titan-iac/services/keycloak/scripts/hermes_access_oidc_ensure.sh

#!/usr/bin/env sh
set -eu

. /vault/secrets/keycloak-admin-env.sh

KC_URL="http://keycloak.sso.svc.cluster.local"
VAULT_ADDR="${VAULT_ADDR:-http://vault.vault.svc.cluster.local:8200}"
VAULT_ROLE="${VAULT_ROLE:-sso-secrets}"

ACCESS_TOKEN=""
for attempt in 1 2 3 4 5 6 7 8 9 10; do
  if curl -fsS "${KC_URL}/realms/master" >/dev/null 2>&1; then
    break
  fi
  echo "Waiting for Keycloak to be reachable (attempt ${attempt})" >&2
  sleep $((attempt * 2))
done

for attempt in 1 2 3 4 5; do
  token_json="$(curl -sS -X POST "${KC_URL}/realms/master/protocol/openid-connect/token" \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d "grant_type=password" \
    -d "client_id=admin-cli" \
    -d "username=${KEYCLOAK_ADMIN}" \
    -d "password=${KEYCLOAK_ADMIN_PASSWORD}" || true)"
  ACCESS_TOKEN="$(printf '%s' "${token_json}" | jq -r '.access_token' 2>/dev/null || true)"
  if [ -n "${ACCESS_TOKEN}" ] && [ "${ACCESS_TOKEN}" != "null" ]; then
    break
  fi
  sleep $((attempt * 2))
done
if [ -z "${ACCESS_TOKEN}" ] || [ "${ACCESS_TOKEN}" = "null" ]; then
  echo "Failed to fetch Keycloak admin token" >&2
  exit 1
fi

jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
login_payload="$(jq -nc --arg jwt "${jwt}" --arg role "${VAULT_ROLE}" '{jwt:$jwt,role:$role}')"
vault_token="$(curl -sS --request POST --data "${login_payload}" \
  "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
if [ -z "${vault_token}" ] || [ "${vault_token}" = "null" ]; then
  echo "Vault login failed" >&2
  exit 1
fi

ensure_proxy_client() {
  client_id="$1"
  public_url="$2"
  vault_path="$3"
  payload="$(jq -nc \
    --arg client_id "${client_id}" \
    --arg redirect_uri "${public_url}/oauth2/callback" \
    --arg web_origin "${public_url}" \
    '{
      clientId:$client_id,
      name:$client_id,
      enabled:true,
      protocol:"openid-connect",
      publicClient:false,
      standardFlowEnabled:true,
      implicitFlowEnabled:false,
      directAccessGrantsEnabled:false,
      serviceAccountsEnabled:false,
      redirectUris:[$redirect_uri],
      webOrigins:[$web_origin],
      rootUrl:$web_origin,
      baseUrl:"/",
      attributes:{
        "pkce.code.challenge.method":"S256",
        "post.logout.redirect.uris":$web_origin,
        "access.token.lifespan":"1200"
      }
    }')"

  query="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    "${KC_URL}/admin/realms/atlas/clients?clientId=${client_id}" || true)"
  internal_id="$(printf '%s' "${query}" | jq -r '.[0].id' 2>/dev/null || true)"
  if [ -z "${internal_id}" ] || [ "${internal_id}" = "null" ]; then
    status="$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
      -H "Authorization: Bearer ${ACCESS_TOKEN}" \
      -H 'Content-Type: application/json' \
      -d "${payload}" \
      "${KC_URL}/admin/realms/atlas/clients")"
    if [ "${status}" != "201" ] && [ "${status}" != "204" ] && [ "${status}" != "409" ]; then
      echo "Keycloak client ${client_id} create failed (status ${status})" >&2
      exit 1
    fi
    query="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
      "${KC_URL}/admin/realms/atlas/clients?clientId=${client_id}" || true)"
    internal_id="$(printf '%s' "${query}" | jq -r '.[0].id' 2>/dev/null || true)"
  fi
  if [ -z "${internal_id}" ] || [ "${internal_id}" = "null" ]; then
    echo "Keycloak client ${client_id} was not found after create" >&2
    exit 1
  fi

