ligoj-cli 1.0.0__py3-none-any.whl

ligoj_cli-1.0.0.dist-info/RECORD

@@ -0,0 +1,20 @@
+ligoj_cli-1.0.0.dist-info/licenses/LICENSE,sha256=L2YkZq7C9_D6o9V3rYPyP1voevszDMzu8Y4DMgXuVL8,1062
+ligojcli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+ligojcli/ligoj.py,sha256=BSKbLBHw_miqKrsRRMxFUA1vkqdZUCBpxonjrIjk6i8,3836
+ligojcli/plugins/__init__.py,sha256=UMUcOsjtTJ-xapSGPQDYgKDKeNzoZkYxbfyIW2pQ9Bs,78
+ligojcli/plugins/alfresco.py,sha256=DbWhIViZfHyo6942pRX88OzLtg1RLfxpEOoMfmubyaA,12405
+ligojcli/plugins/argocd.py,sha256=S_PH2KKqhfJmWaanijkLaLbFe0HL-FZ4cj2Cq9Sx92w,9218
+ligojcli/plugins/bootstrap.py,sha256=F-1n-vME_A4fePG1uGaGMz9C_G8KRhfKArEFriZVKmk,40374
+ligojcli/plugins/gitlab.py,sha256=V3rbL4WlO6PykYwXlFUarVOPylcgE3Q443_RiwY98cE,12447
+ligojcli/plugins/harbor.py,sha256=tW8DqF7WGZCeaLJHw5YJtHtcqDp2hyqmqrvoE1Ex1_E,7384
+ligojcli/plugins/jenkins.py,sha256=PPz4atF7-Jx4bG-uuuvBYuEvq3fbQauOYFWiNuoHQtc,28164
+ligojcli/plugins/ligoj.py,sha256=9Vj4BAzsTQ-nzTGDundfMMDsZ1ID-DpmR9sb2YWUl64,90090
+ligojcli/plugins/nexus.py,sha256=EwHbDEtrl_hgoshqwXN8LDjfB0xEDdPCGTcRK4fCKUo,11309
+ligojcli/plugins/sonarqube.py,sha256=vRjJV0GI-t-kUEVUIvE2cbBR5qWJRTS2pr_M51qVmH8,14818
+ligojcli/plugins/ssl.py,sha256=JQma6-T4kHk__FMp6Jq0Dd0-Y1zYQoUtzy_M8x44DpY,5193
+ligojcli/plugins/utils.py,sha256=v-n5sR0WODytOJMev3ahV3NP_WgoBkodWzV7p039aak,16690
+ligoj_cli-1.0.0.dist-info/METADATA,sha256=ubEo2zrpf-Aet_-q93Zo8-G6kudvN5qpETKPElv8Kig,84209
+ligoj_cli-1.0.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+ligoj_cli-1.0.0.dist-info/entry_points.txt,sha256=su1lFQ2Dk1a2S-3FhgOIpwnAQek0Q9RYv57TODt1EyM,47
+ligoj_cli-1.0.0.dist-info/top_level.txt,sha256=sufJCWe9-z4wUZlj6vJu5kcwwWv3y3yjd0Ag3LHcUKk,9
+ligoj_cli-1.0.0.dist-info/RECORD,,

ligoj_cli-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

ligoj_cli-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+ligoj = ligojcli.ligoj:ligoj

ligoj_cli-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ligoj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ligoj_cli-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+ligojcli

ligojcli/ligoj.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python
+#
+# Licensed under MIT (https://github.com/ligoj/ligoj/blob/master/LICENSE)
+#
+import json
+import os
+import sys
+
+from ligojcli.plugins import (
+    alfresco,
+    argocd,
+    bootstrap,
+    gitlab,
+    harbor,
+    jenkins,
+    nexus,
+    sonarqube,
+    utils,
+)
+from ligojcli.plugins import ligoj as ligoj_plugin
+
+
+def main():
+    (parser, subparser_service) = utils.init()
+    argocd.configure(subparser_service)
+    alfresco.configure(subparser_service)
+    bootstrap.configure(subparser_service)
+    gitlab.configure(subparser_service)
+    harbor.configure(subparser_service)
+    jenkins.configure(subparser_service)
+    ligoj_plugin.configure(subparser_service)
+    nexus.configure(subparser_service)
+    sonarqube.configure(subparser_service)
+
+    (args, output) = utils.configure(parser)
+
+    if args["version"] is True:
+        service = "info"
+        action = "version"
+        operation = None
+    else:
+        service = args.get("service")
+        action = args.get("action")
+        operation = args.get("operation")
+    if action is None or service is None:
+        parser.print_usage()
+        return
+
+    ligoj_plugin.parse_remote_args(args)
+
+    result = execute_action(service, action, operation, args)
+    if result is False:
+        # Ignore output
+        return
+
+    if isinstance(result, str):
+        result = {"id": result}
+    elif result is not None:
+        try:
+            result = result.json()
+        except BaseException:
+            try:
+                result = {"id": result.text}
+            except BaseException:
+                pass
