test "X-NLS-Signature" upper/lowercase

ref. https://git.collinwebdesigns.de/nvidia/nls/-/blob/main/src/test/test_config_token.py

.gitlab-ci.yml

@@ -16,12 +16,12 @@ build:docker:
   interruptible: true
   stage: build
   rules:
-    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+    # deployment is in "deploy:docker:"
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
       changes:
         - app/**/*
         - Dockerfile
         - requirements.txt
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
   tags: [ docker ]
   before_script:
     - docker buildx inspect
@@ -41,19 +41,17 @@ build:apt:
   interruptible: true
   stage: build
   rules:
+    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_COMMIT_TAG
       variables:
         VERSION: $CI_COMMIT_REF_NAME
-    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
       changes:
         - app/**/*
         - .DEBIAN/**/*
         - .gitlab-ci.yml
       variables:
         VERSION: "0.0.1"
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-      variables:
-        VERSION: "0.0.1"
   before_script:
     - echo -e "VERSION=$VERSION\nCOMMIT=$CI_COMMIT_SHA" > version.env
     # install build dependencies
@@ -94,16 +92,13 @@ build:pacman:
     - if: $CI_COMMIT_TAG
       variables:
         VERSION: $CI_COMMIT_REF_NAME
-    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
       changes:
         - app/**/*
         - .PKGBUILD/**/*
         - .gitlab-ci.yml
       variables:
         VERSION: "0.0.1"
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-      variables:
-        VERSION: "0.0.1"
   before_script:
     #- echo -e "VERSION=$VERSION\nCOMMIT=$CI_COMMIT_SHA" > version.env
     # install build dependencies
@@ -168,11 +163,12 @@ test:
 .test:apt:
   stage: test
   rules:
-    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
       changes:
         - app/**/*
         - .DEBIAN/**/*
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+        - .gitlab-ci.yml
   needs:
     - job: build:apt
       artifacts: true
@@ -217,11 +213,12 @@ test:apt:
 test:pacman:archlinux:
   image: archlinux:base
   rules:
-    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
       changes:
         - app/**/*
         - .PKGBUILD/**/*
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+        - .gitlab-ci.yml
   needs:
     - job: build:pacman
       artifacts: true

app/main.py

@@ -7,6 +7,7 @@ from hashlib import sha256
 from json import loads as json_loads
 from os import getenv as env
 from os.path import join, dirname, isfile
+from random import randbytes
 from uuid import uuid4
 
 from dateutil.relativedelta import relativedelta
@@ -369,8 +370,8 @@ async def auth_v1_code(request: Request):
 
     response = {
         "auth_code": auth_code,
+        "prompts": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     return JSONr(response)
@@ -403,18 +404,18 @@ async def auth_v1_token(request: Request):
         'iss': 'https://cls.nvidia.org',
         'aud': 'https://cls.nvidia.org',
         'exp': timegm(access_expires_on.timetuple()),
-        'origin_ref': origin_ref,
         'key_ref': SITE_KEY_XID,
         'kid': SITE_KEY_XID,
+        'origin_ref': origin_ref,
     }
 
     auth_token = jwt.encode(new_payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256)
 
     response = {
-        "expires": access_expires_on.strftime(DT_FORMAT),
         "auth_token": auth_token,
+        "expires": access_expires_on.strftime(DT_FORMAT),
+        "prompts": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     return JSONr(response)
@@ -689,21 +690,21 @@ async def leasing_v1_lessor(request: Request):
         lease_ref = str(uuid4())
         expires = cur_time + LEASE_EXPIRE_DELTA
         lease_result_list.append({
-            "ordinal": None,
             "error": None,
             # https://docs.nvidia.com/license-system/latest/nvidia-license-system-user-guide/index.html
             "lease": {
-                "ref": lease_ref,
                 "created": cur_time.strftime(DT_FORMAT),
                 "expires": expires.strftime(DT_FORMAT),
-                "recommended_lease_renewal": LEASE_RENEWAL_PERIOD,
-                "offline_lease": "false",  # todo
-                "license_type": "CONCURRENT_COUNTED_SINGLE",
-                "lease_intent_id": None,
-                "metadata": None,
                 "feature_name": "GRID-Virtual-WS",  # todo
+                "lease_intent_id": None,
+                "license_type": "CONCURRENT_COUNTED_SINGLE",
+                "metadata": None,
+                "offline_lease": False,  # todo
                 "product_name": "NVIDIA RTX Virtual Workstation",  # todo
-            }
+                "recommended_lease_renewal": LEASE_RENEWAL_PERIOD,
+                "ref": lease_ref,
+            },
+            "ordinal": None,
         })
 
