gitlabrat 1.0__py3-none-any.whl

labrat/cli/agents.py

@@ -0,0 +1,60 @@
+from labrat.cli import common
+from labrat.controllers.agents import Agents
+
+def build_parser(parsers):
+    parser = parsers.add_parser("agents", help="Manage GitLab agents")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    list_parser = common.add_filtered_parser(subparsers, "list", handle_list_args, aliases=["ls"], help="List GitLab servers", filter_required=False)
+    
+    delete_parser = common.add_filtered_parser(subparsers, "delete", handle_delete_args, aliases=["rm"], help="Delete GitLab server from config")
+
+    add_key_parser = common.add_filtered_parser(subparsers, "add-key", handle_add_key_args, help="Add SSH key to the user account", filter_required=False)
+    key_group = add_key_parser.add_mutually_exclusive_group(required=True)
+    key_group.add_argument("-k", "--key", required=False, help="Public SSH key to add")
+    key_group.add_argument("-K", "--key-file", required=False, help="Path to public SSH key file")
+
+    add_key_parser.add_argument("-t", "--title", required=False, help="Title for the SSH key", default="SSH Key")
+
+    parser.set_defaults(controller=Agents())
+    return parser
+
+def handle_list_args(args):
+    # Prepare table
+    headers = ["Host", "ID", "Username", "Name", "Authenticated", "Is Admin", "Is Bot", "Password", "Private Token"]
+    data = []
+
+    for agent in args.controller.list(args.filter):
+        data.append([
+            agent.host,
+            agent.id,
+            agent.username,
+            agent.gitlab.user.name if agent.is_authenticated else "-",
+            agent.is_authenticated,
+            agent.is_admin,
+            agent.is_bot,
+            agent.password,
+            agent.private_token
+        ])
+
+    common.print_table(headers, data, "Host")
+
+def handle_delete_args(args):
+    # Delete configs for filtered sections
+    for agent in args.controller.delete(args.filter):
+        print(f"[-] Deleted {agent.label} from config")
+
+def handle_add_key_args(args):
+    # Prepare SSH key
+    if args.key:
+        key = args.key
+    elif args.key_file:
+        with open(args.key_file, "r") as f:
+            key = f.read().strip()
+
+    # Add SSH key to agents
+    for agent, err in args.controller.add_ssh_key(args.filter, args.title, key):
+        if err:
+            print(f"[-] Failed to add SSH key to {agent.label}: {err}")
+        else:
+            print(f"[+] Added SSH key to {agent.label}")

labrat/cli/auth.py

@@ -0,0 +1,60 @@
+from labrat.controllers.auth import Auth
+from labrat.core.utils import parse_host_range
+
+def build_parser(parsers):
+    parser = parsers.add_parser("auth", help="Authenticate to GitLab server(s)")
+
+    parser.add_argument("-t", "--target", required=False, nargs="+", action="extend", help="GitLab server URL or pattern")
+    parser.add_argument("-T", "--target-file", required=False, help="Path to file containing GitLab server URLs or patterns")
+    parser.add_argument("-u", "--username", required=False, help="Username or e-mail for authentication")
+    parser.add_argument("-p", "--password", required=False, help="Password for authentication")
+    parser.add_argument("-C", "--combo-list", required=False, help="Path to the combo list file")
+    parser.add_argument("-l", "--use-ldap", action="store_true", help="Use LDAP for authentication")
+    parser.add_argument("-r", "--re-auth", action="store_true", help="Re-authenticate with stored credentials")
+    parser.add_argument("-n", "--token-name", required=False, help="Name for the access token", default="private token")
+    parser.add_argument("-s", "--scopes", required=False, help="Comma-separated list of scopes for the access token", default="api,read_repository,write_repository")
+
+    parser.set_defaults(func=handle_args, _parser=parser)
+    parser.set_defaults(controller=Auth())
+    return parser
+
+def handle_args(args):
+    has_targets = args.target or args.target_file
+    has_credentials = (args.username and args.password) or args.combo_list
+    can_auth = has_targets and has_credentials
+
+    if args.re_auth or can_auth:
+        auth(args)
+    else:
+        getattr(args, "_parser", None).print_help()
+        return
+
+def auth(args):
+    # Build the list of users
+    users = []
+    if args.username:
+        users = [(args.username, args.password)]
+    elif args.combo_list:
+        with open(args.combo_list, "r") as f:
+            for line in f:
+                username, password = line.strip().split(":")
+                users.append((username, password))
+
+    # Build the list of targets
+    targets = []
+    if args.target:
+        for target in args.target:
+            targets.extend(parse_host_range(target))
+    elif args.target_file:
+        with open(args.target_file, "r") as f:
+            for line in f:
+                targets.extend(parse_host_range(line.strip()))
+
+    scopes = args.scopes.split(",") if args.scopes else []
+
+    # Iterate over each user and target
+    for agent, err in args.controller.reauth(token_name=args.token_name, token_scopes=scopes, targets=targets, users=[user[0] for user in users]) if args.re_auth else args.controller.auth(targets, users, token_name=args.token_name, token_scopes=scopes, use_ldap=args.use_ldap):
+        if err:
+            print(f"[-] Authentication failed for {agent.label}: {err}")
+        else:
+            print(f"[+] Authenticated {agent.label}{' (admin)' if agent.is_admin else ''} with {agent.private_token}")