+
+    if output == "json":
+        try:
+            print(json.dumps(result))
+        except Exception:
+            print("Unable to display result as JSON", result)
+
+    elif output == "text":
+        if isinstance(result, str):
+            print(result)
+        elif result is None or (isinstance(result, dict) and len(result.keys()) == 0):
+            print("")
+        elif isinstance(result, dict) and len(result.keys()) == 1:
+            print(result[list(result.keys())[0]])
+        elif isinstance(result, dict):
+            for key in result.keys():
+                print(result[key])
+        else:
+            print(result)
+
+
+def execute_action(service, action, operation, args):
+    utils.check_endpoint(utils.not_none(ligoj_plugin.ligoj_endpoint, "endpoint"), "ligoj")
+    utils.debug(
+        f"[ligoj] Ligoj CLI '{service}/{action}' profile '{utils.ini_profile}', user '{ligoj_plugin.ligoj_api_user}'{'' if ligoj_plugin.ligoj_api_run_as_user is None else (' as ' + ligoj_plugin.ligoj_api_run_as_user)} on endpoint '{ligoj_plugin.ligoj_endpoint}'"
+    )
+
+    return (
+        ligoj_plugin.execute_action(service, action, operation, args)
+        or alfresco.execute_action(service, action, operation, args)
+        or argocd.execute_action(service, action, operation, args)
+        or jenkins.execute_action(service, action, operation, args)
+        or bootstrap.execute_action(service, action, operation, args)
+        or harbor.execute_action(service, action, operation, args)
+        or nexus.execute_action(service, action, operation, args)
+        or sonarqube.execute_action(service, action, operation, args)
+        or gitlab.execute_action(service, action, operation, args)
+        or False
+    )
+
+
+def ligoj() -> int:
+    """Entry point for the ligoj CLI."""
+    try:
+        main()
+    except ValueError as e:
+        utils.error(str(e))
+        sys.exit(os.EX_SOFTWARE)
+        return os.EX_SOFTWARE
+    except SystemExit as e:
+        raise e
+    except BaseException as e:
+        template = "An exception of type {0} occurred. Arguments:\n{1!r}"
+        error_message = template.format(type(e).__name__, e.args)
+        utils.error(error_message)
+        raise e
+    return 0
+
+
+if __name__ == "__main__":
+    ligoj()

ligojcli/plugins/__init__.py

@@ -0,0 +1,3 @@
+#
+# Licensed under MIT (https://github.com/ligoj/ligoj/blob/master/LICENSE)
+#

ligojcli/plugins/alfresco.py

@@ -0,0 +1,246 @@
+#
+# Licensed under MIT (https://github.com/ligoj/ligoj/blob/master/LICENSE)
+#
+import base64
+
+from unidecode import unidecode
+
+from ligojcli.plugins import ligoj, utils
+
+PLUGIN_NAME = "alfresco"
+alfresco_endpoint: str | None = None
+alfresco_ticket: str | None = None
+alfresco_user: str | None = None
+alfresco_password: str | None = None
+
+
+def configure(subparser_service):
+    # alfresco
+    subparser_action = subparser_service.add_parser("alfresco", help="Alfresco related operations").add_subparsers(title="action", help="Action", dest="action")
+    subparser_service2 = subparser_action.add_parser("site", help="Site operations").add_subparsers(title="action", help="Action", dest="operation")
+    subparser_service2.add_parser("list", help="List sites")
+    parser_action = subparser_service2.add_parser("create", help="Create site")
+    parser_action.add_argument("--id", "-i", help="Site name")
+    parser_action.add_argument("--title", help="Site title")
+    parser_action.add_argument("--visibility", help="Visibility", choices=["PUBLIC", "PRIVATE"])
+    parser_action.add_argument("--description", help="Description")
+    parser_action = subparser_service2.add_parser("get", help="Get site")
+    parser_action.add_argument("--id", help="Site name")
