AkurAI-Build

Latest change e16ed955e37bc7f7b00de000a208ef91006cf60e - Adopt the AkurAI ID SSO contract and inject pipeline build context by AkurAI Build

#!/usr/bin/env bash
set -euo pipefail

# Reads temporary administrator credentials only from a mode-0600 file, creates
# the OIDC client, stores its generated secret in PassVault, then removes the
# temporary file. It never prints either credential.
CONFIG=${AKURAI_BUILD_PROVISION_ENV:-"$HOME/.config/akurai-build/provision.env"}
[[ -f $CONFIG ]] || { echo "missing protected provisioning environment" >&2; exit 1; }
[[ $(stat -c '%a' "$CONFIG") == 600 ]] || { echo "provisioning environment must be mode 0600" >&2; exit 1; }
# shellcheck disable=SC1090
source "$CONFIG"
: "${AKURAI_IDP_ADMIN_TOKEN:?missing AKURAI_IDP_ADMIN_TOKEN}"
: "${AKURAI_IDP_TENANT_ID:?missing AKURAI_IDP_TENANT_ID}"
: "${AKURAI_PASSVAULT_TOKEN:?missing AKURAI_PASSVAULT_TOKEN}"

root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"; rm -f "$CONFIG"' EXIT
chmod 700 "$tmp"

python3 - "$tmp/create.json" "$AKURAI_IDP_TENANT_ID" <<'PY'
import json, sys
json.dump({"name":"AkurAI Build","tenant_id":sys.argv[2],"redirect_uris":["https://akurai-build.olibuijr.com/auth/callback"],"grant_types":["authorization_code","refresh_token"],"scopes":["openid","profile","email","groups"],"first_party":True}, open(sys.argv[1], "w"))
PY
printf 'header = "Authorization: Bearer %s"\n' "$AKURAI_IDP_ADMIN_TOKEN" > "$tmp/idp.curl"
printf 'header = "Content-Type: application/json"\n' >> "$tmp/idp.curl"
printf 'data = @%s\n' "$tmp/create.json" >> "$tmp/idp.curl"
chmod 600 "$tmp/idp.curl"
curl --fail --silent --show-error --config "$tmp/idp.curl" "https://auth.olibuijr.com/admin/clients" > "$tmp/client.json"

python3 - "$tmp/client.json" "$tmp/vault.json" <<'PY'
import json, sys
client=json.load(open(sys.argv[1]))
json.dump({"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_entry","arguments":{"name":"AkurAI Build OIDC client","username":client["id"],"password":client["client_secret"],"uri":"https://auth.olibuijr.com","notes":"Managed by AkurAI Build provisioning; callback https://akurai-build.olibuijr.com/auth/callback","folderId":0}}}, open(sys.argv[2], "w"))
PY
printf 'header = "Authorization: Bearer %s"\n' "$AKURAI_PASSVAULT_TOKEN" > "$tmp/vault.curl"
printf 'header = "Content-Type: application/json"\n' >> "$tmp/vault.curl"
printf 'data = @%s\n' "$tmp/vault.json" >> "$tmp/vault.curl"
chmod 600 "$tmp/vault.curl"
curl --fail --silent --show-error --config "$tmp/vault.curl" "https://akurai-passvault.olibuijr.com/mcp" >/dev/null

python3 - "$tmp/client.json" "$HOME/.config/akurai-build/env" <<'PY'
import json, os, sys
client=json.load(open(sys.argv[1])); path=sys.argv[2]
lines=[]
if os.path.exists(path):
    lines=[line for line in open(path).read().splitlines() if not line.startswith(("AKURAI_IDP_CLIENT_ID=", "AKURAI_IDP_CLIENT_SECRET="))]
lines += [f"AKURAI_IDP_CLIENT_ID={client['id']}", f"AKURAI_IDP_CLIENT_SECRET={client['client_secret']}"]
open(path,"w").write("\n".join(lines)+"\n"); os.chmod(path,0o600)
PY
printf '%s\n' 'OIDC client provisioned and stored without exposing credentials.'