labrat/cli/common.py

@@ -0,0 +1,76 @@
+import re
+
+def add_filtered_parser(subparsers, name, handler, aliases=[], help=None, filter_required=True, all_help="All items", filter_help="Filter by substring"):
+    parser = subparsers.add_parser(name, aliases=aliases, help=help)
+
+    filter_group = parser.add_mutually_exclusive_group(required=filter_required)
+
+    if filter_required:
+        filter_group.add_argument("-a", "--all", action="store_true", help=all_help)
+
+    filter_group.add_argument("-f", "--filter", action="append", help=filter_help)
+
+    parser.set_defaults(func=handler, _parser=parser)
+    return parser
+
+def print_table(headers, data, sort_key=None):
+    """
+    Print a table with the given data and headers.
+    """
+    column_widths = [max(len(re.sub(r'\x1b\[[0-9;]*m', '', str(x))) for x in col) for col in zip(*([headers] + data))]
+
+    # Print header
+    if headers:
+        print(" " + "  ".join(h.ljust(w) for h, w in zip(headers, column_widths)) + " ")
+        print(" ".join("=" * (w + 1) for w in column_widths))
+
+    # Sort data by the specified key
+    if sort_key is not None:
+        data = sorted(data, key=lambda x: x[headers.index(sort_key)])
+
+    # Print data rows
+    for row in data:
+        print(" " + "  ".join(str(x).ljust(w) for x, w in zip(row, column_widths)) + " ")
+
+class Colors:
+    RESET = "\x1b[0m"
+    BRIGHT_RED = "\x1b[0;91m"
+    RED = "\x1b[0;31m"
+    GREEN = "\x1b[0;32m"
+    YELLOW = "\x1b[0;33m"
+    BLUE = "\x1b[0;34m"
+    MAGENTA = "\x1b[0;35m"
+    CYAN = "\x1b[0;36m"
+    WHITE = "\x1b[0;37m"
+
+def color_access_level(level, text):
+    shades = [
+        Colors.RESET,      # guest - none
+        Colors.RESET,      # planner - none
+        Colors.RESET,      # reporter - none
+        Colors.GREEN,      # developer - green
+        Colors.YELLOW,     # maintainer - yellow
+        Colors.BRIGHT_RED, # owner - bright red (highest)
+    ]
+    idx = min(len(shades)-1, max(0, (level // 10)))
+    return f"{shades[idx]}{text}{Colors.RESET}"
+
+def color_diff(diff):
+    lines = []
+    for line in diff.splitlines():
+        if line.startswith("@@"):
+            match = re.match(r"(@@[^@]*@@)(.*)", line)
+            if match:
+                header = match.group(1)
+                tail = match.group(2)
+                lines.append(f"{Colors.CYAN}{header}{Colors.RESET}{tail}")
+            else:
+                lines.append(line)
+        elif line.startswith("+"):
+            lines.append(f"{Colors.GREEN}{line}{Colors.RESET}")  # Green for additions
+        elif line.startswith("-"):
+            lines.append(f"{Colors.RED}{line}{Colors.RESET}")  # Red for deletions
+        else:
+            lines.append(line)
+
+    return "\n".join(lines)