+    parser_action = subparser_service2.add_parser("add-group", help="Add group to site with a role")
+    parser_action.add_argument("--id", help="Site name")
+    parser_action.add_argument("--group", help="Group name")
+    parser_action.add_argument("--role", help="Role name", choices=["SiteCollaborator", "SiteConsumer", "SiteManager"])
+    parser_action = subparser_service2.add_parser("remove-group", help="Remove group from site")
+    parser_action.add_argument("--id", help="Site name")
+    parser_action.add_argument("--group", help="Group name")
+    subparser_service2 = subparser_action.add_parser("group", help="Group operations").add_subparsers(title="action", help="Action", dest="operation")
+    parser_action = subparser_service2.add_parser("create", help="Create group")
+    parser_action.add_argument("--id", "-i", help="Group name")
+    parser_action.add_argument("--display-name", help="Group display name")
+    parser_action.add_argument("--parents", help="Parent group identifiers", nargs="*", default=["admin"])
+    parser_action = subparser_service2.add_parser("delete", help="Delete group")
+    parser_action.add_argument("--id", "-i", help="Group name")
+    parser_action = subparser_service2.add_parser("get", help="Get group")
+    parser_action.add_argument("--id", "-i", help="Group name")
+
+
+def execute_action(service, action, operation, args):
+    if service == "alfresco":
+        parse_remote_args(args)
+
+        if action == "site" and operation == "create":
+            return alfresco_create_site(args.get("id"), args.get("title"), args.get("description"), args.get("visibility"))
+        if action == "site" and operation == "list":
+            return alfresco_list_sites()
+        if action == "site" and operation == "get":
+            return alfresco_get_site(args.get("id"))
+        if action == "site" and operation == "add-group":
+            return alfresco_set_permissions(args.get("group"), [args.get("role")], args.get("id"))
+        if action == "site" and operation == "remove-group":
+            return alfresco_remove_permissions(args.get("group"), args.get("id"))
+        if action == "group" and operation == "create":
+            return alfresco_create_group(args.get("id"), args.get("display_name"), args.get("parents"))
+        if action == "group" and operation == "get":
+            return alfresco_get_group(args.get("id"))
+        if action == "group" and operation == "get":
+            return alfresco_delete_group(args.get("id"))
+    return None
+
+
+# Extract from args the parameters related to remote access API of Alfresco
+def parse_remote_args(args):
+    global alfresco_endpoint
+    global alfresco_ticket
+    global alfresco_user
+    global alfresco_password
+    alfresco_endpoint = utils.get_config(args, "alfresco_endpoint", "ALFRESCO_ENDPOINT", None)
+    alfresco_ticket = utils.get_secret(args, "alfresco_ticket", "ALFRESCO_TICKET", None)
+    alfresco_user = utils.get_secret(args, "alfresco_user", "ALFRESCO_USER", None)
+    alfresco_password = utils.get_secret(args, "alfresco_password", "ALFRESCO_PASSWORD", None)
+
+
+def call_alfresco_api(method, definition, url, **kwargs):
+    global alfresco_ticket
+    if not alfresco_ticket:
+        if not alfresco_user or not alfresco_password:
+            raise ValueError("[alfresco] No ticket and no user/password provided")
+        alfresco_ticket = alfresco_login(alfresco_user, alfresco_password)
+    return utils.call_rest_api(
+        method, "alfresco", f"{alfresco_endpoint}/{definition}/versions/1/", url, None, kwargs | {"headers": {"Authorization": f"Basic {base64.b64encode(alfresco_ticket.encode('ascii')).decode()}"}}
+    )
+
+
+def alfresco_login(user, password):
+    utils.info(f"[alfresco] Login of user '{user}' ...")
