling's `bin/start gateway` below.
|
|
export COMPOSE_PROJECT_NAME=ai-gateway
|
|
|
|
# Provision (deps + resolver mode + sk- + blob; ledger funding is best-effort
|
|
# until the gateway has booted once). Retry until Insights's DB/migrations ready.
|
|
provisioned=false
|
|
for i in $(seq 1 10); do
|
|
if "$REPO_ROOT/bin/setup-gateway-e2e"; then
|
|
provisioned=true
|
|
break
|
|
fi
|
|
echo "[start-ai-gateway] waiting for Insights (db/migrations) before provisioning (attempt $i/10)..."
|
|
sleep 3
|
|
done
|
|
|
|
# Don't start the gateway without a credential — it would boot in resolver mode
|
|
# and 401 every request with no signal. Fail loud instead.
|
|
if [ "$provisioned" != true ]; then
|
|
echo "[start-ai-gateway] provisioning failed after 10 attempts (see Django output above) — aborting." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Once the gateway is listening — it migrates the ledger schema before serving —
|
|
# re-run setup so the topup lands (a no-op once the team is already funded). Runs
|
|
# in the background so it doesn't block the gateway, and survives the exec below.
|
|
(
|
|
for _ in $(seq 1 60); do
|
|
if curl -sf "$GATEWAY_URL/livez" >/dev/null 2>&1; then
|
|
"$REPO_ROOT/bin/setup-gateway-e2e" >/dev/null 2>&1 || true
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
) &
|
|
|
|
# Run the gateway on the host. bin/start brings up the sibling deps and runs
|
|
# under air with hot reload; it reads AI_GATEWAY_AUTH_MODE=resolver from the
|
|
# sibling .env that setup-gateway-e2e wrote.
|
|
cd "$AI_GATEWAY_REPO"
|
|
exec bin/start gateway
|