labrat/cli/projects.py

@@ -0,0 +1,95 @@
+import datetime
+import gitlab
+
+from labrat.cli import common
+from labrat.controllers.projects import Projects
+
+def build_parser(parsers):
+    parser = parsers.add_parser("projects", help="Manage GitLab projects")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    list_parser = common.add_filtered_parser(subparsers, "list", handle_list_args, aliases=["ls"], help="List GitLab projects", filter_required=False)
+    list_parser.add_argument("-m", "--min-access-level", required=False, type=int, help="Minimum access level to filter projects", default=0)
+    list_parser.add_argument("-u", "--user", action="append", required=False, help="Filter agent performing action")
+
+    clone_parser = common.add_filtered_parser(subparsers, "clone", handle_clone_args, help="Clone GitLab repositories")
+    clone_parser.add_argument("-o", "--output", required=False, help="Output location for cloned repositories", default='./')
+    clone_parser.add_argument("-u", "--user", action="append", required=False, help="Filter agent performing action")
+
+    create_token_parser = common.add_filtered_parser(subparsers, "create_token", handle_create_token_args, help="Create an access token", filter_required=True)
+    create_token_parser.add_argument("-l", "--access-level", required=False, type=int, help="Access level for the access token", default=50)
+    create_token_parser.add_argument("-d", "--days", required=False, type=int, help="Number of days until the token expires", default=60)
+    create_token_parser.add_argument("-n", "--token-name", required=False, help="Name for the access token", default="project_bot")
+    create_token_parser.add_argument("-s", "--scopes", required=False, help="Comma-separated list of scopes for the access token", default="api,read_repository,write_repository")
+    create_token_parser.add_argument("-u", "--user", action="append", required=False, help="Filter agent performing action")
+
+    update_parser = common.add_filtered_parser(subparsers, "update", handle_update_args, help="Update GitLab repositories procedurally", filter_required=True)
+    update_parser.add_argument("-F", "--file", required=True, help="Path to the remote file to update")
+
+    mechanism_group = update_parser.add_mutually_exclusive_group(required=True)
+    mechanism_group.add_argument("-c", "--content", required=False, help="Text content to replace the file with")
+    mechanism_group.add_argument("-C", "--content-file", required=False, help="Path to replacement file")
+    mechanism_group.add_argument("-p", "--pattern", required=False, help="String or regex pattern to find in the file")
+
+    update_parser.add_argument("-r", "--replace", required=False, help="String or pattern to replace the found text")
+
+    update_parser.add_argument("-m", "--commit-message", required=False, help="Commit message for the update", default="Update")
+    update_parser.add_argument("-b", "--branch", required=False, help="Branch to update", default="main")
+    update_parser.add_argument("-u", "--user", action="append", required=False, help="Filter agent performing action")
+
+    parser.set_defaults(controller=Projects())
+    return subparsers
+
+def handle_list_args(args):
+    headers = ["Host", "ID", "Path with Namespace", "Access Level", "Agents"]
+    data = []
+
+    for project in args.controller.list(args.filter, args.user):
+        # color each username by that agent's access level (higher -> brighter)
+        usernames = []
+        for agent in project.agents:
+            colored_username = common.color_access_level(agent.access_level, f"{agent.username} ({agent.access_level})")
+            usernames.append(colored_username)
+        
+        # Add project information to data table
+        data.append([
+            project.host,
+            project.id,
+            project.path_with_namespace,
+            f"{project.access_level} ({gitlab.const.AccessLevel(project.access_level).name.lower()})",
+            ", ".join(usernames)
+        ])
+
+    common.print_table(headers, data)
+
+def handle_clone_args(args):
+    for project, err in args.controller.clone(args.output, args.user, args.filter):
+        if err:
+            print(f"[!] Failed to clone {project.web_url}: {err}")
+        else:
+            print(f"[+] Successfully cloned {project.web_url} to {project.to_path}")
+
+def handle_create_token_args(args):
+    expiration = (datetime.datetime.now() + datetime.timedelta(days=args.days)).strftime("%Y-%m-%d")
+    for project, agent, err in args.controller.create_token(args.token_name, args.access_level, args.scopes.split(","), expiration, args.user, args.filter):
+        if err:
+            print(f"[!] Failed to create access token for {project.web_url}: {err}")
+        else:
+            print(f"[+] Successfully created access token for {project.web_url}: {agent.private_token}")
+
+def handle_update_args(args):
+    content = None
+    if args.content:
+        content = args.content
+    elif args.content_file:
+        with open(args.content_file, "r") as f:
+            content = f.read()
+    
+    for project, commit, err in args.controller.update(file_path=args.file, content=content, pattern=args.pattern, replace=args.replace, branch=args.branch, commit_message=args.commit_message, agent_filter=args.user, filter=args.filter):
+        if err:
+            print(f"[!] Failed to update {project.web_url}: {err}")
+        else:
+            print(f"[+] Successfully updated {project.web_url}:")
+            diff = commit.diff()
+            if diff:
+                print(common.color_diff(diff[0].get("diff")))

