Initial commit
This commit is contained in:
Astra Logical
commit
af8b071325
1 changed files with 247 additions and 0 deletions
247
matrix_keycloak_bot.py
Normal file
247
matrix_keycloak_bot.py
Normal file
|
|
@ -0,0 +1,247 @@
|
|||
import asyncio
|
||||
import os
|
||||
import sys
|
||||
from keycloak import KeycloakAdmin
|
||||
from keycloak.exceptions import KeycloakError
|
||||
from nio import (
|
||||
AsyncClient,
|
||||
MatrixRoom,
|
||||
RoomMessageText,
|
||||
ReactionEvent,
|
||||
RoomSendResponse,
|
||||
)
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Configuration (Set these via environment variables or replace inline)
|
||||
# ------------------------------------------------------------------------------
|
||||
MATRIX_HOMESERVER = os.getenv("MATRIX_HOMESERVER", "https://matrix.nest.local")
|
||||
MATRIX_BOT_USER = os.getenv("MATRIX_BOT_USER", "@access-bot:nest.local")
|
||||
MATRIX_BOT_PASSWORD = os.getenv("MATRIX_BOT_PASSWORD", "SuperSecretBotPassword")
|
||||
ADMIN_ROOM_ID = os.getenv("ADMIN_ROOM_ID", "!adminroomid:nest.local")
|
||||
ADMIN_MATRIX_IDS = set(os.getenv("ADMIN_MATRIX_IDS", "@you:nest.local").split(","))
|
||||
|
||||
KEYCLOAK_URL = os.getenv("KEYCLOAK_URL", "https://keycloak.nest.local/")
|
||||
KEYCLOAK_REALM = os.getenv("KEYCLOAK_REALM", "master")
|
||||
KEYCLOAK_CLIENT_ID = os.getenv("KEYCLOAK_CLIENT_ID", "nest-matrix-bot")
|
||||
KEYCLOAK_CLIENT_SECRET = os.getenv("KEYCLOAK_CLIENT_SECRET", "your-client-secret")
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# In-Memory State
|
||||
# Maps target message event_id -> request metadata
|
||||
# ------------------------------------------------------------------------------
|
||||
pending_requests = {}
|
||||
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Keycloak Helper Functions
|
||||
# ------------------------------------------------------------------------------
|
||||
def get_keycloak_client() -> KeycloakAdmin:
|
||||
"""Initializes and returns a KeycloakAdmin client using service account credentials."""
|
||||
return KeycloakAdmin(
|
||||
server_url=KEYCLOAK_URL,
|
||||
client_id=KEYCLOAK_CLIENT_ID,
|
||||
client_secret=KEYCLOAK_CLIENT_SECRET,
|
||||
realm_name=KEYCLOAK_REALM,
|
||||
user_realm_name=KEYCLOAK_REALM,
|
||||
grant_type="client_credentials",
|
||||
verify=True,
|
||||
)
|
||||
|
||||
|
||||
def add_user_to_kc_group(username: str, group_name: str) -> tuple[bool, str]:
|
||||
"""Queries Keycloak for the user and group UUIDs and adds the user to the group."""
|
||||
try:
|
||||
kc = get_keycloak_client()
|
||||
|
||||
# 1. Fetch User UUID (Assumes Matrix localpart matches Keycloak username)
|
||||
users = kc.get_users(query={"username": username, "exact": True})
|
||||
if not users:
|
||||
return False, f"Keycloak user '{username}' not found."
|
||||
user_id = users[0]["id"]
|
||||
|
||||
# 2. Fetch Group UUID
|
||||
groups = kc.get_groups()
|
||||
target_group = next((g for g in groups if g["name"].lower() == group_name.lower()), None)
|
||||
if not target_group:
|
||||
return False, f"Keycloak group '{group_name}' not found."
|
||||
group_id = target_group["id"]
|
||||
|
||||
# 3. Assign User to Group
|
||||
kc.group_user_add(user_id=user_id, group_id=group_id)
|
||||
return True, f"Successfully added '{username}' to group '{target_group['name']}'."
|
||||
|
||||
except KeycloakError as e:
|
||||
return False, f"Keycloak API error: {str(e)}"
|
||||
except Exception as e:
|
||||
return False, f"Unexpected error: {str(e)}"
|
||||
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Matrix Event Handlers
|
||||
# ------------------------------------------------------------------------------
|
||||
async def on_message(client: AsyncClient, room: MatrixRoom, event: RoomMessageText):
|
||||
"""Listens for `!request <group_name>` commands."""
|
||||
# Ignore messages sent by the bot itself
|
||||
if event.sender == client.user_id:
|
||||
return
|
||||
|
||||
body = event.body.strip()
|
||||
if not body.startswith("!request"):
|
||||
return
|
||||
|
||||
parts = body.split(maxsplit=1)
|
||||
if len(parts) < 2:
|
||||
await client.room_send(
|
||||
room_id=room.room_id,
|
||||
message_type="m.room.message",
|
||||
content={"msgtype": "m.notice", "body": "Usage: !request <group_name>"},
|
||||
)
|
||||
return
|
||||
|
||||
requested_group = parts[1].strip()
|
||||
matrix_user = event.sender
|
||||
# Extract username (e.g., "@alice:nest.local" -> "alice")
|
||||
kc_username = matrix_user.split(":")[0].lstrip("@")
|
||||
|
||||
# Send notification message to the private Admin Room
|
||||
admin_msg_body = (
|
||||
f"📋 **Access Request**\n"
|
||||
f"**User:** `{matrix_user}` (KC Username: `{kc_username}`)\n"
|
||||
f"**Requested Group:** `{requested_group}`\n\n"
|
||||
f"React with 👍 to **Approve** or 👎 to **Deny**."
