@samik081/mcp-authentik 0.1.0

package/dist/tools/rac.js

@@ -0,0 +1,190 @@
+import { z } from 'zod';
+import { registerTool } from '../core/tools.js';
+export function registerRacTools(server, client, config) {
+    // ── RAC Endpoints ──
+    // 1. List RAC endpoints
+    registerTool(server, config, {
+        name: 'authentik_rac_endpoints_list',
+        description: 'List RAC (Remote Access Control) endpoints with optional filters.',
+        accessTier: 'read-only',
+        category: 'rac',
+        inputSchema: {
+            name: z.string().optional().describe('Filter by endpoint name'),
+            provider: z.number().optional().describe('Filter by provider ID'),
+            search: z.string().optional().describe('Search across fields'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racEndpointsList({
+                name: args.name,
+                provider: args.provider,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 2. Get RAC endpoint
+    registerTool(server, config, {
+        name: 'authentik_rac_endpoints_get',
+        description: 'Get a single RAC endpoint by its UUID.',
+        accessTier: 'read-only',
+        category: 'rac',
+        inputSchema: {
+            pbm_uuid: z.string().describe('RAC endpoint UUID'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racEndpointsRetrieve({
+                pbmUuid: args.pbm_uuid,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 3. Create RAC endpoint
+    registerTool(server, config, {
+        name: 'authentik_rac_endpoints_create',
+        description: 'Create a new RAC endpoint for remote access.',
+        accessTier: 'full',
+        category: 'rac',
+        inputSchema: {
+            name: z.string().describe('Endpoint name (required)'),
+            provider: z.number().describe('RAC provider ID (required)'),
+            protocol: z.enum(['rdp', 'vnc', 'ssh']).describe('Connection protocol (required)'),
+            host: z.string().describe('Target host address (required)'),
+            auth_mode: z.enum(['static', 'prompt']).describe('Authentication mode (required)'),
+            settings: z.record(z.unknown()).optional().describe('Additional endpoint settings'),
+            property_mappings: z.array(z.string()).optional().describe('List of property mapping UUIDs'),
+            maximum_connections: z.number().optional().describe('Maximum concurrent connections'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racEndpointsCreate({
+                endpointRequest: {
+                    name: args.name,
+                    provider: args.provider,
+                    protocol: args.protocol,
+                    host: args.host,
+                    authMode: args.auth_mode,
+                    settings: args.settings,
+                    propertyMappings: args.property_mappings,
+                    maximumConnections: args.maximum_connections,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4. Update RAC endpoint
+    registerTool(server, config, {
+        name: 'authentik_rac_endpoints_update',
+        description: 'Update an existing RAC endpoint. Only provided fields are modified (partial update).',
+        accessTier: 'full',
+        category: 'rac',
+        inputSchema: {
+            pbm_uuid: z.string().describe('RAC endpoint UUID (required)'),
+            name: z.string().optional().describe('New endpoint name'),
+            provider: z.number().optional().describe('New RAC provider ID'),
+            protocol: z.enum(['rdp', 'vnc', 'ssh']).optional().describe('New connection protocol'),
+            host: z.string().optional().describe('New target host address'),
+            auth_mode: z.enum(['static', 'prompt']).optional().describe('New authentication mode'),
+            settings: z.record(z.unknown()).optional().describe('New endpoint settings'),
+            property_mappings: z.array(z.string()).optional().describe('New list of property mapping UUIDs'),
+            maximum_connections: z.number().optional().describe('New maximum concurrent connections'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racEndpointsPartialUpdate({
+                pbmUuid: args.pbm_uuid,
+                patchedEndpointRequest: {
+                    name: args.name,
+                    provider: args.provider,
+                    protocol: args.protocol,
+                    host: args.host,
+                    authMode: args.auth_mode,
+                    settings: args.settings,
+                    propertyMappings: args.property_mappings,
+                    maximumConnections: args.maximum_connections,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 5. Delete RAC endpoint
+    registerTool(server, config, {
+        name: 'authentik_rac_endpoints_delete',
+        description: 'Delete a RAC endpoint by its UUID. This action is irreversible.',
+        accessTier: 'full',
+        category: 'rac',
+        tags: ['destructive'],
+        inputSchema: {
+            pbm_uuid: z.string().describe('RAC endpoint UUID to delete'),
+        },
+        handler: async (args) => {
+            await client.racApi.racEndpointsDestroy({
+                pbmUuid: args.pbm_uuid,
+            });
+            return `RAC endpoint "${args.pbm_uuid}" deleted successfully.`;
+        },
+    });
+    // ── RAC Connection Tokens (no create — Pitfall 8) ──
+    // 6. List RAC connection tokens
+    registerTool(server, config, {
+        name: 'authentik_rac_connection_tokens_list',
+        description: 'List RAC connection tokens with optional filters. Tokens are system-managed (no create).',
+        accessTier: 'read-only',
+        category: 'rac',
+        inputSchema: {
+            endpoint: z.string().optional().describe('Filter by endpoint UUID'),
+            provider: z.number().optional().describe('Filter by provider ID'),
+            search: z.string().optional().describe('Search across fields'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racConnectionTokensList({
+                endpoint: args.endpoint,
+                provider: args.provider,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 7. Get RAC connection token
+    registerTool(server, config, {
+        name: 'authentik_rac_connection_tokens_get',
+        description: 'Get a single RAC connection token by its UUID.',
+        accessTier: 'read-only',
+        category: 'rac',
+        inputSchema: {
+            connection_token_uuid: z.string().describe('Connection token UUID'),
+        },
+        handler: async (args) => {
+            const result = await client.racApi.racConnectionTokensRetrieve({
+                connectionTokenUuid: args.connection_token_uuid,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 8. Delete RAC connection token
+    registerTool(server, config, {
+        name: 'authentik_rac_connection_tokens_delete',
+        description: 'Delete a RAC connection token by its UUID. This action is irreversible.',
+        accessTier: 'full',
+        category: 'rac',
+        tags: ['destructive'],
+        inputSchema: {
+            connection_token_uuid: z.string().describe('Connection token UUID to delete'),
+        },
+        handler: async (args) => {
+            await client.racApi.racConnectionTokensDestroy({
+                connectionTokenUuid: args.connection_token_uuid,
+            });
+            return `RAC connection token "${args.connection_token_uuid}" deleted successfully.`;
+        },
+    });
+}