labrat/cli/users.py

@@ -0,0 +1,40 @@
+from labrat.cli import common
+from labrat.controllers.users import Users
+
+def build_parser(parsers):
+    parser = parsers.add_parser("users", help="Manage GitLab users")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    list_parser = common.add_filtered_parser(subparsers, "list", handle_list_args, aliases=["ls"], help="List GitLab users", filter_required=False)
+
+    create_token_parser = common.add_filtered_parser(subparsers, "create_token", handle_create_token_args, help="Create an access token", filter_required=True)
+    create_token_parser.add_argument("-n", "--token-name", required=False, help="Name for the access token", default="private token")
+    create_token_parser.add_argument("-s", "--scopes", required=False, help="Comma-separated list of scopes for the access token", default="api,read_repository,write_repository")
+
+
+    parser.set_defaults(controller=Users())
+    return parser
+
+def handle_list_args(args):
+    headers = ["Host", "ID", "Username", "Name", "Is Agent", "Is Admin", "Is Bot"]
+    data = []
+
+    for user in args.controller.list(filter=args.filter):
+        data.append([
+            user.host,
+            user.id,
+            user.username,
+            user.name,
+            getattr(user, "is_agent", "-"),
+            getattr(user, "is_admin", "-"),
+            getattr(user, "bot", "-")
+        ])
+
+    common.print_table(headers, data, "Host")
+
+def handle_create_token_args(args):
+    for agent, err in args.controller.create_token(args.token_name, args.scopes.split(","), filter=args.filter):
+        if err:
+            print(f"[-] Failed to create access token: {err}")
+        else:
+            print(f"[+] Created access token for {agent.label}: {agent.private_token}")

labrat/controllers/agents.py

@@ -0,0 +1,47 @@
+from labrat.core.agent import Agent
+from labrat.core.config import Config
+from urllib.parse import urlparse
+
+class Agents:
+    def __init__(self):
+        self.config = Config(preauth=True)
+
+    def list(self, filter=None):
+        """List Labrat agents in config.
+        
+        Keyword arguments:
+        - filter: Regex filter and field selection passed to `utils.obj_filter()`
+        """
+
+        for section, agent in self.config.filter(filter):
+            yield agent
+
+    def delete(self, filter):
+        """Delete Labrat agents from config.
+
+        Keyword arguments:
+        - filter: Regex filter and field selection passed to `utils.obj_filter()`
+        """
+
+        for section, agent in self.config.filter(filter):
+            self.config.remove_section(section)
+            yield agent
+
+    def add_ssh_key(self, filter, title, key):
+        """Add an SSH key to each agent matching the filter.
+
+        Keyword arguments:
+        - filter: Regex filter and field selection passed to `utils.obj_filter()`
+        - title: Title of the SSH key.
+        - key: The SSH key to add.
+        """
+
+        for section, agent in self.config.filter(filter):
+            if not agent.is_authenticated:
+                continue
+            
+            try:
+                agent.add_ssh_key(title, key)
+                yield agent, None
+            except Exception as e:
+                yield agent, e

labrat/controllers/auth.py

@@ -0,0 +1,55 @@
+from labrat.core.agent import Agent
+from labrat.core.config import Config
+from urllib.parse import urlparse
+
+class Auth:
+    def __init__(self):
+        self.config = Config()
+
+    def auth(self, targets, users, token_name, token_scopes, use_ldap=False):
+        """Authenticate and create a PAT for each user on each target.
+        
+        Keyword arguments:
+        - targets: List of target URLs to authenticate against.
+        - users: List of (username, password) tuples for authentication.
+        - token_name: Name for the created Access Token.
+        - token_scopes: Scopes for the created Access Token.
+        - use_ldap: Whether to use LDAP for authentication (default: False).
+        """
+
+        for username, password in users:
+            for target in targets:
+                agent = Agent(target, use_ldap, username, password)
+                try:
+                    agent.login()
+                    agent.auth(private_token=agent.create_pat(token_name, token_scopes))
+                    self.config[agent.section] = agent.to_dict()
+                    yield agent, None
+                except Exception as e:
+                    yield agent, e
+
+    def reauth(self, token_name, token_scopes, targets=None, users=None):
+        """Re-authenticate existing agents.
+
+        Keyword arguments:
+        - targets: List of target URLs to re-authenticate against.
+        - users: List of usernames to re-authenticate.
+        """
+
+        for section, agent in self.config:
+            # Filter by target if specified
+            if targets and agent.url not in targets:
+                continue
+
+            # Filter by username if specified
+            if users and agent.username not in users:
+                continue
+
+            try:
+                if not agent.is_authenticated:
+                    agent.login()
+                    agent.auth(private_token=agent.create_pat(token_name, token_scopes))
+                    self.config[section] = agent.to_dict()
+                yield agent, None
+            except Exception as e:
+                yield agent, e

