feat(deploy): provision Unscouted smoke tenant (#22)

scripts/mint-local-publisher-credential.sh

@@ -3,9 +3,25 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 LOCAL_KEY="${RENDEZVOUS_SMOKE_LOCAL_KEY:-$ROOT/deploy/compose/secrets/signing-key}"
+GAME_ID="${RENDEZVOUS_LOCAL_CREDENTIAL_GAME_ID:-space-game}"
+
+case "$GAME_ID" in
+    space-game)
+        KEY_ID="local-smoke-1"
+        SUBJECT="local-smoke-host"
+        ;;
+    unscouted)
+        KEY_ID="local-smoke-unscouted-1"
+        SUBJECT="local-smoke-unscouted-host"
+        ;;
+    *)
+        printf 'RENDEZVOUS_LOCAL_CREDENTIAL_GAME_ID must be space-game or unscouted.\n' >&2
+        exit 2
+        ;;
+esac
 
 if (( $# != 0 )); then
-    printf 'This helper accepts no arguments and mints only the fixed local Compose smoke scope.\n' >&2
+    printf 'This helper accepts no arguments; select only a provisioned local game through RENDEZVOUS_LOCAL_CREDENTIAL_GAME_ID.\n' >&2
     exit 2
 fi
 
@@ -17,7 +33,7 @@ command -v python3 >/dev/null || {
 # This is deliberately a local-fixture tool, not a general credential issuer.
 # Python reads the raw key from the protected file; key material never appears in
 # a child process argument, environment value, temporary file, or command output.
-python3 - "$LOCAL_KEY" <<'PY'
+python3 - "$LOCAL_KEY" "$GAME_ID" "$KEY_ID" "$SUBJECT" <<'PY'
 import base64
 import hashlib
 import hmac
@@ -29,6 +45,9 @@ import sys
 import time
 
 key_path = sys.argv[1]
+game_id = sys.argv[2]
+key_id = sys.argv[3]
+subject = sys.argv[4]
 try:
     metadata = os.lstat(key_path)
 except FileNotFoundError:
@@ -55,9 +74,9 @@ payload = {
     "version": 1,
     "issuer": "final-factory-rendezvous-smoke",
     "audience": "rendezvous-service",
-    "subject": "local-smoke-host",
+    "subject": subject,
     "kind": "dedicatedPublisher",
-    "gameId": "space-game",
+    "gameId": game_id,
     "environmentId": "smoke",
     "regions": ["local"],
     "permissions": [],
@@ -71,7 +90,7 @@ def base64url(value: bytes) -> str:
     return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")
 
 encoded = base64url(json.dumps(payload, separators=(",", ":")).encode("utf-8"))
-signed = f"rv1.local-smoke-1.{encoded}"
+signed = f"rv1.{key_id}.{encoded}"
 signature = base64url(hmac.new(key, signed.encode("ascii"), hashlib.sha256).digest())
 print(f"{signed}.{signature}")
 PY