nest-matrix-bot/matrix_keycloak_bot.py

import asyncio
import os
import sys
import markdown
from keycloak import KeycloakAdmin
from keycloak.exceptions import KeycloakError
from nio import (
    AsyncClient,
    MatrixRoom,
    RoomMessageText,
    ReactionEvent,
    RoomSendResponse,
    InviteMemberEvent,
    OlmUnverifiedDeviceError,
)

# ------------------------------------------------------------------------------
# Configuration
# ------------------------------------------------------------------------------
MATRIX_HOMESERVER = os.getenv("MATRIX_HOMESERVER", "https://matrix.nest.local")
MATRIX_BOT_USER = os.getenv("MATRIX_BOT_USER", "@access-bot:nest.local")
MATRIX_BOT_PASSWORD = os.getenv("MATRIX_BOT_PASSWORD", "SuperSecretBotPassword")
ADMIN_ROOM_ID = os.getenv("ADMIN_ROOM_ID", "!adminroomid:nest.local")
ADMIN_MATRIX_IDS = set(os.getenv("ADMIN_MATRIX_IDS", "@you:nest.local").split(","))

KEYCLOAK_URL = os.getenv("KEYCLOAK_URL", "https://keycloak.nest.local/")
KEYCLOAK_REALM = os.getenv("KEYCLOAK_REALM", "master")
KEYCLOAK_CLIENT_ID = os.getenv("KEYCLOAK_CLIENT_ID", "nest-matrix-bot")
KEYCLOAK_CLIENT_SECRET = os.getenv("KEYCLOAK_CLIENT_SECRET", "your-client-secret")

# In-memory tracking of active requests
pending_requests = {}


# ------------------------------------------------------------------------------
# Keycloak Helper Functions
# ------------------------------------------------------------------------------
def get_keycloak_client() -> KeycloakAdmin:
    """Initializes KeycloakAdmin client using client credentials."""
    return KeycloakAdmin(
        server_url=KEYCLOAK_URL,
        client_id=KEYCLOAK_CLIENT_ID,
        client_secret_key=KEYCLOAK_CLIENT_SECRET,
        realm_name=KEYCLOAK_REALM,
        user_realm_name=KEYCLOAK_REALM,
        grant_type="client_credentials",
        verify=True,
    )


def add_user_to_kc_group(username: str, group_name: str) -> tuple[bool, str]:
    """Adds a Keycloak user to a target group."""
    try:
        kc = get_keycloak_client()

        users = kc.get_users(query={"username": username, "exact": True})
        if not users:
            return False, f"Keycloak user '{username}' not found."
        user_id = users[0]["id"]

        groups = kc.get_groups()
        target_group = next((g for g in groups if g["name"].lower() == group_name.lower()), None)
        if not target_group:
            return False, f"Keycloak group '{group_name}' not found."
        group_id = target_group["id"]

        kc.group_user_add(user_id=user_id, group_id=group_id)
        return True, f"Successfully added '{username}' to group '{target_group['name']}'."

    except KeycloakError as e:
        return False, f"Keycloak API error: {str(e)}"
    except Exception as e:
        return False, f"Unexpected error: {str(e)}"


def get_requestable_groups(username: str) -> tuple[bool, str]:
    """Fetches available Keycloak groups, filtering out 'admin' and checking user membership."""
    try:
        kc = get_keycloak_client()

        users = kc.get_users(query={"username": username, "exact": True})
        if not users:
            user_group_names = set()
        else:
            user_id = users[0]["id"]
            user_groups = kc.get_user_groups(user_id=user_id)
            user_group_names = {g["name"] for g in user_groups}

        groups = kc.get_groups()
        valid_groups = [g["name"] for g in groups if g["name"].lower() != "admin"]

        if not valid_groups:
            return True, "No groups are currently available to request."

        group_lines = []
        for name in valid_groups:
            if name in user_group_names:
                group_lines.append(f"* `{name}` *(Already a member)*")
            else:
                group_lines.append(f"* `{name}`")

        group_list = "\n".join(group_lines)
        return True, f"**Available Groups:**\n{group_list}"

    except KeycloakError as e:
        return False, f"Keycloak API error: {str(e)}"
    except Exception as e:
        return False, f"Unexpected error: {str(e)}"


# ------------------------------------------------------------------------------
# Matrix Message Sending Wrappers
# ------------------------------------------------------------------------------
async def send_message_safe(client: AsyncClient, room_id: str, content: dict):
    while True:
        try:
            return await client.room_send(
                room_id=room_id,
                message_type="m.room.message",
                content=content,
            )
        except OlmUnverifiedDeviceError as e:
            print(f"Auto-trusting unverified device '{e.device.device_id}' for user '{e.device.user_id}'...")
            client.verify_device(e.device)


async def send_markdown_message(
    client: AsyncClient,
    room_id: str,
    md_text: str,
    msgtype: str = "m.text",
    relates_to: dict = None,
):
    html_body = markdown.markdown(md_text, extensions=["extra", "sane_lists"])

    content = {
        "msgtype": msgtype,
        "body": md_text,
        "format": "org.matrix.custom.html",
        "formatted_body": html_body,
    }

    if relates_to:
        content["m.relates_to"] = relates_to
        content["m.new_content"] = {
            "msgtype": msgtype,
            "body": md_text,
            "format": "org.matrix.custom.html",
            "formatted_body": html_body,
        }
        content["body"] = f"* {md_text}"
        content["formatted_body"] = f"* {html_body}"

    return await send_message_safe(client, room_id, content)