labrat/controllers/projects.py

@@ -0,0 +1,164 @@
+import copy
+import os
+import git
+import re
+
+from labrat.core.agent import Agent
+from labrat.core.config import Config
+from labrat.core.utils import obj_filter
+from urllib.parse import urlparse
+
+class Projects:
+    def __init__(self):
+        self.config = Config(authed_only=True)
+
+    def list(self, filter=None, agent_filter=None, min_level=0):
+        """List projects accessible by agents.
+
+        Keyword arguments:
+        - filter: Regex filter and field selection passed to `utils.obj_filter()` for project objects
+        - agent_filter: Regex filter and field selection passed to `utils.obj_filter()` for agent objects
+        - min_level: Minimum desired access level for agent to return a project
+        """
+
+        repo_map = {}
+        for section, agent in self.config.filter(agent_filter):
+            projects = agent.gitlab.projects.list(all=True)
+            for project in projects:
+                access_level = self.get_project_access_level(agent, project)
+                if access_level < min_level:
+                    continue
+
+                # Agent enrichment with shallow copy
+                agent_copy = copy.copy(agent)
+                agent_copy.access_level = access_level
+
+                # Project enrichment
+                project.host = agent.host
+
+                # Add project and agent to map
+                if project.web_url not in repo_map:
+                    project.agents = [agent_copy]
+                    project.access_level = access_level
+                    repo_map[project.web_url] = project
+                else:
+                    repo_map[project.web_url].agents.append(agent_copy)
+                    repo_map[project.web_url].access_level = max(repo_map[project.web_url].access_level, access_level)
+
+        return [proj for proj in repo_map.values() if not filter or obj_filter(proj, filter)]
+
+    def clone(self, output, agent_filter=None, filter=None):
+        """Clone projects accessible by agents.
+
+        Keyword arguments:
+        - output: Output directory for cloned projects. A nested structure of `<hostname>/<namespace>/<project>` will be created inside.
+        - agent_filter: Regex filter and field selection passed to `utils.obj_filter()` for agent objects.
+        - filter: Regex filter and field selection passed to `utils.obj_filter()` for project objects.
+        """
+
+        projects = self.list(filter=filter, agent_filter=agent_filter, min_level=15)
+        for project in projects:
+            agent = project.agents[0]
+
+            url = urlparse(agent.url)
+            clone_url = f"{url.scheme}://{agent.username}:{agent.private_token}@{url.netloc}/{project.path_with_namespace}.git"
+            to_path = f"{output}{'/' if output[-1] != '/' else ''}{url.hostname}/{project.path_with_namespace}"
+            project.clone_url = clone_url
+            project.to_path = to_path
+
+            if os.path.isdir(to_path):
+                yield project, f"destination path '{to_path}' already exists"
+                continue
+
+            try:
+                git.Repo.clone_from(clone_url, to_path)
+                yield project, None
+            except Exception as e:
+                yield project, e
+
+    def create_token(self, name, access_level, scopes, expires_at, agent_filter=None, filter=None):
+        """ Create Project Access Tokens.
+        
+        Keyword arguments:
+        - name: Name of the access token.
+        - access_level: Access level of the created PAT.
+        - scopes: List of scopes for the created PAT. (e.g. `['read_repository', 'write_repository']`)
+        - expires_at: ISO format expiration date for the created PAT.
+        - agent_filter: Regex filter and field selection passed to `utils.obj_filter()` for agent objects.
+        - filter: Regex filter and field selection passed to `utils.obj_filter()` for project objects.
+        """
+
+        for project in self.list(filter=filter, agent_filter=agent_filter, min_level=40):
+            agent = project.agents[0]
+
+            try:
+                req = project.access_tokens.create({
+                    'name': name,
+                    'access_level': access_level,
+                    'scopes': scopes,
+                    'expires_at': expires_at
+                })
+
+                section = f"{req.user_id}_{project.id}@{agent.host}"
+                project_agent = Agent(agent.url, username=name, private_token=req.token, section=section)
+                self.config[section] = project_agent.to_dict()
+
+                yield project, project_agent, None
+            except Exception as e:
+                yield project, None, e
+
+    def update(self, file_path, content=None, pattern=None, replace=None, branch=None, commit_message=None, agent_filter=None, filter=None):
+        """Update file contents.
+
+        Keyword arguments:
+        - file_path: Path to the file in project to update.
+        - content: New content for the file.
+        - pattern: Regex pattern to match for replacement.
+        - replace: Replacement string for the regex pattern.
+        - branch: Branch to commit the changes to.
+        - commit_message: Commit message for the update.
+        - agent_filter: Regex filter and field selection passed to `utils.obj_filter()` for agent objects.
+        - filter: Regex filter and field selection passed to `utils.obj_filter()` for project objects.
+        """
+
+        for project in self.list(filter=filter, agent_filter=agent_filter, min_level=30):
+            agent = project.agents[0]
+            try:
+                file = project.files.get(file_path=file_path, ref="main")
+                file_content = file.decode().decode("utf-8")
+
+                if content is not None:
+                    new_content = content
+                elif pattern and replace is not None:
+                    new_content = re.sub(pattern, replace, file_content, flags=re.MULTILINE)
+                else:
+                    yield project, None, "No update method specified"
+                    continue
+
+                if new_content == file_content:
+                    yield project, None, "Content is the same, skipping update"
+                    continue
+
+                commit = project.commits.create({
+                    "branch": branch,
+                    "commit_message": commit_message,
+                    "actions": [
+                        {
+                            "action": "update",
+                            "file_path": file_path,
+                            "content": new_content
+                        }
+                    ]
+                })
+                yield project, commit, None
+            except Exception as e:
+                yield project, None, e
+
+    def get_project_access_level(self, agent, project):
+        if project.permissions['project_access']:
+            access_level = int(project.permissions['project_access']['access_level'])
+        elif project.permissions['group_access']:
+            access_level = int(project.permissions['group_access']['access_level'])
+        else:
+            access_level = 60 if agent.is_admin else 15
+        return access_level