+    return utils.call_rest_api("POST", "alfresco", f"{alfresco_endpoint}/authentication/versions/1/", "tickets", None, {"data": {"userId": user, "password": password}}).json()["entry"]["id"]
+
+
+def alfresco_internal_group_name(name):
+    return name if name.startswith("GROUP_") else f"GROUP_{name}"
+
+
+def alfresco_get_group(name):
+    utils.info(f"[alfresco] Get group {name} ...")
+    name = alfresco_internal_group_name(name)
+    response = call_alfresco_api("GET", "alfresco", f"groups/{name}", ignore_error=True)
+    return response and response.json() or None
+
+
+def alfresco_delete_group(name):
+    utils.info(f"[alfresco] Delete group {name} ...")
+    name = alfresco_internal_group_name(name)
+    response = call_alfresco_api("DELETE", "alfresco", f"groups/{name}", ignore_error=True)
+    return response and response.json() or None
+
+
+def alfresco_list_groups():
+    utils.info("[alfresco] List groups ...")
+    return call_alfresco_api("GET", "alfresco", "groups")
+
+
+def alfresco_create_group(name: str, display_name: str, parents=None):
+    utils.info(f"[alfresco] Create group '{name}' ...")
+    if alfresco_get_group(name):
+        utils.debug(f"[alfresco] Group {name} already exists ...")
+    else:
+        call_alfresco_api("POST", "alfresco", "groups", data={"id": name, "displayName": display_name, "parentIds": parents or []})
+
+
+def alfresco_list_sites():
+    utils.info("[alfresco] List sites ...")
+    return call_alfresco_api("GET", "alfresco", "sites")
+
+
+def alfresco_get_site(name):
+    utils.info(f"[alfresco] Get site {name} ...")
+    response = call_alfresco_api("GET", "alfresco", f"sites/{name}", ignore_error=True)
+    return response and response.json()["entry"] or None
+
+
+def alfresco_create_site(name, title, description, visibility="PRIVATE"):
+    if name != unidecode(name):
+        raise ValueError("[alfresco] Site identifier can contain only ASCII chars")
+
+    utils.info(f"[alfresco] Create site '{name}', '{title}' ({visibility}) ...")
+    site_details = alfresco_get_site(name)
+    if not title:
+        title = name
+    if site_details is None:
+        call_alfresco_api("POST", "alfresco", "sites", data={"id": name, "title": title, "description": description, "visibility": visibility})
+        return
+
+    utils.info(f"[alfresco] Site {name} already exists")
+    current_title = site_details.get("title", "")
+    current_description = site_details.get("description", "")
+    current_visibility = site_details["visibility"]
+    if current_title != (title or "") or current_description != (description or "") or current_visibility != visibility:
+        # Update to the new key
+        utils.debug(f"[alfresco] Update site '{name}' title, description or visibility ...")
+        call_alfresco_api("PUT", "alfresco", f"sites/{name}", data={"title": title, "description": description, "visibility": visibility})
+
+
+def alfresco_delete_site(site_id, site_details, remove_from_trash):
+    utils.info(f"[alfresco] Delete site {site_id} ...")
+    if site_details is None:
+        utils.info(f"[alfresco] Site {site_id} does not exist, ignore")
+    else:
+        call_alfresco_api("DELETE", "alfresco", f"sites/{site_id}")
+
+    if remove_from_trash:
+        nodes = call_alfresco_api("GET", "alfresco", "deleted-nodes", data={"maxItems": 100000}).json()["list"]["entries"]
+        node_entry = next(filter(lambda x: x["entry"]["nodeType"] == "st:site" and x["entry"]["name"] == site_id, nodes), None)
+        if node_entry:
+            # Also remote site from trash
+            node_id = node_entry["entry"]["id"]
+            utils.info(f"[alfresco] Delete site {site_id} from trash, node_id={node_id} ...")
+            call_alfresco_api("DELETE", "alfresco", f"deleted-nodes/{node_id}")
+        elif site_details:
+            utils.warn(f"[alfresco] Site {site_id} has been deleted, however it is not found in trash")
+
+
+def alfresco_create_site_roles(groups_by_name: dict[str, str], definition):
+    utils.info("[alfresco] Create Alfresco roles for sites ...")