|
||||
)
|
||||
|
||||
res = await client.room_send(
|
||||
room_id=ADMIN_ROOM_ID,
|
||||
message_type="m.room.message",
|
||||
content={
|
||||
"msgtype": "m.text",
|
||||
"body": admin_msg_body,
|
||||
"format": "org.matrix.custom.html",
|
||||
"formatted_body": admin_msg_body.replace("\n", "<br>"),
|
||||
},
|
||||
)
|
||||
|
||||
if isinstance(res, RoomSendResponse):
|
||||
# Store pending request keyed by the admin message event_id
|
||||
pending_requests[res.event_id] = {
|
||||
"matrix_user": matrix_user,
|
||||
"kc_username": kc_username,
|
||||
"requested_group": requested_group,
|
||||
"origin_room_id": room.room_id,
|
||||
}
|
||||
|
||||
# Confirm request receipt to the user
|
||||
await client.room_send(
|
||||
room_id=room.room_id,
|
||||
message_type="m.room.message",
|
||||
content={
|
||||
"msgtype": "m.notice",
|
||||
"body": f"Request for group '{requested_group}' submitted for admin approval.",
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
async def on_reaction(client: AsyncClient, room: MatrixRoom, event: ReactionEvent):
|
||||
"""Listens for reaction approvals/denials in the admin room."""
|
||||
if room.room_id != ADMIN_ROOM_ID:
|
||||
return
|
||||
|
||||
# Verify reactor is an authorized admin
|
||||
if event.sender not in ADMIN_MATRIX_IDS:
|
||||
return
|
||||
|
||||
relates_to = event.content.get("m.relates_to", {})
|
||||
target_event_id = relates_to.get("event_id")
|
||||
emoji = relates_to.get("key")
|
||||
|
||||
# Check if this reaction targets an active pending request
|
||||
if not target_event_id or target_event_id not in pending_requests:
|
||||
return
|
||||
|
||||
request = pending_requests[target_event_id]
|
||||
|
||||
if emoji == "👍":
|
||||
# Execute Keycloak Group Addition
|
||||
success, msg = add_user_to_kc_group(
|
||||
request["kc_username"], request["requested_group"]
|
||||
)
|
||||
|
||||
status_text = (
|
||||
f"✅ **APPROVED** by `{event.sender}`\n"
|
||||
f"**User:** `{request['matrix_user']}` → **Group:** `{request['requested_group']}`\n"
|
||||
f"**Result:** {msg}"
|
||||
)
|
||||
|
||||
# Notify requesting user
|
||||
user_msg = (
|
||||
f"🎉 Your request for access to group '{request['requested_group']}' "
|
||||
f"has been approved!" if success else f"⚠️ Approval failed: {msg}"
|
||||
)
|
||||
await client.room_send(
|
||||
room_id=request["origin_room_id"],
|
||||
message_type="m.room.message",
|
||||
content={"msgtype": "m.notice", "body": user_msg},
|
||||
)
|
||||
|
||||
elif emoji == "👎":
|
||||
status_text = (
|
||||
f"❌ **DENIED** by `{event.sender}`\n"
|
||||
f"**User:** `{request['matrix_user']}` → **Group:** `{request['requested_group']}`"
|
||||
)
|
||||
|
||||
await client.room_send(
|
||||
room_id=request["origin_room_id"],
|
||||
message_type="m.room.message",
|
||||
content={
|
||||
"msgtype": "m.notice",
|
||||
"body": f"Your request for group '{request['requested_group']}' was denied.",
|
||||
},
|
||||
)
|
||||
else:
|
||||
return # Ignore other reactions
|
||||
|
||||
# Update the original admin room message to reflect resolution status
|
||||
await client.room_send(
|
||||
room_id=ADMIN_ROOM_ID,
|
||||
message_type="m.room.message",
|
||||
content={
|
||||
"msgtype": "m.text",
|
||||
"body": status_text,
|
||||
"format": "org.matrix.custom.html",
|
||||
"formatted_body": status_text.replace("\n", "<br>"),
|
||||
"m.relates_to": {"rel_type": "m.replace", "event_id": target_event_id},
|
||||
},
|
||||
)
|
||||
|
||||
# Clean up request state
|
||||
del pending_requests[target_event_id]
|
||||
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Main Event Loop
|
||||
# ------------------------------------------------------------------------------
|
||||
async def main():
|
||||
client = AsyncClient(MATRIX_HOMESERVER, MATRIX_BOT_USER)
|
||||
|
||||
# Register callbacks
|
||||
client.add_event_callback(
|
||||
lambda room, event: on_message(client, room, event), RoomMessageText
|
||||
)
|
||||
client.add_event_callback(
|
||||
lambda room, event: on_reaction(client, room, event), ReactionEvent
|
||||
)
|
||||
|
||||
print(f"Connecting to Matrix homeserver {MATRIX_HOMESERVER}...")
|
||||
await client.login(MATRIX_BOT_PASSWORD)
|
||||
print(f"Logged in as {MATRIX_BOT_USER}. Syncing...")
|
||||
|
||||
await client.sync_forever(timeout=30000, full_state=True)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
asyncio.run(main())
|
||||
except KeyboardInterrupt:
|
||||
print("\nBot stopped by user.")
|
||||
sys.exit(0)
|
||||
Loading…
Add table
Reference in a new issue