  status="$(curl -sS -o /dev/null -w '%{http_code}' -X PUT \
    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    -H 'Content-Type: application/json' \
    -d "${payload}" \
    "${KC_URL}/admin/realms/atlas/clients/${internal_id}")"
  if [ "${status}" != "204" ]; then
    echo "Keycloak client ${client_id} update failed (status ${status})" >&2
    exit 1
  fi

  client_secret="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    "${KC_URL}/admin/realms/atlas/clients/${internal_id}/client-secret" \
    | jq -r '.value' 2>/dev/null || true)"
  if [ -z "${client_secret}" ] || [ "${client_secret}" = "null" ]; then
    echo "Keycloak client ${client_id} secret was not returned" >&2
    exit 1
  fi

  state_file="/tmp/hermes-$(printf '%s' "${client_id}" | tr -c 'a-zA-Z0-9' '-').json"
  read_status="$(curl -sS -o "${state_file}" -w '%{http_code}' \
    -H "X-Vault-Token: ${vault_token}" \
    "${VAULT_ADDR}/v1/kv/data/atlas/${vault_path}" || true)"
  cookie_secret=""
  if [ "${read_status}" = "200" ]; then
    cookie_secret="$(jq -r '.data.data.cookie_secret // empty' "${state_file}")"
  elif [ "${read_status}" != "404" ]; then
    echo "Vault ${vault_path} read failed (status ${read_status})" >&2
    exit 1
  fi
  cookie_length="$(printf '%s' "${cookie_secret}" | wc -c | tr -d ' ')"
  case "${cookie_length}" in 16|24|32) ;; *) cookie_secret="$(openssl rand -hex 16 | tr -d '\n')" ;; esac

  vault_payload="$(jq -nc \
    --arg client_id "${client_id}" \
    --arg client_secret "${client_secret}" \
    --arg cookie_secret "${cookie_secret}" \
    '{data:{client_id:$client_id,client_secret:$client_secret,cookie_secret:$cookie_secret}}')"
  write_status="$(curl -sS -o "${state_file}.write" -w '%{http_code}' -X POST \
    -H "X-Vault-Token: ${vault_token}" \
    -H 'Content-Type: application/json' \
    -d "${vault_payload}" \
    "${VAULT_ADDR}/v1/kv/data/atlas/${vault_path}")"
  if [ "${write_status}" != "200" ] && [ "${write_status}" != "204" ]; then
    echo "Vault ${vault_path} write failed (status ${write_status})" >&2
    exit 1
  fi
  echo "Hermes OIDC client ${client_id} is ready"
}

ensure_telegram_config() {
  vault_path="hermes/chat-telegram"
  state_file="/tmp/hermes-chat-telegram.json"
  read_status="$(curl -sS -o "${state_file}" -w '%{http_code}' \
    -H "X-Vault-Token: ${vault_token}" \
    "${VAULT_ADDR}/v1/kv/data/atlas/${vault_path}" || true)"
  bot_token=""
  relay_key=""
  if [ "${read_status}" = "200" ]; then
    bot_token="$(jq -r '.data.data.bot_token // empty' "${state_file}")"
    relay_key="$(jq -r '.data.data.relay_key // empty' "${state_file}")"
  elif [ "${read_status}" != "404" ]; then
    echo "Vault ${vault_path} read failed (status ${read_status})" >&2
    exit 1
  fi
  relay_length="$(printf '%s' "${relay_key}" | wc -c | tr -d ' ')"
  if [ "${relay_length}" -lt 64 ]; then
    relay_key="$(openssl rand -hex 32 | tr -d '\n')"
  fi
  vault_payload="$(jq -nc \
    --arg bot_token "${bot_token}" \
    --arg relay_key "${relay_key}" \
    '{data:{bot_token:$bot_token,relay_key:$relay_key}}')"
  write_status="$(curl -sS -o "${state_file}.write" -w '%{http_code}' -X POST \
    -H "X-Vault-Token: ${vault_token}" \
    -H 'Content-Type: application/json' \
    -d "${vault_payload}" \
    "${VAULT_ADDR}/v1/kv/data/atlas/${vault_path}")"
  if [ "${write_status}" != "200" ] && [ "${write_status}" != "204" ]; then
    echo "Vault ${vault_path} write failed (status ${write_status})" >&2
    exit 1
  fi
  echo "Hermes Telegram transport secret is ready"
}

ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc"
ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc"
ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc"
ensure_telegram_config