feat: rename rails/ to tools/ and add service tool suites

Rename the `rails/` directory to `tools/` for agent discoverability — agents frequently failed to locate helper scripts due to the non-intuitive directory name. Add backward-compat symlink `rails/ → tools/`. New tool suites: - Authentik: auth-token, user-list, user-create, group-list, app-list, flow-list, admin-status (8 scripts) - Coolify: team-list, project-list, service-list, service-status, deploy, env-set (7 scripts) - Woodpecker: pipeline-list, pipeline-status, pipeline-trigger (3 stubs) - GLPI: session-init, computer-list, ticket-list, ticket-create, user-list (6 scripts) - Health: stack-health.sh — stack-wide connectivity check Infrastructure: - Shared credential loader at tools/_lib/credentials.sh - install.sh creates symlink + chmod on tool scripts - All ~253 rails/ path references updated across 68+ files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-22 11:51:39 -06:00
parent 248db8935c
commit 80c3680ccb
158 changed files with 2481 additions and 213 deletions
--- a/tools/authentik/README.md
+++ b/tools/authentik/README.md
@@ -0,0 +1,59 @@
+# Authentik Tool Suite
+
+Manage Authentik identity provider (SSO, users, groups, applications, flows) via CLI.
+
+## Prerequisites
+
+- `jq` installed
+- Authentik credentials in `~/src/jarvis-brain/credentials.json` (or `$MOSAIC_CREDENTIALS_FILE`)
+- Required fields: `authentik.url`, `authentik.username`, `authentik.password`
+
+## Authentication
+
+Scripts use `auth-token.sh` to auto-authenticate via username/password and cache the API token at `~/.cache/mosaic/authentik-token`. The token is validated on each use and refreshed automatically when expired.
+
+For better security, create a long-lived API token in Authentik admin (Directory > Tokens) and set `$AUTHENTIK_TOKEN` in your environment — the scripts will use it directly.
+
+## Scripts
+
+| Script | Purpose |
+|--------|---------|
+| `auth-token.sh` | Authenticate and cache API token |
+| `user-list.sh` | List users (search, filter by group) |
+| `user-create.sh` | Create user with optional group assignment |
+| `group-list.sh` | List groups |
+| `app-list.sh` | List OAuth/SAML applications |
+| `flow-list.sh` | List authentication flows |
+| `admin-status.sh` | System health and version info |
+
+## Common Options
+
+All scripts support:
+- `-f json` — JSON output (default: table)
+- `-h` — Show help
+
+## API Reference
+
+- Base URL: `https://auth.diversecanvas.com`
+- API prefix: `/api/v3/`
+- OpenAPI schema: `/api/v3/schema/`
+- Auth: Bearer token in `Authorization` header
+
+## Examples
+
+```bash
+# List all users
+~/.config/mosaic/tools/authentik/user-list.sh
+
+# Search for a user
+~/.config/mosaic/tools/authentik/user-list.sh -s "jason"
+
+# Create a user in the admins group
+~/.config/mosaic/tools/authentik/user-create.sh -u newuser -n "New User" -e new@example.com -g admins
+
+# List OAuth applications as JSON
+~/.config/mosaic/tools/authentik/app-list.sh -f json
+
+# Check system health
+~/.config/mosaic/tools/authentik/admin-status.sh
+```
--- a/tools/authentik/admin-status.sh
+++ b/tools/authentik/admin-status.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+#
+# admin-status.sh — Authentik system health and version info
+#
+# Usage: admin-status.sh [-f format]
+#
+# Options:
+#   -f format   Output format: table (default), json
+#   -h          Show this help
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+FORMAT="table"
+
+while getopts "f:h" opt; do
+  case $opt in
+    f) FORMAT="$OPTARG" ;;
+    h) head -11 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f format]" >&2; exit 1 ;;
+  esac
+done
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+response=$(curl -sk -w "\n%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "${AUTHENTIK_URL}/api/v3/admin/system/")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "200" ]]; then
+  echo "Error: Failed to get system status (HTTP $http_code)" >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.'