         data = Lease(origin_ref=origin_ref, lease_ref=lease_ref, lease_created=cur_time, lease_expires=expires)
@@ -712,19 +713,15 @@ async def leasing_v1_lessor(request: Request):
     response = {
         "client_challenge": j.get('client_challenge'),
         "lease_result_list": lease_result_list,
+        "prompts": None,
         "result_code": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     logger.debug(response)
 
-    si_certificate_filename = join(dirname(__file__), 'cert/my_demo_si_certificate.pem')
-    my_si_certificate = Cert.from_file(si_certificate_filename)
-    signature = my_si_certificate.signature().hex()
-    signature = f'b\'{signature}\''
-
-    return JSONr(response, headers={'X-NLS-Signature': signature})
+    signature = f'b\'{randbytes(256).hex()}\''
+    return JSONr(response, headers={'access-control-expose-headers': 'X-NLS-Signature', 'X-NLS-Signature': signature})
 
 
 # venv/lib/python3.9/site-packages/nls_services_lease/test/test_lease_multi_controller.py
@@ -740,8 +737,8 @@ async def leasing_v1_lessor_lease(request: Request):
 
     response = {
         "active_lease_list": active_lease_list,
+        "prompts": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     return JSONr(response)
@@ -763,17 +760,20 @@ async def leasing_v1_lease_renew(request: Request, lease_ref: str):
     expires = cur_time + LEASE_EXPIRE_DELTA
     response = {
         "client_challenge": j.get('client_challenge'),
-        "lease_ref": lease_ref,
         "expires": expires.strftime(DT_FORMAT),
-        "recommended_lease_renewal": LEASE_RENEWAL_PERIOD,
+        "feature_expired": False,
+        "lease_ref": lease_ref,
+        "metadata": None,
         "offline_lease": True,
         "prompts": None,
+        "recommended_lease_renewal": LEASE_RENEWAL_PERIOD,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
     }
 
     Lease.renew(db, entity, expires, cur_time)
 
-    return JSONr(response)
+    signature = f'b\'{randbytes(256).hex()}\''
+    return JSONr(response, headers={'access-control-expose-headers': 'X-NLS-Signature', 'X-NLS-Signature': signature})
 
 
 # venv/lib/python3.9/site-packages/nls_services_lease/test/test_lease_single_controller.py
@@ -817,8 +817,8 @@ async def leasing_v1_lessor_lease_remove(request: Request):
     response = {
         "released_lease_list": released_lease_list,
         "release_failure_list": None,
+        "prompts": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     return JSONr(response)
@@ -839,8 +839,8 @@ async def leasing_v1_lessor_shutdown(request: Request):
     response = {
         "released_lease_list": released_lease_list,
         "release_failure_list": None,
+        "prompts": None,
         "sync_timestamp": cur_time.strftime(DT_FORMAT),
-        "prompts": None
     }
 
     return JSONr(response)

test/main.py

@@ -212,6 +212,8 @@ def test_leasing_v1_lessor():
 
     client_challenge = response.json().get('client_challenge')
     assert client_challenge == payload.get('client_challenge')
+    signature = eval(response.headers.get('X-NLS-Signature'))
+    assert len(signature) == 512
 
     lease_result_list = response.json().get('lease_result_list')
     assert len(lease_result_list) == 1
@@ -242,6 +244,8 @@ def test_leasing_v1_lease_renew():
 
     client_challenge = response.json().get('client_challenge')
     assert client_challenge == payload.get('client_challenge')
+    signature = eval(response.headers.get('X-NLS-Signature'))
+    assert len(signature) == 512
 
     lease_ref = response.json().get('lease_ref')
     assert len(lease_ref) == 36