Source code for aidputils.agents.tools.http.http_auth

"""HTTP Tool auth helper.

This module uses the shared auth strategies under
aidputils.agents.auth.strategy to HttpTool needs:
  - Producing auth headers when applicable (Bearer/OAuth/NoAuth)

HttpTool intentionally bypasses template/header validation for auth headers
returned by strategies, since templating explicitly disallows sensitive headers
like Authorization.
"""

from __future__ import annotations

from typing import Any, Dict, Optional, Set, Tuple

from aidputils.agents.auth.strategy.auth_strategy_base import AuthStrategy
from aidputils.agents.auth.strategy.no_auth_strategy import NoAuthStrategy
from aidputils.agents.auth.strategy.bearer_strategy import BearerTokenAuthStrategy
from aidputils.agents.auth.strategy.oauth_strategy import OAuthAuthStrategy
# from aidputils.agents.auth.strategy.oci_resource_principal_strategy import (
#     OCIResourcePrincipalAuthStrategy,
# )
# Disabling till the security concern related to RP is figured out.


SUPPORTED_AUTH_TYPES: Set[str] = {
    "NO_AUTH",
    "BEARER_TOKEN",
    "OAUTH",
}




def build_auth_for_http(auth: Optional[dict]) -> Tuple[Dict[str, str], Any | None, str]:
    """Build auth headers and/or signer for HttpTool.

    Args:
        auth: Tool configuration dict. Expected shape:
            {"authType": "NO_AUTH"|"BEARER_TOKEN"|"OAUTH", ...}

    Returns:
        (auth_headers, signer, auth_type) where:
          - auth_headers: headers to merge into request headers
          - signer: optional signer object for GenericRestClient
          - auth_type: normalized auth type string (for metrics/logging)
    """

    auth = auth or {}
    auth_type = auth.get("authType", "NO_AUTH")

    if not isinstance(auth_type, str):
        raise ValueError("auth.authType must be a string when provided")

    norm_type = auth_type.strip().upper() or "NO_AUTH"
    if norm_type not in SUPPORTED_AUTH_TYPES:
        raise ValueError(
            f"Unsupported HTTP authType '{auth_type}'. Supported types: {sorted(SUPPORTED_AUTH_TYPES)}"
        )

    strategies: Dict[str, type[AuthStrategy]] = {
        "NO_AUTH": NoAuthStrategy,
        "BEARER_TOKEN": BearerTokenAuthStrategy,
        "OAUTH": OAuthAuthStrategy,
        # "OCI_RESOURCE_PRINCIPAL": OCIResourcePrincipalAuthStrategy,
        # Disabling till the security concern related to RP is figured out.
    }

    strategy_cls = strategies.get(norm_type)
    if not strategy_cls:
        # Defensive fallback (should not happen due to SUPPORTED_AUTH_TYPES gate)
        return {}, None, norm_type

    strategy = strategy_cls(auth)

    # Supported strategies are header-based; signer is optional for consistency.
    auth_headers = strategy.build_auth_headers()
    signer = strategy.get_signer()

    return auth_headers or {}, signer, norm_type



__all__ = ["SUPPORTED_AUTH_TYPES", "build_auth_for_http"]