feat(service): Add SCIM sync for Teams

Signed-off-by: Louis Chmn <louis@chmn.me>

src/service.rs

@@ -19,7 +19,7 @@ mod webhook;
 
 use crate::cloud::CloudOptions;
 use crate::config::{HazeConfig, Preset, ProxyConfig};
-pub use crate::service::authentik::{Authentik, AuthentikOidc, AuthentikSaml};
+pub use crate::service::authentik::{Authentik, AuthentikOidc, AuthentikSaml, AuthentikScim};
 pub use crate::service::clam::{Clam, ClamIcap, ClamIcapTls, ClamSocket};
 use crate::service::dav::Dav;
 use crate::service::imaginary::Imaginary;
@@ -322,6 +322,8 @@ pub enum ServiceType {
     Saml,
     /// Configure Authentik as an OIDC IDP for Nextcloud
     Oidc,
+    /// Configure Authentik as a SCIM server for Nextcloud
+    Scim,
 }
 
 #[enum_dispatch]
@@ -358,6 +360,7 @@ pub enum Service {
     Authentik(Authentik),
     AuthentikSaml(AuthentikSaml),
     AuthentikOidc(AuthentikOidc),
+    AuthentikScim(AuthentikScim),
     Preset(PresetService),
 }
 
@@ -413,6 +416,10 @@ impl Service {
                     Service::Authentik(Authentik),
                     Service::AuthentikOidc(AuthentikOidc),
                 ]),
+                ServiceType::Scim => Some(vec![
+                    Service::Authentik(Authentik),
+                    Service::AuthentikScim(AuthentikScim),
+                ]),
             }
         } else {
             presets

src/service/authentik/mod.rs

@@ -1,8 +1,10 @@
 mod oidc;
 mod saml;
+mod scim;
 
 pub use oidc::AuthentikOidc;
 pub use saml::AuthentikSaml;
+pub use scim::AuthentikScim;
 
 use crate::Result;
 use crate::cloud::CloudOptions;

src/service/authentik/scim.rs

@@ -0,0 +1,73 @@
+use super::{AUTHENTIK_PORT, container_ip, container_name, write_file};
+use crate::Result;
+use crate::cloud::CloudOptions;
+use crate::config::{HazeConfig, ProxyConfig};
+use crate::service::{ServiceTrait, split_cmnd};
+use bollard::Docker;
+
+const BLUEPRINT: &str = include_str!("../../../blueprints/authentik-scim.yaml");
+
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub struct AuthentikScim;
+
+#[async_trait::async_trait]
+impl ServiceTrait for AuthentikScim {
+    fn name(&self) -> &str {
+        "scim"
+    }
+
+    async fn spawn(
+        &self,
+        _docker: &Docker,
+        cloud_id: &str,
+        _network: &str,
+        config: &HazeConfig,
+        _options: &CloudOptions,
+    ) -> Result<Vec<String>> {
+        let blueprints_directory = config
+            .work_dir
+            .join(cloud_id)
+            .join("authentik")
+            .join("blueprints");
+        write_file(&blueprints_directory, "scim.yaml", BLUEPRINT)?;
+
+        Ok(Vec::new())
+    }
+
+    fn apps(&self) -> &'static [&'static str] {
+        &["circles"]
+    }
+
+    async fn post_setup(
+        &self,
+        docker: &Docker,
+        cloud_id: &str,
+        config: &HazeConfig,
+    ) -> Result<Vec<Vec<String>>> {
+        let authentik_container = container_name(cloud_id, "server");
+        let authentik_url = config.proxy.addr_with_port(
+            &authentik_container,
+            container_ip(docker, &authentik_container, None).await?,
+            AUTHENTIK_PORT,
+        );
+
+        Ok(vec![
+            split_cmnd("occ config:app:set --silent circles scim_enabled --type boolean --value 1"),
+            split_cmnd(&format!(
+                "occ config:app:set --silent circles scim_endpoint --value {authentik_url}/source/scim/nextcloud-scim/v2"
+            )),
+            split_cmnd("occ config:app:set --silent circles scim_token --value haze-scim-token"),
+        ])
+    }
+
+    async fn start_message(
+        &self,
+        _docker: &Docker,
+        cloud_id: &str,
+        _proxy: &ProxyConfig,
+    ) -> Result<Option<String>> {
+        Ok(Some(format!(
+            "Once Authentik as started, you can sync teams with 'haze {cloud_id} occ circles:scim:sync-circles'\n",
+        )))
+    }
+}