import urllib.request
import json
import ssl

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

AK_BASE = "https://authentik.snarfnet.net"
AK_TOKEN = "SnarfNetPermanentAutomationToken2026"

def ak_req(endpoint, method="GET", data=None):
    url = f"{AK_BASE}/api/v3/{endpoint.lstrip('/')}"
    body = json.dumps(data).encode("utf-8") if data else None
    headers = {
        "Authorization": f"Bearer {AK_TOKEN}",
        "Content-Type": "application/json",
        "Accept": "application/json"
    }
    req = urllib.request.Request(url, data=body, headers=headers, method=method)
    with urllib.request.urlopen(req, timeout=10, context=ctx) as r:
        raw = r.read().decode("utf-8")
        return r.getcode(), json.loads(raw) if raw else {}

# 1. Create or Update ldap-authorization-flow
code, flows = ak_req("flows/instances/")
flow = next((f for f in flows.get("results", []) if f["slug"] == "ldap-authorization-flow"), None)

if not flow:
    payload = {
        "name": "LDAP Authorization Flow",
        "slug": "ldap-authorization-flow",
        "title": "LDAP Authorization Flow",
        "designation": "authorization",
        "authentication": "none",
    }
    code, flow = ak_req("flows/instances/", method="POST", data=payload)
    print("Created flow:", flow["pk"])
else:
    print("Flow exists:", flow["pk"])
    ak_req(f"flows/instances/{flow['slug']}/", method="PATCH", data={"authentication": "none"})

flow_pk = flow["pk"]

# 2. Update Provider 22
code, prov = ak_req("providers/ldap/22/", method="PATCH", data={"authorization_flow": flow_pk})
print("Updated Provider 22 authorization_flow to:", prov.get("authorization_flow"))