package/dist/tools/rbac.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerRbacTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;

package/dist/tools/rbac.js

@@ -0,0 +1,283 @@
+import { z } from 'zod';
+import { registerTool } from '../core/tools.js';
+export function registerRbacTools(server, client, config) {
+    // ── Roles CRUD ─────────────────────────────────────────────────────
+    // 1. List roles
+    registerTool(server, config, {
+        name: 'authentik_rbac_roles_list',
+        description: 'List RBAC roles with optional filters.',
+        accessTier: 'read-only',
+        category: 'rbac',
+        inputSchema: {
+            group_name: z.string().optional().describe('Filter by group name'),
+            search: z.string().optional().describe('Search across role fields'),
+            ordering: z.string().optional().describe('Field to order by (prefix with - for descending)'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacRolesList({
+                groupName: args.group_name,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 2. Get role
+    registerTool(server, config, {
+        name: 'authentik_rbac_roles_get',
+        description: 'Get a single RBAC role by its UUID.',
+        accessTier: 'read-only',
+        category: 'rbac',
+        inputSchema: {
+            uuid: z.string().describe('Role UUID'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacRolesRetrieve({
+                uuid: args.uuid,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 3. Create role
+    registerTool(server, config, {
+        name: 'authentik_rbac_roles_create',
+        description: 'Create a new RBAC role.',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            name: z.string().describe('Role name (required)'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacRolesCreate({
+                roleRequest: {
+                    name: args.name,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4. Update role
+    registerTool(server, config, {
+        name: 'authentik_rbac_roles_update',
+        description: 'Update an existing RBAC role. Only provided fields are modified (partial update).',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            uuid: z.string().describe('Role UUID (required)'),
+            name: z.string().optional().describe('New role name'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacRolesPartialUpdate({
+                uuid: args.uuid,
+                patchedRoleRequest: {
+                    name: args.name,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 5. Delete role
+    registerTool(server, config, {
+        name: 'authentik_rbac_roles_delete',
+        description: 'Delete an RBAC role by its UUID. This action is irreversible.',
+        accessTier: 'full',
+        category: 'rbac',
+        tags: ['destructive'],
+        inputSchema: {
+            uuid: z.string().describe('Role UUID to delete'),
+        },
+        handler: async (args) => {
+            await client.rbacApi.rbacRolesDestroy({
+                uuid: args.uuid,
+            });
+            return `Role "${args.uuid}" deleted successfully.`;
+        },
+    });
+    // ── Permissions ────────────────────────────────────────────────────
+    // 6. List permissions
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_list',
+        description: 'List all available permissions, filterable by model and app.',
+        accessTier: 'read-only',
+        category: 'rbac',
+        inputSchema: {
+            codename: z.string().optional().describe('Filter by permission codename'),
+            content_type_model: z.string().optional().describe('Filter by content type model'),
+            content_type_app_label: z.string().optional().describe('Filter by content type app label'),
+            role: z.string().optional().describe('Filter by role UUID'),
+            user: z.number().optional().describe('Filter by user ID'),
+            search: z.string().optional().describe('Search across permission fields'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacPermissionsList({
+                codename: args.codename,
+                contentTypeModel: args.content_type_model,
+                contentTypeAppLabel: args.content_type_app_label,
+                role: args.role,
+                user: args.user,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // ── Permissions by role ────────────────────────────────────────────
+    // 7. List permissions assigned to a role
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_role_list',
+        description: 'List object permissions assigned to a specific model, filterable by role.',
+        accessTier: 'read-only',
+        category: 'rbac',
+        inputSchema: {
+            model: z.string().describe('Model identifier (e.g. "authentik_core.application")'),
+            object_pk: z.string().optional().describe('Object primary key to filter permissions for'),
+            search: z.string().optional().describe('Search across fields'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacPermissionsAssignedByRolesList({
+                model: args.model,
+                objectPk: args.object_pk,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 8. Assign permissions to a role
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_role_assign',
+        description: 'Assign permission(s) to a role. When object_pk is set, permissions are only assigned to the specific object.',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            uuid: z.string().describe('Role UUID'),
