import urllib.request
import ssl
import json

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

token = "SnarfNetPermanentAutomationToken2026"
headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

# Fetch provider 12
req = urllib.request.Request("https://authentik.snarfnet.net/api/v3/providers/proxy/12/", headers=headers)
with urllib.request.urlopen(req, context=ctx, timeout=8) as resp:
    data = json.loads(resp.read().decode('utf-8'))
    print("Current Provider 12 external_host:", data.get('external_host'))
    print("Current redirect URIs:", data.get('redirect_uris'))

# Update redirect URIs
redirect_uris = [
    {"url": "https://pihole.snarfnet.net/outpost.goauthentik.io/callback?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole.snarfnet.net?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole1.snarfnet.net/outpost.goauthentik.io/callback?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole1.snarfnet.net?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole2.snarfnet.net/outpost.goauthentik.io/callback?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole2.snarfnet.net?X-authentik-auth-callback=true", "matching_mode": "strict"},
    {"url": "https://pihole.*\\.snarfnet\\.net.*", "matching_mode": "regex"}
]

patch_payload = {
    "redirect_uris": redirect_uris
}

req_patch = urllib.request.Request(
    "https://authentik.snarfnet.net/api/v3/providers/proxy/12/",
    headers=headers,
    data=json.dumps(patch_payload).encode('utf-8'),
    method="PATCH"
)

try:
    with urllib.request.urlopen(req_patch, context=ctx, timeout=8) as resp:
        updated = json.loads(resp.read().decode('utf-8'))
        print("Updated Provider 12 successfully!")
except urllib.error.HTTPError as e:
    print("PATCH error:", e.code, e.read().decode('utf-8'))