generate-egress-token.py

#!/usr/bin/env python3
# generate_egress_token.py

import jwt
import time
from datetime import datetime, timedelta

# EC private key (ES256)
PRIVATE_KEY = """
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIJ... (your private key)
-----END EC PRIVATE KEY-----
"""

def generate_egress_token(container_id, user_id, allowed_hosts, duration_hours=4):
    """Generate egress control JWT"""

    now = int(time.time())
    payload = {
        "iss": "secure-egress-control",
        "iat": now,
        "exp": now + (duration_hours * 3600),
        "container_id": container_id,
        "organization_uuid": user_id,
        "allowed_hosts": ",".join(allowed_hosts),
        "is_hipaa_regulated": "false",
        "use_egress_gateway": "true",
        "enforce_container_binding": "true", # RECOMMENDED: Set to true
        "enforce_centralized_egress": "false"
    }

    token = jwt.encode(
        payload,
        PRIVATE_KEY,
        algorithm="ES256",
        headers={"kid": "your-ecdsa-key-id"}
    )

    return token

# Example usage
if __name__ == "__main__":
    allowed_hosts = [
        "api.example.com",
        "github.com",
        "npmjs.com",
        "pypi.org",
        "archive.ubuntu.com"
    ]

    token = generate_egress_token(
        container_id="sandbox_session_abc123",
        user_id="user_123",
        allowed_hosts=allowed_hosts
    )

    print(f"JWT Token: {token}")