+  exit 0
+fi
+
+echo "Authentik System Status"
+echo "======================="
+echo "$body" | jq -r '
+  "  URL:            \(.http_host // "unknown")\n" +
+  "  Version:        \(.runtime.authentik_version // "unknown")\n" +
+  "  Python:         \(.runtime.python_version // "unknown")\n" +
+  "  Workers:        \(.runtime.gunicorn_workers // "unknown")\n" +
+  "  Build Hash:     \(.runtime.build_hash // "unknown")\n" +
+  "  Embedded Outpost: \(.embedded_outpost_host // "unknown")"
+'
--- a/tools/authentik/app-list.sh
+++ b/tools/authentik/app-list.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# app-list.sh — List Authentik applications
+#
+# Usage: app-list.sh [-f format] [-s search]
+#
+# Options:
+#   -f format   Output format: table (default), json
+#   -s search   Search by application name
+#   -h          Show this help
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+FORMAT="table"
+SEARCH=""
+
+while getopts "f:s:h" opt; do
+  case $opt in
+    f) FORMAT="$OPTARG" ;;
+    s) SEARCH="$OPTARG" ;;
+    h) head -12 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f format] [-s search]" >&2; exit 1 ;;
+  esac
+done
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+PARAMS="ordering=name"
+[[ -n "$SEARCH" ]] && PARAMS="${PARAMS}&search=${SEARCH}"
+
+response=$(curl -sk -w "\n%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "${AUTHENTIK_URL}/api/v3/core/applications/?${PARAMS}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "200" ]]; then
+  echo "Error: Failed to list applications (HTTP $http_code)" >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.results'
+  exit 0
+fi
+
+echo "NAME                          SLUG                          PROVIDER           LAUNCH URL"
+echo "----------------------------  ----------------------------  -----------------  ----------------------------------------"
+echo "$body" | jq -r '.results[] | [
+  .name,
+  .slug,
+  (.provider_obj.name // "none"),
+  (.launch_url // "—")
+] | @tsv' | while IFS=$'\t' read -r name slug provider launch_url; do
+  printf "%-28s  %-28s  %-17s  %s\n" \
+    "${name:0:28}" "${slug:0:28}" "${provider:0:17}" "$launch_url"
+done
--- a/tools/authentik/auth-token.sh
+++ b/tools/authentik/auth-token.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+#
+# auth-token.sh — Obtain and cache Authentik API token
+#
+# Usage: auth-token.sh [-f] [-q]
+#
+# Returns a valid Authentik API token. Checks in order:
+#   1. Cached token at ~/.cache/mosaic/authentik-token (if valid)
+#   2. Pre-configured token from credentials.json (authentik.token)
+#   3. Fails with instructions to create a token in the admin UI
+#
+# Options:
+#   -f    Force re-validation (ignore cached token)
+#   -q    Quiet mode — only output the token
+#   -h    Show this help
+#
+# Environment variables (or credentials.json):
+#   AUTHENTIK_URL    — Authentik instance URL
+#   AUTHENTIK_TOKEN  — Pre-configured API token (recommended)
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+CACHE_DIR="$HOME/.cache/mosaic"
+CACHE_FILE="$CACHE_DIR/authentik-token"
+FORCE=false
+QUIET=false
+
+while getopts "fqh" opt; do
+  case $opt in
+    f) FORCE=true ;;
+    q) QUIET=true ;;
+    h) head -20 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f] [-q]" >&2; exit 1 ;;
+  esac
+done
+
+_validate_token() {
+  local token="$1"
+  local http_code
+  http_code=$(curl -sk -o /dev/null -w "%{http_code}" \
+    --connect-timeout 5 --max-time 10 \
+    -H "Authorization: Bearer $token" \
+    "${AUTHENTIK_URL}/api/v3/core/users/me/")
+  [[ "$http_code" == "200" ]]
+}
+
+# 1. Check cached token
+if [[ "$FORCE" == "false" ]] && [[ -f "$CACHE_FILE" ]]; then
+  cached_token=$(cat "$CACHE_FILE")
+  if [[ -n "$cached_token" ]] && _validate_token "$cached_token"; then
+    [[ "$QUIET" == "false" ]] && echo "Using cached token (valid)" >&2
+    echo "$cached_token"
+    exit 0
+  fi
+  [[ "$QUIET" == "false" ]] && echo "Cached token invalid, checking credentials..." >&2
+fi
+
+# 2. Use pre-configured token from credentials.json
+if [[ -n "${AUTHENTIK_TOKEN:-}" ]]; then
+  if _validate_token "$AUTHENTIK_TOKEN"; then
+    # Cache it for faster future access
+    mkdir -p "$CACHE_DIR"
+    echo "$AUTHENTIK_TOKEN" > "$CACHE_FILE"
+    chmod 600 "$CACHE_FILE"
+    [[ "$QUIET" == "false" ]] && echo "Token validated and cached at $CACHE_FILE" >&2
+    echo "$AUTHENTIK_TOKEN"
+    exit 0
+  else
+    echo "Error: Pre-configured AUTHENTIK_TOKEN is invalid (API returned non-200)" >&2
+    exit 1
+  fi
+fi
+
+# 3. No token available
+echo "Error: No Authentik API token configured" >&2
+echo "" >&2
+echo "To create one:" >&2
+echo "  1. Log into Authentik admin: ${AUTHENTIK_URL}/if/admin/#/core/tokens" >&2
+echo "  2. Click 'Create' → set identifier (e.g., 'mosaic-agent')" >&2
+echo "  3. Select 'API Token' intent, uncheck 'Expiring'" >&2
+echo "  4. Copy the key and add to credentials.json:" >&2
+echo "     jq '.authentik.token = \"<your-token>\"' credentials.json > tmp && mv tmp credentials.json" >&2
+exit 1
--- a/tools/authentik/flow-list.sh
+++ b/tools/authentik/flow-list.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# flow-list.sh — List Authentik flows
+#
+# Usage: flow-list.sh [-f format] [-d designation]
+#
+# Options:
+#   -f format        Output format: table (default), json
+#   -d designation   Filter by designation (authentication, authorization, enrollment, etc.)
