Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

scripts/authentik_provision_mcp_service_account.py

@@ -0,0 +1,82 @@
+"""Authentik-shell payload for an idempotent MCP service account and app password.
+
+Run by piping this file to ``ak shell`` with MCP_USERNAME, MCP_DISPLAY_NAME,
+MCP_TOKEN_IDENTIFIER and MCP_SECRET_FILE set inside the container. The secret
+is read from a temporary file and is never printed.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+from authentik.core.models import Token, TokenIntents, User, UserTypes
+from django.db import transaction
+
+
+def required(name: str) -> str:
+    value = os.environ.get(name, "").strip()
+    if not value:
+        raise ValueError(f"missing {name}")
+    return value
+
+
+username = required("MCP_USERNAME")
+display_name = required("MCP_DISPLAY_NAME")
+identifier = required("MCP_TOKEN_IDENTIFIER")
+secret_path = Path(required("MCP_SECRET_FILE"))
+if secret_path.is_symlink() or not secret_path.is_file() or secret_path.stat().st_size > 8192:
+    raise ValueError("invalid app-password secret file")
+secret = secret_path.read_text(encoding="utf-8").strip()
+if not secret or "\n" in secret or "\r" in secret:
+    raise ValueError("app-password secret must contain one non-empty line")
+
+with transaction.atomic():
+    user, created = User.objects.get_or_create(
+        username=username,
+        defaults={
+            "name": display_name,
+            "path": "users",
+            "type": UserTypes.SERVICE_ACCOUNT,
+        },
+    )
+    if not created and user.type not in {
+        UserTypes.SERVICE_ACCOUNT,
+        UserTypes.INTERNAL_SERVICE_ACCOUNT,
+    }:
+        raise ValueError("existing Authentik identity is not a service account")
+    if user.name != display_name:
+        user.name = display_name
+        user.save(update_fields=["name"])
+    token, token_created = Token.objects.get_or_create(
+        identifier=identifier,
+        defaults={
+            "user": user,
+            "intent": TokenIntents.INTENT_APP_PASSWORD,
+            "key": secret,
+            "expiring": False,
+            "description": "ITWorx MCP Hub Codex machine credential",
+        },
+    )
+    if not token_created:
+        if token.user_id != user.pk or token.intent != TokenIntents.INTENT_APP_PASSWORD:
+            raise ValueError("existing Authentik token identifier has incompatible ownership")
+        if os.environ.get("MCP_ROTATE", "false").lower() == "true":
+            token.key = secret
+            token.expiring = False
+            token.save(update_fields=["key", "expiring"])
+
+print(
+    json.dumps(
+        {
+            "created": created,
+            "tokenCreated": token_created,
+            "subject": str(user.uuid),
+            "username": user.username,
+            "tokenIdentifier": token.identifier,
+        },
+        sort_keys=True,
+    )
+)
+del secret