+
+    for alfresco_site in definition.get("sites", []):
+        alfresco_site_id = alfresco_site.get("id", "")
+        alfresco_site_title = alfresco_site.get("title", "")
+        alfresco_site_description = alfresco_site.get("description", "")
+        alfresco_site_visibility = alfresco_site.get("visibility", "public").upper()
+        if alfresco_site_id == "":
+            raise ValueError("[alfresco] Missing Alfresco site id")
+        if alfresco_site_title == "":
+            alfresco_site_title = alfresco_site_id
+        if alfresco_site_visibility not in ["PUBLIC", "PRIVATE"]:
+            raise ValueError("[alfresco] Invalid Alfresco visibility in site '{alfresco_site_id}'")
+        alfresco_create_site(alfresco_site_id, alfresco_site_title, alfresco_site_description, alfresco_site_visibility)
+        alfresco_create_roles_scope(groups_by_name, alfresco_site, alfresco_site_id)
+
+
+def alfresco_delete_site_roles(groups_by_name: dict[str, str], definition, with_data: bool):
+    utils.info("[alfresco] Delete Alfresco roles for sites ...")
+
+    for alfresco_site in definition.get("sites", []):
+        alfresco_site_id = alfresco_site.get("id", "")
+        if alfresco_site_id == "":
+            raise ValueError("[alfresco] Missing Alfresco site id")
+        site_details = alfresco_get_site(alfresco_site_id)
+
+        if site_details:
+            alfresco_delete_roles_scope(groups_by_name, alfresco_site, alfresco_site_id)
+        if with_data:
+            alfresco_delete_site(alfresco_site_id, site_details, True)
+
+
+def alfresco_create_roles_scope(groups_by_name: dict[str, str], definition, site_id):
+    for alfresco_group in definition.get("roles", {}).keys():
+        ldap_group = ligoj.get_ldap_group("alfresco", groups_by_name, alfresco_group)
+        role_definition = definition["roles"][alfresco_group]
+        permissions = role_definition.get("permissions", [])
+        if len(permissions) == 0:
+            raise ValueError(f"[alfresco] Missing Alfresco permissions in role '{alfresco_group}'")
+        alfresco_create_group(ldap_group, ldap_group)
+        alfresco_set_permissions(ldap_group, permissions, site_id)
+
+
+def alfresco_delete_roles_scope(groups_by_name: dict[str, str], definition, site_id):
+    for alfresco_group in definition.get("roles", {}).keys():
+        ldap_group = ligoj.get_ldap_group("alfresco", groups_by_name, alfresco_group)
+        alfresco_remove_permissions(ldap_group, site_id)
+        alfresco_delete_group(ldap_group)
+
+
+def alfresco_set_permissions(group, permissions, site_id):
+    for permission in permissions:
+        utils.info(f"[alfresco] Set permission '{permission}' to group '{group}' on site '{site_id}' ...")
+        group = alfresco_internal_group_name(group)
+        member = call_alfresco_api("GET", "alfresco", f"sites/{site_id}/group-members/{group}", ignore_400=True)
+        if member:
+            call_alfresco_api("PUT", "alfresco", f"sites/{site_id}/group-members/{group}", data={"role": permission})
+        else:
+            call_alfresco_api("POST", "alfresco", f"sites/{site_id}/group-members", data={"id": group, "role": permission})
+
+
+def alfresco_remove_permissions(group, site_id):
+    utils.info(f"[alfresco] Remove group '{group}' from site '{site_id}' ...")