+#   -h               Show this help
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+FORMAT="table"
+DESIGNATION=""
+
+while getopts "f:d:h" opt; do
+  case $opt in
+    f) FORMAT="$OPTARG" ;;
+    d) DESIGNATION="$OPTARG" ;;
+    h) head -13 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f format] [-d designation]" >&2; exit 1 ;;
+  esac
+done
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+PARAMS="ordering=slug"
+[[ -n "$DESIGNATION" ]] && PARAMS="${PARAMS}&designation=${DESIGNATION}"
+
+response=$(curl -sk -w "\n%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "${AUTHENTIK_URL}/api/v3/flows/instances/?${PARAMS}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "200" ]]; then
+  echo "Error: Failed to list flows (HTTP $http_code)" >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.results'
+  exit 0
+fi
+
+echo "NAME                          SLUG                          DESIGNATION       TITLE"
+echo "----------------------------  ----------------------------  ----------------  ----------------------------"
+echo "$body" | jq -r '.results[] | [
+  .name,
+  .slug,
+  .designation,
+  (.title // "—")
+] | @tsv' | while IFS=$'\t' read -r name slug designation title; do
+  printf "%-28s  %-28s  %-16s  %s\n" \
+    "${name:0:28}" "${slug:0:28}" "$designation" "${title:0:28}"
+done
--- a/tools/authentik/group-list.sh
+++ b/tools/authentik/group-list.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+#
+# group-list.sh — List Authentik groups
+#
+# Usage: group-list.sh [-f format] [-s search]
+#
+# Options:
+#   -f format   Output format: table (default), json
+#   -s search   Search by group name
+#   -h          Show this help
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+FORMAT="table"
+SEARCH=""
+
+while getopts "f:s:h" opt; do
+  case $opt in
+    f) FORMAT="$OPTARG" ;;
+    s) SEARCH="$OPTARG" ;;
+    h) head -12 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f format] [-s search]" >&2; exit 1 ;;
+  esac
+done
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+PARAMS="ordering=name"
+[[ -n "$SEARCH" ]] && PARAMS="${PARAMS}&search=${SEARCH}"
+
+response=$(curl -sk -w "\n%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "${AUTHENTIK_URL}/api/v3/core/groups/?${PARAMS}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "200" ]]; then
+  echo "Error: Failed to list groups (HTTP $http_code)" >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.results'
+  exit 0
+fi
+
+echo "NAME                          PK                                    MEMBERS  SUPERUSER"
+echo "----------------------------  ------------------------------------  -------  ---------"
+echo "$body" | jq -r '.results[] | [
+  .name,
+  .pk,
+  (.users | length | tostring),
+  (if .is_superuser then "yes" else "no" end)
+] | @tsv' | while IFS=$'\t' read -r name pk members superuser; do
+  printf "%-28s  %-36s  %-7s  %s\n" "${name:0:28}" "$pk" "$members" "$superuser"
+done
--- a/tools/authentik/user-create.sh
+++ b/tools/authentik/user-create.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+#
+# user-create.sh — Create an Authentik user
+#
+# Usage: user-create.sh -u <username> -n <name> -e <email> [-p password] [-g group]
+#
+# Options:
+#   -u username   Username (required)
+#   -n name       Display name (required)
+#   -e email      Email address (required)
+#   -p password   Initial password (optional — user gets set-password flow if omitted)
+#   -g group      Group name to add user to (optional)
+#   -f format     Output format: table (default), json
+#   -h            Show this help
+#
+# Environment variables (or credentials.json):
+#   AUTHENTIK_URL — Authentik instance URL
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+USERNAME="" NAME="" EMAIL="" PASSWORD="" GROUP="" FORMAT="table"
+
+while getopts "u:n:e:p:g:f:h" opt; do
+  case $opt in
+    u) USERNAME="$OPTARG" ;;
+    n) NAME="$OPTARG" ;;
+    e) EMAIL="$OPTARG" ;;
+    p) PASSWORD="$OPTARG" ;;
+    g) GROUP="$OPTARG" ;;
+    f) FORMAT="$OPTARG" ;;
