kych

client_management_cli.rs (11398B)

---

 //! OAuth2 Gateway CLI
 //!
 //! Command-line tool for managing OAuth2 Gateway clients.
 //!
 //! Usage (`--config` is optional; without it the standard search path applies,
 //! ending at /etc/kych/kych.conf):
 //!   kych-client-management --config kych.conf list
 //!   kych-client-management --config kych.conf show <client_id>
 //!   kych-client-management --config kych.conf create --client-id <id> --secret <secret> ...
 //!   kych-client-management --config kych.conf update <client_id> --redirect-uri <url>
 //!   kych-client-management --config kych.conf sync
 //!   kych-client-management --config kych.conf delete <client_id>
 
 use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
 use kych_oauth2_gateway_lib::{
     config::{CONFIG_SOURCE, Config},
     db,
 };
 use std::collections::HashSet;
 use taler_config::{CommonArgs, taler_main};
 
 #[derive(Parser, Debug)]
 #[command(name = "kych-client-management")]
 #[command(version)]
 #[command(about = "manage OAuth 2.0 clients of the KyCH gateway")]
 struct Args {
     #[command(flatten)]
     common: CommonArgs,
 
     #[command(subcommand)]
     command: Commands,
 }
 
 #[derive(Subcommand, Debug)]
 enum Commands {
     List,
 
     Show {
         client_id: String,
     },
 
     Create {
         /// Unique client identifier
         #[arg(long)]
         client_id: String,
 
         /// Client secret (stored as hash)
         #[arg(long)]
         secret: String,
 
         /// Swiyu verifier base URL
         #[arg(long)]
         verifier_url: String,
 
         /// Verifier management API path (default: /management/api/verifications)
         #[arg(long)]
         verifier_api_path: Option<String>,
 
         /// Default redirect URI for OAuth2 flow
         #[arg(long)]
         redirect_uri: String,
 
         /// Accepted issuer DIDs in braces, e.g. {did1, did2}
         #[arg(long)]
         accepted_issuer_dids: Option<String>,
     },
 
     Update {
         client_id: String,
 
         #[arg(long)]
         verifier_url: Option<String>,
 
         #[arg(long)]
         verifier_api_path: Option<String>,
 
         #[arg(long)]
         redirect_uri: Option<String>,
 
         #[arg(long)]
         accepted_issuer_dids: Option<String>,
     },
 
     /// Sync clients from configuration file (reads [client_*] sections)
     Sync {
         /// Remove clients not in config file
         #[arg(long)]
         prune: bool,
     },
 
     /// Delete a client (WARNING: cascades to all sessions)
     Delete {
         client_id: String,
 
         #[arg(long, short = 'y')]
         yes: bool,
     },   
 }
 
 fn main() {
     let args = Args::parse();
 
     taler_main(CONFIG_SOURCE, args.common, async |cfg| {
         run(Config::parse(cfg)?, args.command).await
     })
 }
 
 async fn run(config: Config, command: Commands) -> Result<()> {
     let pool = db::create_pool(config.database.clone())
         .await
         .context("Failed to connect to database")?;
 
     match command {
         Commands::List => cmd_list_clients(&pool).await?,
         Commands::Show { client_id } => cmd_show_client(&pool, &client_id).await?,
         Commands::Create {
             client_id,
             secret,
             verifier_url,
             verifier_api_path,
             redirect_uri,
             accepted_issuer_dids,
         } => {
             cmd_create_client(
                 &pool,
                 &client_id,
                 &secret,
                 &verifier_url,
                 verifier_api_path.as_deref(),
                 &redirect_uri,
                 accepted_issuer_dids.as_deref(),
             )
             .await?
         }
         Commands::Update {
             client_id,
             verifier_url,
             verifier_api_path,
             redirect_uri,
             accepted_issuer_dids,
         } => {
             cmd_update_client(
                 &pool,
                 &client_id,
                 verifier_url.as_deref(),
                 verifier_api_path.as_deref(),
                 redirect_uri.as_deref(),
                 accepted_issuer_dids.as_deref(),
             )
             .await?
         }
         Commands::Sync { prune } => {
             cmd_sync_clients(&pool, &config, prune).await?
         }
         Commands::Delete { client_id, yes } => {
             cmd_delete_client(&pool, &client_id, yes).await?
         }
     }
 
     Ok(())
 }
 
 fn print_client_details(client: &db::clients::Client) {
     use chrono::Local;
 
     println!("{}", "=".repeat(60));
     println!("UUID:                  {}", client.id);
     println!("Client ID:             {}", client.client_id);
     println!("Secret Hash:           {}...", &client.secret_hash[..20.min(client.secret_hash.len())]);
     println!("Verifier URL:          {}", client.verifier_url);
     println!("Verifier API Path:     {}", client.verifier_management_api_path);
     println!("Redirect URI(s):       {}", client.redirect_uri);
     println!("Accepted Issuer DIDs:  {}", client.accepted_issuer_dids.as_deref().unwrap_or("(not set)"));
     println!("Created:               {}", client.created_at.with_timezone(&Local));
     println!("Updated:               {}", client.updated_at.with_timezone(&Local));
 }
 
 async fn cmd_list_clients(pool: &sqlx::PgPool) -> Result<()> {
     let clients = db::clients::list_clients(pool).await?;
 
     if clients.is_empty() {
         println!("No clients registered.");
         return Ok(());
     }
 
     let total = clients.len();
 
     for (i, client) in clients.iter().enumerate() {
         if i > 0 {
             println!();
         }
         print_client_details(&client);
     }
 
     println!();
     println!("{}", "=".repeat(60));
     println!("Total clients: {}", total);
 