+    group = alfresco_internal_group_name(group)
+    call_alfresco_api("DELETE", "alfresco", f"sites/{site_id}/group-members/{group}", ignore_409=True)

ligojcli/plugins/argocd.py

@@ -0,0 +1,205 @@
+#
+# Licensed under MIT (https://github.com/ligoj/ligoj/blob/master/LICENSE)
+#
+import json
+
+from unidecode import unidecode
+
+from ligojcli.plugins import ligoj, utils
+
+PLUGIN_NAME = "argocd"
+ARGOCD_ALLOWED_ACTIONS = ["get", "create", "sync", "override", "delete", "*"]
+argocd_endpoint: str | None = None
+argocd_token: str | None = None
+argocd_user: str | None = None
+argocd_password: str | None = None
+
+
+def configure(subparser_service):
+
+    # argocd
+    subparser_action = subparser_service.add_parser("argocd", help="Argo CD related operations").add_subparsers(title="action", help="Action", dest="action")
+    subparser_service2 = subparser_action.add_parser("project", help="Project operations").add_subparsers(title="action", help="Action", dest="operation")
+    subparser_service2.add_parser("list", help="List projects")
+    parser_action = subparser_service2.add_parser("upsert", help="Create or update a project")
+    parser_action.add_argument("--name", "-i", help="Project name")
+    parser_action.add_argument("--description", help="Description")
+    parser_action = subparser_service2.add_parser("get", help="Get project")
+    parser_action.add_argument("--name", help="Project name")
+
+
+def execute_action(service, action, operation, args):
+
+    # argocd
+    if service == "argocd":
+        parse_remote_args(args)
+        if action == "project" and operation == "upsert":
+            return argocd_upsert_project(args.get("name"), args.get("description"))
+        if action == "project" and operation == "list":
+            return argocd_list_projects()
+        if action == "project" and operation == "get":
+            return argocd_get_project(args.get("name"))
+    return None
+
+
+# Extract from args the parameters related to remote access API of ArgoCD
+def parse_remote_args(args):
+    global argocd_endpoint
+    global argocd_token
+    global argocd_user
+    global argocd_password
+    argocd_endpoint = utils.get_config(args, "argocd_endpoint", "ARGOCD_ENDPOINT", None)
+    argocd_token = utils.get_secret(args, "argocd_token", "ARGOCD_TOKEN", None)
+    argocd_user = utils.get_secret(args, "argocd_user", "ARGOCD_API_TOKEN", None)
+    argocd_password = utils.get_secret(args, "argocd_password", "ARGOCD_PASSWORD", None)
+
+
+def argocd_list_projects():
+    utils.info("[argocd] List projects ...")
+    return call_argocd_api("GET", "projects").json()["items"]
+
+
+def argocd_get_project(name):
+    utils.info(f"[argocd] Get project {name} ...")
+    response = call_argocd_api("GET", f"projects/{name}/detailed", ignore_error=True)
+    return response and response.json() or None
+
+
+def argocd_upsert_project(name, description: str | None = None):
+    if name != unidecode(name):
+        raise ValueError("[argocd] Project identifier can contain only ASCII chars")
+
+    utils.info(f"[argocd] Create project '{name}' ...")
+    project_details = argocd_get_project(name)
+    if not description:
+        description = name
+    if project_details is None:
+        call_argocd_api("POST", "projects", data={"project": {"metadata": {"name": name}, "spec": {"description": description}}})
+        return argocd_get_project(name)
+
+    utils.info(f"[argocd] Project '{name}' already exists")
+    spec = project_details["project"].get("spec")
+    if not spec:
+        spec = {}
+        project_details["spec"] = spec
+    current_description = spec.get("description")
+    if current_description != (description or ""):
+        # Update to the new key
+        utils.debug(f"[argocd] Update project '{name}' description ...")
+        spec["description"] = description
+        call_argocd_api("PUT", f"projects/{name}", data=project_details)
+    return project_details
+
+
+def argocd_login(user, password):
+    utils.info(f"[argocd] Login of user '{user}' ...")
+    return utils.call_rest_api("POST", "argocd", f"{argocd_endpoint}/api/v1", "session", None, {"username": user, "password": password}).json()["token"]
+
+
+def call_argocd_api(method, url, **kwargs):
+    global argocd_token
+    if not argocd_token:
+        if not argocd_user or not argocd_password:
+            raise ValueError("[argocd] No token and no user/password provided")
+        argocd_token = argocd_login(argocd_user, argocd_password)
+    return utils.call_rest_api(method, "argocd", f"{argocd_endpoint}/api/v1", url, None, kwargs | {"headers": {"Content-Type": "application/json"}, "cookies": {"argocd.token": argocd_token}})
+
+
+def argocd_create_project_roles(groups_by_name: dict[str, str], definition):
+    utils.info("[argocd] Create ArgoCD roles for projects ...")
