tegwick
dc42b0344c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
53 lines
1.7 KiB
Python
53 lines
1.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Idempotently register the user-engine portal in the live KeyCape Secret.
|
|
|
|
The complete Secret travels over stdin/stdout between kubectl and this
|
|
process. Secret values are never printed to the terminal or written to disk.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
import sys
|
|
|
|
import yaml
|
|
|
|
CLIENT_ID = "user-engine-portal"
|
|
CLIENT = {
|
|
"clientId": CLIENT_ID,
|
|
"displayName": "User Engine Portal",
|
|
"redirectUris": ["https://users.92-205-62-239.nip.io/oidc/callback",
|
|
"https://users.coulomb.social/oidc/callback"],
|
|
"allowedScopes": ["openid", "profile", "email", "groups"],
|
|
"grantTypes": ["authorization_code"],
|
|
"clientType": "public",
|
|
}
|
|
|
|
|
|
def main() -> None:
|
|
secret = json.load(sys.stdin)
|
|
encoded = secret.get("data", {}).get("config.yaml")
|
|
if not encoded:
|
|
raise SystemExit("keycape-config does not contain config.yaml")
|
|
config = yaml.safe_load(base64.b64decode(encoded))
|
|
clients = config.setdefault("clients", [])
|
|
existing = next(
|
|
(index for index, client in enumerate(clients) if client.get("clientId") == CLIENT_ID),
|
|
None,
|
|
)
|
|
if existing is None:
|
|
clients.append(CLIENT)
|
|
else:
|
|
clients[existing] = CLIENT
|
|
rendered = yaml.safe_dump(config, sort_keys=False).encode()
|
|
secret["data"]["config.yaml"] = base64.b64encode(rendered).decode()
|
|
secret.pop("status", None)
|
|
metadata = secret.get("metadata", {})
|
|
for key in ("creationTimestamp", "managedFields", "resourceVersion", "uid"):
|
|
metadata.pop(key, None)
|
|
json.dump(secret, sys.stdout, separators=(",", ":"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|