     Ok(())
 }
 
 async fn cmd_show_client(pool: &sqlx::PgPool, client_id: &str) -> Result<()> {
     let client = db::clients::get_client_by_id(pool, client_id)
         .await?
         .ok_or_else(|| anyhow::anyhow!("Client not found: {}", client_id))?;
 
     print_client_details(&client);
 
     Ok(())
 }
 
 async fn cmd_create_client(
     pool: &sqlx::PgPool,
     client_id: &str,
     secret: &str,
     verifier_url: &str,
     verifier_api_path: Option<&str>,
     redirect_uri: &str,
     accepted_issuer_dids: Option<&str>,
 ) -> Result<()> {
     let client = db::clients::register_client(
         pool,
         client_id,
         secret,
         verifier_url,
         verifier_api_path,
         redirect_uri,
         accepted_issuer_dids,
     )
     .await
     .context("Failed to create client")?;
 
     println!("Client created successfully.");
     println!();
     print_client_details(&client);
 
     Ok(())
 }
 
 async fn cmd_update_client(
     pool: &sqlx::PgPool,
     client_id: &str,
     verifier_url: Option<&str>,
     verifier_api_path: Option<&str>,
     redirect_uri: Option<&str>,
     accepted_issuer_dids: Option<&str>,
 ) -> Result<()> {
     if verifier_url.is_none() && verifier_api_path.is_none()
         && redirect_uri.is_none() && accepted_issuer_dids.is_none() {
         anyhow::bail!("No fields to update. Specify at least one of: --verifier-url, --verifier-api-path, --redirect-uri, --accepted-issuer-dids");
     }
 
     let client = db::clients::get_client_by_id(pool, client_id)
         .await?
         .ok_or_else(|| anyhow::anyhow!("Client not found: {}", client_id))?;
 
     let updated = db::clients::update_client(
         pool,
         client.id,
         verifier_url,
         verifier_api_path,
         redirect_uri,
         accepted_issuer_dids,
     )
     .await
     .context("Failed to update client")?;
 
     println!("Client updated successfully.");
     println!();
     print_client_details(&updated);
 
     Ok(())
 }
 
 async fn cmd_delete_client(pool: &sqlx::PgPool, client_id: &str, skip_confirm: bool) -> Result<()> {
     let client = db::clients::get_client_by_id(pool, client_id)
         .await?
         .ok_or_else(|| anyhow::anyhow!("Client not found: {}", client_id))?;
 
     if !skip_confirm {
         println!("WARNING: This will delete client '{}' and ALL associated data:", client_id);
         println!("  - All sessions");
         println!("  - All tokens");
         println!();
         print!("Type 'yes' to confirm: ");
 
         use std::io::{self, Write};
         io::stdout().flush()?;
 
         let mut input = String::new();
         io::stdin().read_line(&mut input)?;
 
         if input.trim() != "yes" {
             println!("Aborted.");
             return Ok(());
         }
     }
 
     let deleted = db::clients::delete_client(pool, client.id).await?;
 
     if deleted {
         println!("Client '{}' deleted successfully.", client_id);
     } else {
         println!("Client not found (may have been deleted already).");
     }
 
     Ok(())
 }
 
 async fn cmd_sync_clients(pool: &sqlx::PgPool, config: &Config, prune: bool) -> Result<()> {
     println!("Syncing {} client(s) from configuration...", config.clients.len());
 
     let mut synced_client_ids = HashSet::new();
     let mut created_count = 0;
     let mut updated_count = 0;
 
     for client_config in &config.clients {
         println!("\nProcessing section: [{}]", client_config.section_name);
 
         synced_client_ids.insert(client_config.client_id.clone());
 
         let existing_client = db::clients::get_client_by_id(pool, &client_config.client_id).await?;
 
         match existing_client {
             Some(existing) => {
                 println!("  Client '{}' already exists, updating...", client_config.client_id);
                 db::clients::update_client(
                     pool,
                     existing.id,
                     Some(&client_config.verifier_url),
                     Some(&client_config.verifier_management_api_path),
                     Some(&client_config.redirect_uri),
                     client_config.accepted_issuer_dids.as_deref(),
                 )
                 .await
                 .context(format!("Failed to update client '{}'", client_config.client_id))?;
                 updated_count += 1;
                 println!("  Updated client '{}'", client_config.client_id);
             }
             None => {
                 println!("  Creating new client '{}'...", client_config.client_id);
                 db::clients::register_client(
                     pool,
                     &client_config.client_id,
                     &client_config.client_secret,
                     &client_config.verifier_url,
                     Some(&client_config.verifier_management_api_path),
                     &client_config.redirect_uri,
                     client_config.accepted_issuer_dids.as_deref(),
                 )
                 .await
                 .context(format!("Failed to create client '{}'", client_config.client_id))?;
                 created_count += 1;
                 println!("  Created client '{}'", client_config.client_id);
             }
         }
     }
 
     if prune {
         println!("\nPruning clients not in configuration file...");
         let all_clients = db::clients::list_clients(pool).await?;
         let mut pruned_count = 0;
 
         for client in all_clients {
             if !synced_client_ids.contains(&client.client_id) {
                 println!("  Deleting client '{}'...", client.client_id);
                 db::clients::delete_client(pool, client.id).await?;
                 pruned_count += 1;
             }
         }
         println!("Pruned {} client(s)", pruned_count);
     }
 
     println!("\nSync complete:");
     println!("  Created: {}", created_count);
     println!("  Updated: {}", updated_count);
 
     Ok(())
 }