mino 1.6.0

Secure AI agent sandbox using rootless containers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

//! Azure credential provider using az CLI

use crate::config::schema::AzureConfig;
use crate::credentials::cache::{CachedCredential, CredentialCache};
use crate::error::{MinoError, MinoResult};
use chrono::{DateTime, Utc};
use serde::Deserialize;
use std::process::Stdio;
use tokio::process::Command;
use tracing::debug;

/// Azure credential provider
pub struct AzureCredentials;

impl AzureCredentials {
    const CACHE_KEY: &'static str = "azure-token";

    /// Get access token, using cache if valid
    pub async fn get_access_token(
        config: &AzureConfig,
        cache: &CredentialCache,
    ) -> MinoResult<String> {
        // Check cache first
        if let Some(cached) = cache.get(Self::CACHE_KEY).await? {
            debug!("Using cached Azure access token");
            return Ok(cached.value);
        }

        // Generate new token
        let (token, expires_at) = Self::get_access_token_internal(config).await?;

        // Cache the token
        let cached = CachedCredential::new("azure", token.clone(), expires_at);
        cache.set(Self::CACHE_KEY, &cached).await?;

        Ok(token)
    }

    /// Get access token from az CLI
    async fn get_access_token_internal(
        config: &AzureConfig,
    ) -> MinoResult<(String, DateTime<Utc>)> {
        debug!("Requesting Azure access token...");

        let mut cmd = Command::new("az");
        cmd.args(["account", "get-access-token", "--output", "json"]);

        if let Some(subscription) = &config.subscription {
            cmd.args(["--subscription", subscription]);
        }

        if let Some(tenant) = &config.tenant {
            cmd.args(["--tenant", tenant]);
        }

        cmd.stdout(Stdio::piped()).stderr(Stdio::piped());

        let output = cmd
            .output()
            .await
            .map_err(|e| MinoError::command_failed("az account get-access-token", e))?;

        if !output.status.success() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            if stderr.contains("az login") || stderr.contains("not logged in") {
                return Err(MinoError::AzureNotAuthenticated);
            }
            return Err(MinoError::AzureCredential(stderr.to_string()));
        }

        let response: AzureTokenResponse = serde_json::from_slice(&output.stdout)
            .map_err(|e| MinoError::AzureCredential(format!("Failed to parse response: {}", e)))?;

        let expires_at = DateTime::parse_from_rfc3339(&response.expires_on)
            .map(|dt| dt.with_timezone(&Utc))
            .unwrap_or_else(|_| Utc::now() + chrono::Duration::hours(1));

        Ok((response.access_token, expires_at))
    }

    /// Check if az CLI is authenticated
    pub async fn is_authenticated() -> bool {
        let result = Command::new("az")
            .args(["account", "show"])
            .stdout(Stdio::null())
            .stderr(Stdio::null())
            .status()
            .await;

        result.map(|s| s.success()).unwrap_or(false)
    }

    /// Get the current subscription
    pub async fn get_subscription() -> MinoResult<Option<String>> {
        let output = Command::new("az")
            .args(["account", "show", "--query", "id", "-o", "tsv"])
            .stdout(Stdio::piped())
            .stderr(Stdio::null())
            .output()
            .await
            .map_err(|e| MinoError::command_failed("az account show", e))?;

        if output.status.success() {
            let sub = String::from_utf8_lossy(&output.stdout).trim().to_string();
            if sub.is_empty() {
                Ok(None)
            } else {
                Ok(Some(sub))
            }
        } else {
            Ok(None)
        }
    }
}

#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
struct AzureTokenResponse {
    access_token: String,
    expires_on: String,
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn parse_azure_response() {
        let json = r#"{
            "accessToken": "token123",
            "expiresOn": "2024-01-01T12:00:00+00:00",
            "subscription": "sub123",
            "tenant": "tenant123",
            "tokenType": "Bearer"
        }"#;

        let response: AzureTokenResponse = serde_json::from_str(json).unwrap();
        assert_eq!(response.access_token, "token123");
    }
}