445f1361dc
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
49 lines
1.8 KiB
Python
49 lines
1.8 KiB
Python
#!/usr/bin/env python3
|
|
"""Silent contained callback update; preserve the existing administrator role."""
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
|
|
ROLE = 'auth/netkingdom/role/platform-admin'
|
|
CALLBACK = 'http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback'
|
|
|
|
|
|
def read_role():
|
|
result = subprocess.run(['bao', 'read', '-format=json', ROLE],
|
|
capture_output=True, check=True, timeout=30)
|
|
role = json.loads(result.stdout)['data']
|
|
if (role.get('role_type') != 'oidc'
|
|
or 'platform-admin' not in role.get('token_policies', role.get('policies', []))
|
|
or not isinstance(role.get('allowed_redirect_uris'), list)
|
|
or not all(isinstance(uri, str) for uri in role['allowed_redirect_uris'])):
|
|
raise ValueError('unexpected role')
|
|
return role
|
|
|
|
|
|
def update(read=read_role, write=None):
|
|
original = read()
|
|
if CALLBACK in original['allowed_redirect_uris']:
|
|
return False
|
|
desired = dict(original, allowed_redirect_uris=original['allowed_redirect_uris'] + [CALLBACK])
|
|
if read() != original:
|
|
raise ValueError('role changed before write')
|
|
# The endpoint has no CAS: this detects observed drift, not an atomic lock.
|
|
if write is None:
|
|
subprocess.run(['bao', 'write', ROLE, '-'], input=json.dumps(desired).encode(),
|
|
capture_output=True, check=True, timeout=30)
|
|
else:
|
|
write(desired)
|
|
if read() != desired:
|
|
raise ValueError('role readback differs')
|
|
return True
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
if sys.argv[1:] == ['--check-only']:
|
|
sys.exit(0 if CALLBACK in read_role()['allowed_redirect_uris'] else 3)
|
|
if sys.argv[1:]:
|
|
sys.exit(2)
|
|
update()
|
|
except Exception:
|
|
sys.exit(1)
|