chore: retire TemporalWorker CRD — agent-harness-worker and Forgejo build workflow removed

2026-08-20 23:10:06 -07:00
parent 81d0764d8c
commit d7c30a8af6
5 changed files with 458 additions and 74 deletions
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# device-flow-demo.sh -- showcase Authentik OAuth 2.0 Device Authorization
+# Grant (RFC 8628) end to end, pure curl + jq.
+#
+# Requires: curl, jq
+#
+# Usage:
+#   CLIENT_ID=<device-flow provider client_id> ./scripts/device-flow-demo.sh
+#
+# Steps:
+#   1. Requests a device_code + user_code from Authentik.
+#   2. Prints the verification URL + user_code for approval in a browser.
+#   3. Polls the token endpoint until approved, then prints the access_token.
+#
+# NOTE on quoting: the device_code returned by Authentik can contain raw
+# quote, backslash, and backtick characters. Always pass it to curl via
+# --data-urlencode from a shell variable (curl encodes it safely). Never
+# re-embed it inside another quoted string (a Python literal, a second shell
+# layer, etc) -- that is what breaks it.
+
+set -euo pipefail
+
+AUTHENTIK_URL="${AUTHENTIK_URL:-https://authentik.riotpiao.com}"
+CLIENT_ID="${CLIENT_ID:?CLIENT_ID is required}"
+SCOPE="${SCOPE:-openid}"
+
+JQ_DEVICE_CODE='.device_code'
+JQ_USER_CODE='.user_code'
+JQ_VERIFICATION_URI='.verification_uri'
+JQ_EXPIRES_IN='.expires_in'
+JQ_INTERVAL='.interval'
+JQ_ERROR='.error'
+JQ_ERROR_DESC='.error_description'
+JQ_ACCESS_TOKEN='.access_token'
+
+echo "==> Requesting device code from ${AUTHENTIK_URL}..."
+if ! DEVICE_RESP="$(curl -sS --fail \
+  "${AUTHENTIK_URL}/application/o/device/" \
+  --data-urlencode "client_id=${CLIENT_ID}" \
+  --data-urlencode "scope=${SCOPE}")"; then
+  echo "FAILED: device code request errored (bad CLIENT_ID or unreachable Authentik)." >&2
+  exit 1
+fi
+
+DEVICE_CODE="$(echo "$DEVICE_RESP" | jq -r "$JQ_DEVICE_CODE")"
+if [ -z "$DEVICE_CODE" ] || [ "$DEVICE_CODE" = "null" ]; then
+  echo "FAILED: no device_code in response: $DEVICE_RESP" >&2
+  exit 1
+fi
+
+USER_CODE="$(echo "$DEVICE_RESP" | jq -r "$JQ_USER_CODE")"
+VERIFICATION_URI="$(echo "$DEVICE_RESP" | jq -r "$JQ_VERIFICATION_URI")"
+EXPIRES_IN="$(echo "$DEVICE_RESP" | jq -r "$JQ_EXPIRES_IN")"
+INTERVAL="$(echo "$DEVICE_RESP" | jq -r "${JQ_INTERVAL} // 5")"
+
+echo
+echo "  Go to:       ${VERIFICATION_URI}"
+echo "  Enter code:  ${USER_CODE}"
+echo "  (expires in ${EXPIRES_IN}s)"
+echo
+echo "==> Polling for approval every ${INTERVAL}s..."
+
+DEADLINE=$(( $(date +%s) + EXPIRES_IN ))
+ACCESS_TOKEN=""
+
+while [ "$(date +%s)" -lt "$DEADLINE" ]; do
+  sleep "$INTERVAL"
+
+  TOKEN_RESP="$(curl -sS \
+    "${AUTHENTIK_URL}/application/o/token/" \
+    --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
+    --data-urlencode "device_code=${DEVICE_CODE}" \
+    --data-urlencode "client_id=${CLIENT_ID}")"
+
+  ERR="$(echo "$TOKEN_RESP" | jq -r "${JQ_ERROR} // empty")"
+
+  if [ -z "$ERR" ]; then
+    ACCESS_TOKEN="$(echo "$TOKEN_RESP" | jq -r "$JQ_ACCESS_TOKEN")"
+    break
+  elif [ "$ERR" = "authorization_pending" ]; then
+    echo "  ...still waiting for approval"
+    continue
+  elif [ "$ERR" = "slow_down" ]; then
+    INTERVAL=$((INTERVAL + 5))
+    continue
+  else
+    DESC="$(echo "$TOKEN_RESP" | jq -r "${JQ_ERROR_DESC} // ${JQ_ERROR}")"
+    echo "FAILED: $DESC" >&2
+    exit 1
+  fi
+done
+
+if [ -z "$ACCESS_TOKEN" ]; then
+  echo "Timed out waiting for approval." >&2
+  exit 1
+fi
+
+echo
+echo "==> Got a token. Decoded payload:"
+python3 - "$ACCESS_TOKEN" <<'PYEOF'
+import sys, json, base64
+tok = sys.argv[1].split(".")[1]
+tok += "=" * (-len(tok) % 4)
+print(json.dumps(json.loads(base64.urlsafe_b64decode(tok)), indent=2))
+PYEOF
+
+echo
+echo "==> Example use as a bearer token:"
+echo "curl https://api.riotpiao.com/v1/reasoning/chat/completions \\"
+echo "  -H \"Authorization: Bearer ${ACCESS_TOKEN}\" \\"
+echo "  -H \"Content-Type: application/json\" \\"
+echo "  -d \"{\\\"model\\\":\\\"reasoning\\\",\\\"messages\\\":[{\\\"role\\\":\\\"user\\\",\\\"content\\\":\\\"hi\\\"}]}\""
+echo
+echo "NOTE: api.riotpiao.com does not yet validate Authentik JWTs -- Kongs"
+echo "model routes currently enforce a static key-auth credential instead."
+echo "See k8s/apps/api/DEVICE-GRANT-PLAN.md Phase 2 for the pending work."