Publish curated Unraid-AppOps-Gateway source from 68878c3167dacf2b424c16780e60e0d60815e477

backend/app/services/deployment_control_plane.py

@@ -22,9 +22,10 @@ from ..connectors.portainer import PortainerConnector
 from ..connectors.unraid import UnraidConnector
 from ..core.time import utc_now
 from ..db.models import DeploymentJob, Policy
-from ..schemas.deployment import DeploymentPlanV1
+from ..schemas.deployment import DeploymentPlanV1, OidcProvisioningV1
 from .audit_logger import log_event
 from .deployment_broker import DeploymentBrokerClient
+from .enrollment_oidc_settings import bind_template, load_profile
 from .policy_engine import evaluate_policy
 from .secret_store import get_secret, has_secret, secret_storage_status
 
@@ -76,6 +77,29 @@ class DeploymentControlPlane:
         self.authentik = authentik or AuthentikConnector()
         self.unraid = unraid or UnraidConnector()
 
+    def _oidc_template_ready(self, session: Session, oidc: OidcProvisioningV1) -> bool:
+        bind_template(session, self.authentik)
+        groups = (
+            oidc.roles.administrator_group,
+            oidc.roles.support_agent_group,
+            oidc.roles.read_only_group,
+        )
+        profile = load_profile(session)
+        if profile and groups != (
+            profile.administrator_group,
+            profile.support_agent_group,
+            profile.read_only_group,
+        ):
+            return False
+        template = self.authentik.validate_deployment_oidc_template(
+            role_claim=oidc.role_claim, role_groups=groups,
+        )
+        if template.get("status") != "ready":
+            return False
+        inventory = self.authentik.groups()
+        names = {str(item.get("name") or "") for item in inventory.get("items", []) if isinstance(item, dict)}
+        return inventory.get("success") is True and set(groups).issubset(names)
+
     def preflight(
         self,
         session: Session,
@@ -139,6 +163,12 @@ class DeploymentControlPlane:
                     checks.append(_check("proxy_hostname", "blocked", "Requested hostname is owned by a different NPM target."))
 
         if plan.oidc:
+            ready = self._oidc_template_ready(session, plan.oidc)
+            checks.append(_check(
+                "oidc_template", "passed" if ready else "blocked",
+                "Requested OIDC claim, groups and root template are verified." if ready
+                else "Requested OIDC claim, groups or root template cannot be verified.",
+            ))
             auth_status = self.authentik.test_connection()
             if auth_status.get("status") != "connected":
                 checks.append(_check("oidc_provider", "blocked", "Authentik is unavailable for the requested OIDC plan."))
@@ -254,6 +284,8 @@ class DeploymentControlPlane:
         """
         evidence: dict[str, Any] = {}
         if plan.oidc:
+            if not self._oidc_template_ready(session, plan.oidc):
+                return False, evidence, "Requested OIDC claim, groups or root template cannot be verified after deployment."
             client_secret = get_secret(session, plan.oidc.client_secret_ref, touch=False)
             if not client_secret:
                 return False, evidence, "Referenced OIDC client secret is unavailable after deployment."