75 lines
2.5 KiB
Python
75 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Provision one real Authentik service account as a project-bound MCP client."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
from uuid import UUID
|
|
|
|
_ROOT_DIR = Path(__file__).resolve().parents[1]
|
|
if str(_ROOT_DIR) not in sys.path:
|
|
sys.path.insert(0, str(_ROOT_DIR))
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--subject", required=True, help="Exact validated Authentik token subject")
|
|
parser.add_argument("--oauth-username", required=True)
|
|
parser.add_argument("--name", required=True)
|
|
parser.add_argument("--project", required=True)
|
|
parser.add_argument("--environment", default="prod")
|
|
parser.add_argument("--issuer", default=os.environ.get("HUB_OIDC_ISSUER"))
|
|
parser.add_argument("--public-host", default="mcp.example.com")
|
|
parser.add_argument("--database-url", default=None)
|
|
parser.add_argument(
|
|
"--client-id",
|
|
type=UUID,
|
|
default=None,
|
|
help="Optional pending Hub client ID created by the management UI.",
|
|
)
|
|
args = parser.parse_args()
|
|
if not args.issuer:
|
|
parser.error("--issuer or HUB_OIDC_ISSUER is required")
|
|
|
|
from services.control_api.persistence.db import create_engine_from_url, session_factory
|
|
from services.control_api.persistence.machine_client import provision_machine_client
|
|
from services.runtime.common import hub_database_url
|
|
|
|
engine = create_engine_from_url(args.database_url or hub_database_url())
|
|
try:
|
|
sessions = session_factory(engine)
|
|
with sessions() as session, session.begin():
|
|
result = provision_machine_client(
|
|
session,
|
|
issuer=args.issuer,
|
|
subject=args.subject,
|
|
oauth_username=args.oauth_username,
|
|
name=args.name,
|
|
project_slug=args.project,
|
|
environment_name=args.environment,
|
|
public_host=args.public_host,
|
|
client_id=args.client_id,
|
|
)
|
|
finally:
|
|
engine.dispose()
|
|
print(
|
|
json.dumps(
|
|
{
|
|
"clientId": str(result.client_id),
|
|
"bindingId": str(result.binding_id),
|
|
"endpoint": result.endpoint,
|
|
"oauthUsername": args.oauth_username,
|
|
},
|
|
sort_keys=True,
|
|
)
|
|
)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|