# ------------------------------------------------------------------------------
# Matrix Event Handlers
# ------------------------------------------------------------------------------
async def on_invite(client: AsyncClient, room: MatrixRoom, event: InviteMemberEvent):
    if event.state_key != client.user_id:
        return
    if not event.sender.endswith(":starling.mynest.love"):
        return

    print(f"Received invite for room {room.room_id} from {event.sender}. Joining...")
    await client.join(room.room_id)


async def on_message(client: AsyncClient, room: MatrixRoom, event: RoomMessageText):
    if event.sender == client.user_id:
        return

    body = event.body.strip()
    matrix_user = event.sender
    kc_username = matrix_user.split(":")[0].lstrip("@")

    # --- COMMAND: !groups ---
    if body.startswith("!groups"):
        success, msg = get_requestable_groups(kc_username)
        await send_markdown_message(
            client,
            room_id=room.room_id,
            md_text=msg,
            msgtype="m.notice" if not success else "m.text",
        )
        return

    # --- COMMAND: !request ---
    if not body.startswith("!request"):
        return

    parts = body.split(maxsplit=1)
    if len(parts) < 2:
        await send_markdown_message(
            client,
            room_id=room.room_id,
            md_text="Usage: `!request <group_name>` or `!groups`",
            msgtype="m.notice",
        )
        return

    requested_group = parts[1].strip()

    if requested_group.lower() == "admin":
        await send_markdown_message(
            client,
            room_id=room.room_id,
            md_text="❌ Requests for the **admin** group are not permitted.",
            msgtype="m.notice",
        )
        return

    admin_msg_body = (
        f"📋 **Access Request**\n\n"
        f"**User:** `{matrix_user}` (KC: `{kc_username}`)\n"
        f"**Requested Group:** `{requested_group}`\n\n"
        f"React with 👍 to **Approve** or 👎 to **Deny**."
    )

    res = await send_markdown_message(
        client,
        room_id=ADMIN_ROOM_ID,
        md_text=admin_msg_body,
    )

    if isinstance(res, RoomSendResponse):
        pending_requests[res.event_id] = {
            "matrix_user": matrix_user,
            "kc_username": kc_username,
            "requested_group": requested_group,
            "origin_room_id": room.room_id,
        }

        await send_markdown_message(
            client,
            room_id=room.room_id,
            md_text=f"Request for group `{requested_group}` submitted for admin approval.",
            msgtype="m.notice",
        )


async def on_reaction(client: AsyncClient, room: MatrixRoom, event: ReactionEvent):
    if room.room_id != ADMIN_ROOM_ID or event.sender not in ADMIN_MATRIX_IDS:
        return

    target_event_id = event.reacts_to
    emoji = event.key

    if not target_event_id or target_event_id not in pending_requests:
        return

    request = pending_requests[target_event_id]

    if "👍" in emoji:
        success, msg = add_user_to_kc_group(
            request["kc_username"], request["requested_group"]
        )

        status_text = (
            f"✅ **APPROVED** by `{event.sender}`\n\n"
            f"**User:** `{request['matrix_user']}` → **Group:** `{request['requested_group']}`\n"
            f"**Result:** {msg}"
        )

        user_msg = (
            f"🎉 Your request for access to group `{request['requested_group']}` has been approved!"
            if success else f"⚠️ Approval failed: {msg}"
        )
        await send_markdown_message(
            client,
            room_id=request["origin_room_id"],
            md_text=user_msg,
            msgtype="m.notice",
        )

    elif "👎" in emoji:
        status_text = (
            f"❌ **DENIED** by `{event.sender}`\n\n"
            f"**User:** `{request['matrix_user']}` → **Group:** `{request['requested_group']}`"
        )

        await send_markdown_message(
            client,
            room_id=request["origin_room_id"],
            md_text=f"Your request for group `{request['requested_group']}` was denied.",
            msgtype="m.notice",
        )
    else:
        return

    # Update original message via m.replace
    await send_markdown_message(
        client,
        room_id=ADMIN_ROOM_ID,
        md_text=status_text,
        relates_to={"rel_type": "m.replace", "event_id": target_event_id},
    )

    del pending_requests[target_event_id]


# ------------------------------------------------------------------------------
# Main Event Loop
# ------------------------------------------------------------------------------
async def main():
    client = AsyncClient(
        MATRIX_HOMESERVER,
        MATRIX_BOT_USER,
        store_path="/app/store",
    )

    client.add_event_callback(
        lambda room, event: on_message(client, room, event), RoomMessageText
    )
    client.add_event_callback(
        lambda room, event: on_reaction(client, room, event), ReactionEvent
    )
    client.add_event_callback(
        lambda room, event: on_invite(client, room, event), InviteMemberEvent
    )

    print(f"Connecting to Matrix homeserver {MATRIX_HOMESERVER}...")
    await client.login(MATRIX_BOT_PASSWORD)
    print(f"Logged in as {MATRIX_BOT_USER}. Syncing...")

    await client.sync_forever(timeout=30000, full_state=True)


if __name__ == "__main__":
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\nBot stopped by user.")
        sys.exit(0)