+            permissions: z.array(z.string()).describe('Array of permission codenames to assign'),
+            model: z.string().optional().describe('Model identifier for scoped permissions'),
+            object_pk: z.string().optional().describe('Object primary key for object-level permissions'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacPermissionsAssignedByRolesAssign({
+                uuid: args.uuid,
+                permissionAssignRequest: {
+                    permissions: args.permissions,
+                    model: args.model,
+                    objectPk: args.object_pk,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 9. Unassign permissions from a role
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_role_unassign',
+        description: 'Unassign permission(s) from a role. When object_pk is set, permissions are only unassigned from the specific object.',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            uuid: z.string().describe('Role UUID'),
+            permissions: z.array(z.string()).describe('Array of permission codenames to unassign'),
+            model: z.string().optional().describe('Model identifier for scoped permissions'),
+            object_pk: z.string().optional().describe('Object primary key for object-level permissions'),
+        },
+        handler: async (args) => {
+            await client.rbacApi.rbacPermissionsAssignedByRolesUnassignPartialUpdate({
+                uuid: args.uuid,
+                patchedPermissionAssignRequest: {
+                    permissions: args.permissions,
+                    model: args.model,
+                    objectPk: args.object_pk,
+                },
+            });
+            return `Permissions unassigned from role "${args.uuid}" successfully.`;
+        },
+    });
+    // ── Permissions by user ────────────────────────────────────────────
+    // 10. List permissions assigned to a user
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_user_list',
+        description: 'List object permissions assigned to a specific model, filterable by user.',
+        accessTier: 'read-only',
+        category: 'rbac',
+        inputSchema: {
+            model: z.string().describe('Model identifier (e.g. "authentik_core.user")'),
+            object_pk: z.string().optional().describe('Object primary key to filter permissions for'),
+            search: z.string().optional().describe('Search across fields'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacPermissionsAssignedByUsersList({
+                model: args.model,
+                objectPk: args.object_pk,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 11. Assign permissions to a user
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_user_assign',
+        description: 'Assign permission(s) to a user.',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            id: z.number().describe('User ID'),
+            permissions: z.array(z.string()).describe('Array of permission codenames to assign'),
+            model: z.string().optional().describe('Model identifier for scoped permissions'),
+            object_pk: z.string().optional().describe('Object primary key for object-level permissions'),
+        },
+        handler: async (args) => {
+            const result = await client.rbacApi.rbacPermissionsAssignedByUsersAssign({
+                id: args.id,
+                permissionAssignRequest: {
+                    permissions: args.permissions,
+                    model: args.model,
+                    objectPk: args.object_pk,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 12. Unassign permissions from a user
+    registerTool(server, config, {
+        name: 'authentik_rbac_permissions_by_user_unassign',
+        description: 'Unassign permission(s) from a user.',
+        accessTier: 'full',
+        category: 'rbac',
+        inputSchema: {
+            id: z.number().describe('User ID'),
+            permissions: z.array(z.string()).describe('Array of permission codenames to unassign'),
+            model: z.string().optional().describe('Model identifier for scoped permissions'),
+            object_pk: z.string().optional().describe('Object primary key for object-level permissions'),
+        },
+        handler: async (args) => {
+            await client.rbacApi.rbacPermissionsAssignedByUsersUnassignPartialUpdate({
+                id: args.id,
+                patchedPermissionAssignRequest: {
+                    permissions: args.permissions,
+                    model: args.model,
+                    objectPk: args.object_pk,
+                },
+            });
+            return `Permissions unassigned from user ${args.id} successfully.`;
+        },
+    });
+}

package/dist/tools/root.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerRootTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;

package/dist/tools/root.js

@@ -0,0 +1,14 @@
+import { registerTool } from '../core/tools.js';
+export function registerRootTools(server, client, config) {
+    // 1. Get root configuration
+    registerTool(server, config, {
+        name: 'authentik_root_config',
+        description: 'Get root configuration including capabilities, error reporting settings, and UI configuration.',
+        accessTier: 'read-only',
+        category: 'root',
+        handler: async () => {
+            const result = await client.rootApi.rootConfigRetrieve();
+            return JSON.stringify(result, null, 2);
+        },
+    });
+}

package/dist/tools/sources.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerSourceTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;