tegwick
d9557ba90e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
44 lines
1.4 KiB
Python
Executable file
44 lines
1.4 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
"""Idempotently register coulomb.social in the live KeyCape Secret.
|
|
|
|
The complete Secret travels over stdin/stdout between kubectl and this
|
|
process. Secret values are never printed to the terminal or written to disk.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
import sys
|
|
|
|
import yaml
|
|
|
|
CLIENT_ID = "coulomb-social"
|
|
CLIENT = {
|
|
"clientId": CLIENT_ID,
|
|
"displayName": "coulomb.social",
|
|
"redirectUris": [
|
|
"http://127.0.0.1:8008/auth/callback/",
|
|
"http://localhost:8008/auth/callback/",
|
|
# Parallel public host while apex coulomb.social remains Bubble
|
|
"https://app.coulomb.social/auth/callback/",
|
|
# Future apex cutover (keep registered; not the live app host yet)
|
|
"https://coulomb.social/auth/callback/",
|
|
],
|
|
"allowedScopes": ["openid", "profile", "email", "groups"],
|
|
"grantTypes": ["authorization_code"],
|
|
"clientType": "public",
|
|
# Ordinary coulomb.social sessions are AAL1 unless the client explicitly
|
|
# requests AAL2 through acr_values. Platform/admin clients keep their
|
|
# existing provider-driven mandatory MFA behavior.
|
|
"mfaRequired": False,
|
|
}
|
|
|
|
|
|
def main() -> None:
|
|
print("Retired: use the owner-reviewed KeyCape client registration adapter; raw registry output is disabled.", file=sys.stderr)
|
|
raise SystemExit(2)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|