+
+    for argocd_project in definition.get("projects", []):
+        argocd_project_id = argocd_project.get("name", "")
+        argocd_project_description = argocd_project.get("description", "")
+        if argocd_project_id == "":
+            raise ValueError("[argocd] Missing ArgoCD project name")
+        if argocd_project_description == "":
+            argocd_project_description = argocd_project_id
+        project_details = argocd_upsert_project(argocd_project_id, argocd_project_description)
+        argocd_create_roles_scope(groups_by_name, argocd_project, argocd_project_id, project_details)
+
+
+def argocd_delete_project_roles(groups_by_name: dict[str, str], definition, with_data):
+    utils.info("[argocd] Delete ArgoCD roles for projects ...")
+
+    for argocd_project in definition.get("projects", []):
+        argocd_project_id = argocd_project.get("name", "")
+        if argocd_project_id == "":
+            raise ValueError("[argocd] Missing ArgoCD project name")
+        project_details = argocd_get_project(argocd_project_id)
+        if project_details:
+            argocd_delete_roles_scope(groups_by_name, argocd_project, argocd_project_id, project_details)
+
+            if with_data:
+                call_argocd_api("DELETE", f"projects/{argocd_project_id}")
+        else:
+            utils.info(f"[argocd] Project {argocd_project_id} does not exist, ignore")
+
+
+def argocd_create_roles_scope(groups_by_name: dict[str, str], definition, project_id, project_details):
+    current_project_json = json.dumps(project_details)
+    for argocd_group in definition.get("roles", {}).keys():
+        ldap_group = ligoj.get_ldap_group("argocd", groups_by_name, argocd_group)
+        role_definition = definition["roles"][argocd_group]
+        permissions = role_definition.get("permissions", [])
+        if len(permissions) == 0:
+            raise ValueError(f"[argocd] Missing ArgoCD permissions in role '{argocd_group}'")
+        argocd_role = argocd_complete_role(ldap_group, project_details)
+        argocd_complete_permissions(ldap_group, permissions, project_id, argocd_role)
+
+    new_project_json = json.dumps(project_details)
+    if new_project_json != current_project_json:
+        # at least one change in this project
+        utils.debug(f"[argocd] Update project '{project_id}' permissions ...")
+        call_argocd_api("PUT", f"projects/{project_id}", data=project_details)
+
+
+def argocd_delete_roles_scope(groups_by_name: dict[str, str], definition, project_id, project_details):
+    current_project_json = json.dumps(project_details)
+    for argocd_group in definition.get("roles", {}).keys():
+        ldap_group = ligoj.get_ldap_group("argocd", groups_by_name, argocd_group)
+        argocd_complete_role_delete(ldap_group, project_details)
+
+    new_project_json = json.dumps(project_details)
+    if new_project_json != current_project_json:
+        # at least one change in this project
+        utils.debug(f"[argocd] Update project '{project_id}', delete permissions ...")
+        call_argocd_api("PUT", f"projects/{project_id}", data=project_details)
+
+
+def argocd_complete_role(group, project_details):
+    roles = project_details["project"]["spec"].get("roles")
+    if not roles:
+        roles = []
+        project_details["project"]["spec"]["roles"] = roles
+
+    role = next(filter(lambda r: r["name"] == group, roles), None)
+    if not role:
+        # Add a new role
+        role = {"name": group}
+        roles.append(role)
+    return role
+
+
+def argocd_complete_role_delete(group, project_details):
+    roles = project_details["project"]["spec"].get("roles", [])
+    project_details["project"]["spec"]["roles"] = list(filter(lambda r: r["name"] != group, roles))
+
+
+def argocd_complete_permissions(group, permissions, project_id, argocd_role):
+    policies = []
+    for permission in permissions:
+        if "action" not in permission:
+            raise ValueError("[argocd] Missing ArgoCD permission action")
+        action = permission["action"]
+        if action not in ARGOCD_ALLOWED_ACTIONS:
+            raise ValueError(f"[argocd] Invalid ArgoCD permission action, allowed: {ARGOCD_ALLOWED_ACTIONS}")
+        action_permission = permission.get("permission", "allow")
+        if action_permission != "allow" and action_permission != "deny":
+            raise ValueError("[argocd] Invalid ArgoCD permission type, allowed: deny/allow")
+        application = permission.get("application", "*")
+        policies.append(f"p, proj:{project_id}:{group}, applications, {action}, {project_id}/{application}, {action_permission}")
+
+    # Replace previous groups and policies
+    argocd_role["groups"] = [group.lower()]
+    argocd_role["policies"] = policies