main.go

package main

import (
	"context"
	"log"

	"github.com/AndriyKalashnykov/authentik-k8s/gotest/internal/authentik"
	api "goauthentik.io/api/v3"
)

const (
	AuthentikServerScheme         = "https"
	AuthentikServerHost           = "127.0.0.1:9443"                                               //"172.18.255.200:443"
	AuthentikBootstrapToken       = "NoMlxBQuYgfu3j19ygGqhjXenAjrJgOfN5naqmSDBUhdLjYqHKze7yyzY07H" // see AUTHENTIK_BOOTSTRAP_TOKEN in K8s manifests
	Orgs                          = "orgs/"
	Org1                          = "org-01"
	Org2                          = "org-02"
	GroupOrg1Admins               = Org1 + "-admins"
	GroupOrg1AdminsIsSuperUser    = true // can login to Authentic admin Web UI interface
	GroupOrg1Admin                = Org1 + "-admin"
	GroupOrg1AdminPwd             = "Authentik01234567890!"
	GroupOrg1AdminToken           = "ZId4CDEtmHbnuxkJH2ehUzHgYeTmOansuCO0JsTTsZnYB1z9N0WoAutpyH4i"
	GroupOrg1AdminTokenIdentifier = GroupOrg1Admin + "-token"
	GroupOrg1Users                = Org1 + "-users"
	GroupOrg1UsersIsSuperUser     = false // can login to Authentic admin Web UI interface
	GroupOrg1User                 = Org1 + "-user"
	GroupOrg1UserPwd              = GroupOrg1AdminPwd
	GroupOrg1UserToken            = "e3qVF1uGTL5DKjglvMKpDYk60X7s89jnbNh9nPEpFYzSgoOHYDSMi0xxYhYr"
	GroupOrg1UserTokenIdentifier  = GroupOrg1User + "-token"

	GroupOrg2Admins               = Org2 + "-admins"
	GroupOrg2AdminsIsSuperUser    = true // can login to Authentic admin Web UI interface
	GroupOrg2Admin                = Org2 + "-admin"
	GroupOrg2AdminPwd             = GroupOrg1AdminPwd
	GroupOrg2AdminToken           = "ZId4CDEtmHbnuxkJH2ehUzHgYeTmOansuCO0JsTTsZnYB1z9N0WoAutpyH4i"
	GroupOrg2AdminTokenIdentifier = GroupOrg2Admin + "-token"
	GroupOrg2Users                = Org2 + "-users"
	GroupOrg2UsersIsSuperUser     = false // can login to Authentic admin Web UI interface
	GroupOrg2User                 = Org2 + "-user"
	GroupOrg2UserPwd              = GroupOrg1AdminPwd
	GroupOrg2UserToken            = "svkH90FMYlnXPA5JHxePVQkozTjXReT6rsdQ2BXedwI5mtrFYR5mfrunMt4B"
	GroupOrg2UserTokenIdentifier  = GroupOrg2User + "-token"
)

func CreateGroupsAndUsers(ctx context.Context, authentikServerScheme string, authentikServerHost string, authentikBootstrapToken string, groupName string, isGroupSuperUser bool,
	userName string, userPath string, userPassword string, userTokenIdentifier string, userToken string) {

	// create authentic API client using AuthentikBootstrapToken used during Authentik deployment
	akadminConfig := authentik.CreateConfiguration(authentikServerScheme, authentikServerHost, authentikBootstrapToken)
	akadminApiClient := api.NewAPIClient(akadminConfig)

	// create a group
	// will create new group with different pk
	grp, _, err := authentik.CreateGroup(ctx, akadminApiClient, groupName, isGroupSuperUser)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	groupUID := grp.Pk
	log.Printf("groupUID: %v\n", groupUID)

	// create a user and assign it to previously created group
	usr, _, err := authentik.CreateUser(ctx, akadminApiClient, groupUID, userName, userPath)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	userUID := usr.Pk
	log.Printf("userUID: %v\n", userUID)

