datacrew_resolver

datacrew_resolver

Multi-tenant auth resolver for the datacrew deployment (the integration spine).

Implements the AuthResolver contract: a dc_ token + an instance name -> DomoTokenAuth, by chaining verify(dc_) -> entitlement check -> fetch ciphertext -> decrypt -> DomoTokenAuth, with an in-memory cache keyed by (email, instance).

Dependencies are injected so the resolver is testable with fakes; the deployment supplies concrete impls (JWKS verify, /api/internal/domo-cred fetch over X-Webui-Secret, envelope decrypt with the VPS private key).

CredExpiredError

CredExpiredError(instance: str, email: str)

Bases: Exception

Stored Domo credential is expired/invalid — re-register the instance.

Source code in src/crew_dcs/mcp_server/datacrew_resolver.py

def __init__(self, instance: str, email: str):
    self.instance = instance
    self.email = email
    super().__init__(
        f"Domo credential for {email}@{instance} is expired or invalid — "
        f"re-register {instance} at datacrew.space/account."
    )

DatacrewResolver

DatacrewResolver(
    *,
    verify_token: Callable[[str | None], str],
    check_entitlement: Callable[[str], Awaitable[bool]],
    fetch_cred: Callable[[str, str], Awaitable[dict]],
    decrypt: Callable[[str], str],
    validate: Callable[[Any], Awaitable[bool]] | None = None
)

AuthResolver: dc_ token + instance -> DomoTokenAuth (multi-tenant).

Source code in src/crew_dcs/mcp_server/datacrew_resolver.py

def __init__(
    self,
    *,
    verify_token: Callable[[str | None], str],
    check_entitlement: Callable[[str], Awaitable[bool]],
    fetch_cred: Callable[[str, str], Awaitable[dict]],
    decrypt: Callable[[str], str],
    validate: Callable[[Any], Awaitable[bool]] | None = None,
):
    self._verify_token = verify_token
    self._check_entitlement = check_entitlement
    self._fetch_cred = fetch_cred
    self._decrypt = decrypt
    self._validate = validate
    self._cache: dict[tuple[str, str], DomoTokenAuth] = {}

EntitlementError

Bases: Exception

Caller lacks the entitlement required to use the Domo MCP.