+    h) head -18 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 -u <username> -n <name> -e <email> [-p password] [-g group]" >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "$USERNAME" || -z "$NAME" || -z "$EMAIL" ]]; then
+  echo "Error: -u username, -n name, and -e email are required" >&2
+  exit 1
+fi
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+# Build user payload
+payload=$(jq -n \
+  --arg username "$USERNAME" \
+  --arg name "$NAME" \
+  --arg email "$EMAIL" \
+  '{username: $username, name: $name, email: $email, is_active: true}')
+
+# Add password if provided
+if [[ -n "$PASSWORD" ]]; then
+  payload=$(echo "$payload" | jq --arg pw "$PASSWORD" '. + {password: $pw}')
+fi
+
+# Add to group if provided
+if [[ -n "$GROUP" ]]; then
+  # Look up group PK by name
+  group_response=$(curl -sk \
+    -H "Authorization: Bearer $TOKEN" \
+    "${AUTHENTIK_URL}/api/v3/core/groups/?search=${GROUP}")
+  group_pk=$(echo "$group_response" | jq -r ".results[] | select(.name == \"$GROUP\") | .pk" | head -1)
+  if [[ -n "$group_pk" ]]; then
+    payload=$(echo "$payload" | jq --arg gk "$group_pk" '. + {groups: [$gk]}')
+  else
+    echo "Warning: Group '$GROUP' not found — creating user without group" >&2
+  fi
+fi
+
+response=$(curl -sk -w "\n%{http_code}" -X POST \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "$payload" \
+  "${AUTHENTIK_URL}/api/v3/core/users/")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "201" ]]; then
+  echo "Error: Failed to create user (HTTP $http_code)" >&2
+  echo "$body" | jq -r '.' 2>/dev/null >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.'
+else
+  echo "User created successfully:"
+  echo "$body" | jq -r '"  Username: \(.username)\n  Name:     \(.name)\n  Email:    \(.email)\n  PK:       \(.pk)"'
+fi
--- a/tools/authentik/user-list.sh
+++ b/tools/authentik/user-list.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#
+# user-list.sh — List Authentik users
+#
+# Usage: user-list.sh [-f format] [-s search] [-g group]
+#
+# Options:
+#   -f format   Output format: table (default), json
+#   -s search   Search term (matches username, name, email)
+#   -g group    Filter by group name
+#   -h          Show this help
+#
+# Environment variables (or credentials.json):
+#   AUTHENTIK_URL — Authentik instance URL
+set -euo pipefail
+
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$MOSAIC_HOME/tools/_lib/credentials.sh"
+load_credentials authentik
+
+FORMAT="table"
+SEARCH=""
+GROUP=""
+
+while getopts "f:s:g:h" opt; do
+  case $opt in
+    f) FORMAT="$OPTARG" ;;
+    s) SEARCH="$OPTARG" ;;
+    g) GROUP="$OPTARG" ;;
+    h) head -14 "$0" | grep "^#" | sed 's/^# \?//'; exit 0 ;;
+    *) echo "Usage: $0 [-f format] [-s search] [-g group]" >&2; exit 1 ;;
+  esac
+done
+
+TOKEN=$("$SCRIPT_DIR/auth-token.sh" -q)
+
+# Build query params
+PARAMS="ordering=username"
+[[ -n "$SEARCH" ]] && PARAMS="${PARAMS}&search=${SEARCH}"
+[[ -n "$GROUP" ]] && PARAMS="${PARAMS}&groups_by_name=${GROUP}"
+
+response=$(curl -sk -w "\n%{http_code}" \
+  -H "Authorization: Bearer $TOKEN" \
+  "${AUTHENTIK_URL}/api/v3/core/users/?${PARAMS}")
+
+http_code=$(echo "$response" | tail -n1)
+body=$(echo "$response" | sed '$d')
+
+if [[ "$http_code" != "200" ]]; then
+  echo "Error: Failed to list users (HTTP $http_code)" >&2
+  exit 1
+fi
+
+if [[ "$FORMAT" == "json" ]]; then
+  echo "$body" | jq '.results'
+  exit 0
+fi
+
+# Table output
+echo "USERNAME              NAME                          EMAIL                         ACTIVE  LAST LOGIN"
+echo "--------------------  ----------------------------  ----------------------------  ------  ----------"
+echo "$body" | jq -r '.results[] | [
+  .username,
+  .name,
+  .email,
+  (if .is_active then "yes" else "no" end),
+  (.last_login // "never" | split("T")[0])
+] | @tsv' | while IFS=$'\t' read -r username name email active last_login; do
+  printf "%-20s  %-28s  %-28s  %-6s  %s\n" \
+    "${username:0:20}" "${name:0:28}" "${email:0:28}" "$active" "$last_login"
+done