120 lines
4.0 KiB
Python
120 lines
4.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Tiny token endpoint for the voice UI.
|
|
|
|
Serves POST /token -> { "token": "<signed JWT>" }
|
|
Signs a LiveKit access token with HS256 using the API key/secret from env.
|
|
|
|
The token carries a roomConfig claim requesting the voice-assistant agent, so
|
|
LiveKit dispatches the agent when the participant joins. Without this, the
|
|
auto-created room would get no agent at all.
|
|
|
|
Runs as a separate supervisord process; nginx proxies /token to it.
|
|
"""
|
|
import base64
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import os
|
|
import time
|
|
import uuid
|
|
|
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
|
|
|
API_KEY = os.environ.get("LIVEKIT_API_KEY", "devkey")
|
|
API_SECRET = os.environ.get("LIVEKIT_API_SECRET", "devsecret")
|
|
AGENT_NAME = os.environ.get("VOICE_AGENT_NAME", "voice-assistant")
|
|
USERS_FILE = os.environ.get("VOICE_USERS_FILE", "/etc/hope/users.json")
|
|
DEFAULT_USER = os.environ.get("VOICE_DEFAULT_USER", "shane")
|
|
|
|
|
|
def load_default_user() -> tuple[str, dict]:
|
|
with open(USERS_FILE, encoding="utf-8") as users_file:
|
|
registry = json.load(users_file)
|
|
profile = registry.get("users", {}).get(DEFAULT_USER)
|
|
if not isinstance(profile, dict):
|
|
raise ValueError(f"unknown default voice user: {DEFAULT_USER}")
|
|
return DEFAULT_USER, profile
|
|
|
|
|
|
def b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
|
|
|
|
|
|
def make_token(room_name: str, identity: str) -> str:
|
|
now = int(time.time())
|
|
header = {"alg": "HS256", "typ": "JWT"}
|
|
payload = {
|
|
"iss": API_KEY,
|
|
"sub": identity,
|
|
"nbf": now - 5,
|
|
"exp": now + 3600,
|
|
"jti": str(uuid.uuid4()),
|
|
"identity": identity,
|
|
"video": {
|
|
"roomJoin": True,
|
|
"room": room_name,
|
|
"canPublish": True,
|
|
"canSubscribe": True,
|
|
"canPublishData": True,
|
|
},
|
|
"roomConfig": {
|
|
"agents": [{"agentName": AGENT_NAME, "jobType": "JT_ROOM"}],
|
|
},
|
|
}
|
|
h = b64url(json.dumps(header).encode())
|
|
p = b64url(json.dumps(payload).encode())
|
|
signing_input = f"{h}.{p}".encode()
|
|
sig = hmac.new(API_SECRET.encode(), signing_input, hashlib.sha256).digest()
|
|
return f"{h}.{p}.{b64url(sig)}"
|
|
|
|
|
|
class Handler(BaseHTTPRequestHandler):
|
|
def do_POST(self):
|
|
if self.path != "/token":
|
|
self.send_response(404)
|
|
self.end_headers()
|
|
return
|
|
|
|
length = int(self.headers.get("Content-Length", 0))
|
|
# Consume the body for protocol compatibility, but never trust a
|
|
# browser-supplied room or identity. This LAN bootstrap deployment is
|
|
# pinned to VOICE_DEFAULT_USER until the planned login flow is added.
|
|
self.rfile.read(length)
|
|
try:
|
|
user_id, profile = load_default_user()
|
|
except (OSError, ValueError, json.JSONDecodeError) as exc:
|
|
resp = json.dumps({"error": str(exc)}).encode()
|
|
self.send_response(503)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.send_header("Content-Length", str(len(resp)))
|
|
self.end_headers()
|
|
self.wfile.write(resp)
|
|
return
|
|
|
|
room_name = f"voice-{user_id}-{uuid.uuid4().hex[:8]}"
|
|
identity = profile.get("livekit_identity") or f"user:{user_id}"
|
|
token = make_token(room_name, identity)
|
|
resp = json.dumps(
|
|
{
|
|
"token": token,
|
|
"user": {
|
|
"id": user_id,
|
|
"display_name": profile.get("display_name") or user_id,
|
|
},
|
|
}
|
|
).encode()
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.send_header("Content-Length", str(len(resp)))
|
|
self.end_headers()
|
|
self.wfile.write(resp)
|
|
|
|
def log_message(self, format, *args):
|
|
pass # silence request logging
|
|
|
|
|
|
if __name__ == "__main__":
|
|
server = HTTPServer(("127.0.0.1", 8091), Handler)
|
|
print("token endpoint listening on 127.0.0.1:8091")
|
|
server.serve_forever()
|