@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/export/authentik.d.ts

@@ -1,110 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { type Tables } from './frameworks/tables';
-import { RecordSet, type Obj } from './record-set';
-import { VendorHttp } from './vendor-http';
-/**
- * `atlas migrate export authentik` — a self-hosted authentik (goauthentik)
- * instance onto the canonical bundle models. Two ways in:
- *
- *   DATABASE DUMP (the full export): authentik's API never returns password
- *   hashes, TOTP seeds, recovery codes or WebAuthn public keys, so the owner
- *   dumps authentik's own PostgreSQL tables (one `<table>.csv|json|ndjson` per
- *   table, `psql \copy`) and the exporter reads them on this machine:
- *
- *     authentik_core_user              → user (Django password digest verbatim,
- *                                        `!…` unusable passwords dropped)
- *     authentik_install_id             → the hashed `sub` (see below); never
- *                                        written to the bundle (old installs
- *                                        use the SECRET_KEY as the install id)
- *     authentik_core_group (+ parentage, user_groups / user_ak_groups)
- *                                      → app roles (default) or organizations;
- *                                        superuser groups → the `admin` role
- *     authentik_rbac_role (+ user_roles, group_roles)
- *                                      → app roles `rbac:<name>`
- *     authentik_core_usersourceconnection (+ oauth / saml subtables, sources)
- *                                      → identities; SAML sources → SSO connections
- *     authentik_core_token             → API keys (sha256 of the plaintext key,
- *                                        so `api` and `app_password` tokens keep working)
- *     authentik_stages_authenticator_* → TOTP (hex seed → base32, 6/8 digits,
- *                                        its step), static recovery tokens,
- *                                        WebAuthn passkeys, SMS / email factors
- *
- *   API (no hashes): `/api/v3` with an API token — users, groups, roles,
- *   source links, API keys (`view_key`). Passwords then move by lazy
- *   migration (the `authentik` preset) and factors are re-enrolled.
- *
- * THE USER ID. Atlas keys imported users by the subject the vendor's tokens
- * carry. authentik's OAuth2/OIDC providers choose `sub` per provider
- * (`sub_mode`, core: authentik/providers/oauth2/id_token.py `_resolve_sub`):
- *   hashed_user_id (default) sha256(f"{pk}-{install_id}") hex — `User.uid`
- *   user_id   the integer pk          user_uuid   the user's uuid
- *   user_username / user_email        user_upn    attributes.upn, else uid
- * The export uses one mode (`--set authentik-sub-mode`, or the one every
- * provider in the dump uses) and keeps the other ids in private metadata.
- */
-export type AuthentikSubMode = 'hashed_user_id' | 'user_id' | 'user_uuid' | 'user_username' | 'user_email' | 'user_upn';
-export declare const AUTHENTIK_SUB_MODES: readonly AuthentikSubMode[];
-export interface AuthentikExportOptions {
-    /** authentik's tables (a dump directory read with `readDumpDir`): the full export. */
-    tables?: Tables;
-    /** The authentik URL (`https://auth.example.com`): the API export, and the SAML ACS URLs. */
-    baseUrl?: string;
-    /** An authentik API token (Directory → Tokens, intent API) for the API export. */
-    token?: string;
-    /** Which `sub` the apps' tokens carry; default: the mode the providers use, else hashed_user_id. */
-    subMode?: AuthentikSubMode;
-    /** The install id for `hashed_user_id` when the dump has no `authentik_install_id` table. */
-    installId?: string;
-    groupsAs?: 'roles' | 'organizations' | 'skip';
-    /** The WebAuthn RP id for passkeys registered before authentik stored one per device. */
-    rpId?: string;
-    /** authentik has no verified-email flag: treat every address as verified. Default false. */
-    trustEmails?: boolean;
-    /** Carry the stored upstream OAuth access tokens of social links. Default false. */
-    oauthTokens?: boolean;
-    now?: Date;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-/** One user as the dump or the API has it (the API never has `password`). */
-interface AkUser {
-    pk: string;
-    uuid?: string;
-    /** `User.uid` when the API reported it. */
-    uid?: string;
-    username?: string;
-    email?: string;
-    name?: string;
-    password?: string;
-    isActive: boolean;
-    type?: string;
-    path?: string;
-    attributes: Obj;
-    lastLogin?: string | number;
-    dateJoined?: string | number;
-}
-export declare function exportAuthentik(opts: AuthentikExportOptions): Promise<RecordSet>;
-/** `User.uid` (authentik/core/models.py): sha256 of "<pk>-<install id>", hex. */
-export declare function authentikUid(pk: string, installId: string): string;
-/** The id a user's tokens carry as `sub` under a provider's sub_mode; undefined when the user has none. */
-export declare function authentikSubject(u: AkUser, mode: AuthentikSubMode, installId?: string): string | undefined;
-/**
- * A Django password digest (authentik uses Django's default hashers) as a
- * bundle password, in a form Atlas's registry verifies:
- *   pbkdf2_sha256$… / pbkdf2_sha1$…  → pbkdf2_django (verbatim)
- *   bcrypt_sha256$$2b$…              → bcrypt_sha256_django (verbatim)
- *   argon2$argon2id$v=19$…           → argon2, the argon2-cffi PHC string
- *                                      (a version-less hash is Argon2 v1.0: `v=16`)
- *   bcrypt$$2b$…                     → bcrypt, the plain bcrypt digest
- *   scrypt$<n>$<salt>$<r>$<p>$<hash> → scrypt with its parameters (64-byte key)
- * Null for an unusable (`!…`) or unknown digest.
- */
-export declare function djangoPassword(digest: string | undefined): PasswordHash | null;
-/** RFC 4648 base32, unpadded. */
-export declare function base32(bytes: Buffer): string;
-export declare function exportAuthentikDump(tables: Tables, opts?: Omit<AuthentikExportOptions, 'tables'>): RecordSet;
-/** Every page of an authentik list endpoint (`{ pagination: { next }, results }`, next = 0 on the last page). */
-export declare function authentikList(http: VendorHttp, path: string): Promise<Obj[]>;
-export declare function exportAuthentikApi(opts: AuthentikExportOptions): Promise<RecordSet>;
-export {};