	// create user's password
	resp, err := authentik.UpdateUserPassword(ctx, akadminApiClient, userUID, userPassword)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	if resp != nil {

	}

	// create user's OAuth token
	token, resp, err := authentik.CreateUserToken(ctx, akadminApiClient, userUID, userTokenIdentifier, userTokenIdentifier)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	if token != nil {
		log.Printf("Token: %v", token)
	}

	// retrieve user's OAuth token generated by Authentik
	tv, _, err := authentik.RetrieveUserToken(ctx, akadminApiClient, userTokenIdentifier)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	if tv != nil {
		log.Printf("OAuth token: %v", tv.Key)
	}

	// update user's OAuth token with custom key value
	resp, err = authentik.UpdateUserToken(ctx, akadminApiClient, userTokenIdentifier, userToken)
	if err != nil {
		log.Printf("error: %v", err)
	}
	if tv != nil {
		log.Printf("resp: %v", resp.Body)
	}

	// retrieve user's OAuth token with custom key value
	tvnew, _, err := authentik.RetrieveUserToken(ctx, akadminApiClient, userTokenIdentifier)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	if tv != nil {
		log.Printf("OAuth token: %v", tvnew.Key)
	}

	// check if Oauth token was set
	if tvnew.Key == userToken {
		log.Printf("GroupOrg1AdminToken was set ")
	} else {
		log.Printf("Something went wrong: setting GroupOrg1AdminToken")
	}

	// create authentic API client using user's Oauth token from previous step
	userConfig := authentik.CreateConfiguration(authentikServerScheme, authentikServerHost, tvnew.Key)
	userApiClient := api.NewAPIClient(userConfig)

	// get user's info
	su, _, err := authentik.MeRetrieveUser(ctx, userApiClient)
	if err != nil {
		log.Panicf("error: %v", err)
	}
	if su != nil {
		log.Printf("User Groups: %v", su.GetUser().Groups)
	}

	// can this user create a group?
	//grp, _, err = authentik.CreateGroup(ctx, userApiClient, "demo-group-created-by-"+userName, false)
	//if err != nil {
	//	log.Printf("error: %v", err)
	//}
	//groupUID = grp.Pk
	//log.Printf("groupUID: %v\n", groupUID)
}

func main() {
	ctx := context.Background()

	// org1 admin + user
	CreateGroupsAndUsers(ctx, AuthentikServerScheme, AuthentikServerHost, AuthentikBootstrapToken, GroupOrg1Admins, GroupOrg1AdminsIsSuperUser, GroupOrg1Admin, Orgs+Org1, GroupOrg1AdminPwd,
		GroupOrg1AdminTokenIdentifier, GroupOrg1AdminToken)
	CreateGroupsAndUsers(ctx, AuthentikServerScheme, AuthentikServerHost, AuthentikBootstrapToken, GroupOrg1Users, GroupOrg1UsersIsSuperUser, GroupOrg1User, Orgs+Org1, GroupOrg1UserPwd,
		GroupOrg1UserTokenIdentifier, GroupOrg1UserToken)

	// org2 admin + user
	CreateGroupsAndUsers(ctx, AuthentikServerScheme, AuthentikServerHost, AuthentikBootstrapToken, GroupOrg2Admins, GroupOrg2AdminsIsSuperUser, GroupOrg2Admin, Orgs+Org2, GroupOrg2AdminPwd,
		GroupOrg2AdminTokenIdentifier, GroupOrg2AdminToken)
	CreateGroupsAndUsers(ctx, AuthentikServerScheme, AuthentikServerHost, AuthentikBootstrapToken, GroupOrg2Users, GroupOrg2UsersIsSuperUser, GroupOrg2User, Orgs+Org2, GroupOrg2UserPwd,
		GroupOrg2UserTokenIdentifier, GroupOrg2UserToken)
}