initial commit

app/authentik.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+import subprocess
+from dataclasses import dataclass
+
+from .config import Config
+
+
+@dataclass
+class AuthentikSyncResult:
+    ok: bool
+    message: str
+
+
+def trigger_ldap_sync(config: Config) -> AuthentikSyncResult:
+    if not config.authentik_sync_enabled:
+        return AuthentikSyncResult(True, "authentik sync disabled")
+    if not config.authentik_ldap_source_slugs:
+        return AuthentikSyncResult(False, "authentik sync enabled but AUTHENTIK_LDAP_SOURCE_SLUGS is empty")
+
+    cmd = [
+        "docker",
+        "exec",
+        "-d",
+        config.authentik_sync_container,
+        "ak",
+        "ldap_sync",
+        *config.authentik_ldap_source_slugs,
+    ]
+    try:
+        subprocess.run(cmd, check=True, text=True, capture_output=True, timeout=10)
+    except subprocess.TimeoutExpired:
+        return AuthentikSyncResult(False, "authentik LDAP sync trigger timed out")
+    except subprocess.CalledProcessError as exc:
+        detail = exc.stderr.strip() or exc.stdout.strip() or str(exc)
+        return AuthentikSyncResult(False, f"authentik LDAP sync trigger failed: {detail}")
+    return AuthentikSyncResult(True, f"triggered authentik LDAP sync for {', '.join(config.authentik_ldap_source_slugs)}")