feat: implement GEWU service and local agent workflows

scripts/provision_credential.py

@@ -0,0 +1,34 @@
+"""Provision one local service credential; the bearer key is shown only once."""
+
+from __future__ import annotations
+
+import argparse
+import os
+from pathlib import Path
+
+from gewu.adapters.sqlite_identity import SQLiteIdentityStore
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--credential-id", required=True)
+    parser.add_argument("--principal-id", required=True)
+    parser.add_argument(
+        "--role", action="append", choices=("admin", "editor", "viewer", "agent"), required=True
+    )
+    parser.add_argument("--project", action="append", default=[])
+    arguments = parser.parse_args()
+    data_root = Path(os.environ.get("GEWU_DATA_ROOT", "./.data/gewu")).expanduser().absolute()
+    data_root.mkdir(parents=True, exist_ok=True, mode=0o700)
+    token = SQLiteIdentityStore(data_root / "identity.sqlite3").provision(
+        credential_id=arguments.credential_id,
+        principal_id=arguments.principal_id,
+        roles=tuple(arguments.role),
+        project_ids=tuple(arguments.project),
+    )
+    print("Store this bearer credential securely; it cannot be displayed again:")
+    print(token)
+
+
+if __name__ == "__main__":
+    main()