import paramiko
import json

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('140.44.4.11', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

# Check Technitium local DNS resolution for authentik.snarfnet.net
stdin, stdout, stderr = ssh.exec_command('k3s kubectl exec -n dns deployment/technitium-dns -- dig @127.0.0.1 authentik.snarfnet.net +short')
print("Dig authentik.snarfnet.net from Technitium DNS:")
print(stdout.read().decode())

# Get fresh token
stdin, stdout, stderr = ssh.exec_command('k3s kubectl exec -n dns deployment/technitium-dns -- curl -s "http://localhost:5380/api/user/login?user=admin&pass=snarfnetadmin"')
data = json.loads(stdout.read().decode())
token = data['token']
print("Fresh token:", token)

# Now call api/admin/sso/set with ssoAuthority set as well!
url = (
    f'"http://localhost:5380/api/admin/sso/set?token={token}'
    '&ssoEnabled=true'
    '&ssoAuthority=https://authentik.snarfnet.net/application/o/dns1/'
    '&ssoClientId=technitium-dns-oidc'
    '&ssoClientSecret=SnarfNetTechnitiumOIDC2026!'
    '&ssoMetadataAddress=https://authentik.snarfnet.net/application/o/dns1/.well-known/openid-configuration'
    '&ssoScopes=openid,profile,email'
    '&ssoAllowSignup=true'
    '&ssoAllowSignupOnlyForMappedUsers=false'
    '&ssoGroupMap=authentik%20Admins|Administrators"'
)
stdin, stdout, stderr = ssh.exec_command(f'k3s kubectl exec -n dns deployment/technitium-dns -- curl -s {url}')
print("SSO set result:", stdout.read().decode())

# Check get after set
stdin, stdout, stderr = ssh.exec_command(f'k3s kubectl exec -n dns deployment/technitium-dns -- curl -s "http://localhost:5380/api/admin/sso/get?token={token}"')
print("SSO get after set:", stdout.read().decode())

ssh.close()