Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

scripts/provision_machine_client.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Provision one real Authentik service account as a project-bound MCP client."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from uuid import UUID
+
+_ROOT_DIR = Path(__file__).resolve().parents[1]
+if str(_ROOT_DIR) not in sys.path:
+    sys.path.insert(0, str(_ROOT_DIR))
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--subject", required=True, help="Exact validated Authentik token subject")
+    parser.add_argument("--oauth-username", required=True)
+    parser.add_argument("--name", required=True)
+    parser.add_argument("--project", required=True)
+    parser.add_argument("--environment", default="prod")
+    parser.add_argument("--issuer", default=os.environ.get("HUB_OIDC_ISSUER"))
+    parser.add_argument("--public-host", default="mcp.example.com")
+    parser.add_argument("--database-url", default=None)
+    parser.add_argument(
+        "--client-id",
+        type=UUID,
+        default=None,
+        help="Optional pending Hub client ID created by the management UI.",
+    )
+    args = parser.parse_args()
+    if not args.issuer:
+        parser.error("--issuer or HUB_OIDC_ISSUER is required")
+
+    from services.control_api.persistence.db import create_engine_from_url, session_factory
+    from services.control_api.persistence.machine_client import provision_machine_client
+    from services.runtime.common import hub_database_url
+
+    engine = create_engine_from_url(args.database_url or hub_database_url())
+    try:
+        sessions = session_factory(engine)
+        with sessions() as session, session.begin():
+            result = provision_machine_client(
+                session,
+                issuer=args.issuer,
+                subject=args.subject,
+                oauth_username=args.oauth_username,
+                name=args.name,
+                project_slug=args.project,
+                environment_name=args.environment,
+                public_host=args.public_host,
+                client_id=args.client_id,
+            )
+    finally:
+        engine.dispose()
+    print(
+        json.dumps(
+            {
+                "clientId": str(result.client_id),
+                "bindingId": str(result.binding_id),
+                "endpoint": result.endpoint,
+                "oauthUsername": args.oauth_username,
+            },
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())