labrat/controllers/users.py

@@ -0,0 +1,68 @@
+from labrat.core.agent import Agent
+from labrat.core.config import Config
+from labrat.core.utils import obj_filter
+from urllib.parse import urlparse
+
+class Users:
+    def __init__(self):
+        self.config = Config(authed_only=True)
+
+    def list(self, filter=None):
+        """List users and additional information.
+
+        Keyword arguments:
+        - filter: Regex filter and field selection passed to `utils.obj_filter()`
+        """
+
+        data = dict()
+        for section, agent in self.config:
+            users = agent.gitlab.users.list(all=True)
+            for user in users:
+                self._user_enrichment(agent, user)
+
+                if user.section not in data.keys() or agent.is_admin:
+                    data[user.section] = user
+
+        data = [user for user in data.values() if not filter or obj_filter(user, filter)]
+
+        return data
+
+    def create_token(self, name, scopes, filter=None):
+        """Create Personal Access Tokens for other users.
+
+        Keyword arguments:
+        - name: Name of the access token.
+        - scopes: List of scopes for the access token.
+        - filter: Regex filter and field selection passed to `utils.obj_filter()`
+        """
+
+        for section, agent in self.config:
+            if not agent.is_admin:
+                continue
+
+            for user in agent.gitlab.users.list(all=True):
+                self._user_enrichment(agent, user)
+                if user.is_agent:
+                    continue
+
+                if filter and not obj_filter(user, filter):
+                    continue
+
+                try:
+                    req = user.personal_access_tokens.create({
+                        "name": name,
+                        "scopes": scopes
+                    })
+                    agent_user = Agent(agent.url, username=user.username, private_token=req.token)
+                    self.config[user.section] = agent_user.to_dict()
+                    yield agent_user, None
+                except Exception as e:
+                    yield None, e
+
+    def _user_enrichment(self, agent, user):
+        user.url = agent.url
+        user.host = agent.host
+        user.section = f"{user.id}@{agent.host}"
+        user.label = f"{user.username}@{agent.host}"
+        user.is_agent = self.config.has_section(user.section)
+        user.is_bot = getattr(user, "bot", None)