mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-28 13:31:18 +00:00
98 lines
2.7 KiB
Bash
Executable File
98 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# print-core-token.sh — print the active core RPC bearer token for the
|
|
# current deploy mode, so operators don't have to remember which side of the
|
|
# Tauri-vs-CLI / Docker-vs-binary split owns the value.
|
|
#
|
|
# Resolution order (matches src/core/auth.rs::init_rpc_token):
|
|
# 1. $OPENHUMAN_CORE_TOKEN if set and non-empty (Tauri / Docker / cloud)
|
|
# 2. ${OPENHUMAN_WORKSPACE:-$HOME/.openhuman}/core.token (standalone CLI)
|
|
#
|
|
# Usage:
|
|
# scripts/print-core-token.sh # print full token to stdout
|
|
# scripts/print-core-token.sh --redact # print first 8 hex chars + '…' only
|
|
# scripts/print-core-token.sh --where # print the source (env|file:path)
|
|
# and exit without revealing the value
|
|
#
|
|
# Exit codes:
|
|
# 0 success
|
|
# 1 no token configured (neither env nor file)
|
|
# 2 file exists but is unreadable / empty
|
|
#
|
|
# This script is read-only and never logs the token to syslog or to debug
|
|
# files. When invoked from CI, prefer --redact + --where so logs stay safe.
|
|
|
|
set -euo pipefail
|
|
|
|
mode="full"
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--redact)
|
|
mode="redact"
|
|
;;
|
|
--where)
|
|
mode="where"
|
|
;;
|
|
-h|--help)
|
|
sed -n '2,21p' "$0" | sed 's/^# \{0,1\}//'
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "print-core-token: unknown argument '$arg'" >&2
|
|
exit 64
|
|
;;
|
|
esac
|
|
done
|
|
|
|
env_token="${OPENHUMAN_CORE_TOKEN:-}"
|
|
workspace_dir="${OPENHUMAN_WORKSPACE:-$HOME/.openhuman}"
|
|
file_path="$workspace_dir/core.token"
|
|
|
|
source="" # one of: env | file
|
|
token=""
|
|
|
|
if [ -n "$env_token" ]; then
|
|
source="env"
|
|
token="$env_token"
|
|
elif [ -f "$file_path" ]; then
|
|
if [ ! -r "$file_path" ]; then
|
|
echo "print-core-token: $file_path exists but is not readable by $USER" >&2
|
|
exit 2
|
|
fi
|
|
token="$(tr -d '\n\r' < "$file_path" || true)"
|
|
if [ -z "$token" ]; then
|
|
echo "print-core-token: $file_path is empty" >&2
|
|
exit 2
|
|
fi
|
|
source="file:$file_path"
|
|
else
|
|
cat >&2 <<EOF
|
|
print-core-token: no core token configured.
|
|
|
|
Looked for:
|
|
1. \$OPENHUMAN_CORE_TOKEN environment variable (used by Tauri shell, Docker,
|
|
and any cloud deploy)
|
|
2. $file_path (standalone CLI 'openhuman core run' writes this on first
|
|
boot; override the directory with \$OPENHUMAN_WORKSPACE)
|
|
|
|
If you are running the dockerized core, set OPENHUMAN_CORE_TOKEN in your
|
|
.env (or the App Platform secrets UI) and bounce the container. See
|
|
gitbooks/features/cloud-deploy.md for the full single-source-of-truth setup.
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
case "$mode" in
|
|
full)
|
|
printf '%s\n' "$token"
|
|
;;
|
|
redact)
|
|
# Show enough to disambiguate two tokens without leaking the secret.
|
|
head_chars="${token:0:8}"
|
|
printf '%s…\n' "$head_chars"
|
|
;;
|
|
where)
|
|
printf '%s\n' "$source"
|
|
;;
|
|
esac
|