-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(chart): add user email verification (#35)
Signed-off-by: Sven Trieflinger <[email protected]> Signed-off-by: Sebastian Becker <[email protected]> Co-authored-by: Sebastian Becker <[email protected]>
- Loading branch information
Showing
4 changed files
with
213 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| #!/bin/bash | ||
|
|
||
| # | ||
| # Copyright (c) 2024 - for information on the respective copyright owner | ||
| # see the NOTICE file and/or the repository https://github.com/carbynestack/thymus. | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| # This script creates a user in Kratos and verifies the user's email address. | ||
| # | ||
| # The script expects the following environment variables to be set: | ||
| # - MAILSLURPER_ADDRESS: The address of the MailSlurper instance. | ||
| # - KRATOS_ADMIN_SERVICE_ADDRESS: The address of the Kratos admin service instance. | ||
| # - KRATOS_PUBLIC_SERVICE_ADDRESS: The address of the Kratos public service instance. | ||
| # - RETRY_PERIOD: The time to wait between retries when polling for the verification code. Default is 1 second. | ||
| # - RETRIES: The number of times to retry getting the verification code. Default is 10. | ||
|
|
||
| RETRY_PERIOD=${RETRY_PERIOD:-1} | ||
| RETRIES=${RETRIES:-10} | ||
|
|
||
| if [ -z "${MAILSLURPER_ADDRESS}" ]; then | ||
| echo "Error: MAILSLURPER_ADDRESS environment variable is not set." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${KRATOS_ADMIN_SERVICE_ADDRESS}" ]; then | ||
| echo "Error: KRATOS_ADMIN_SERVICE_ADDRESS environment variable is not set." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${KRATOS_PUBLIC_SERVICE_ADDRESS}" ]; then | ||
| echo "Error: KRATOS_PUBLIC_SERVICE_ADDRESS environment variable is not set." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Checks if the last command failed and exits the script if it did. | ||
| exitOnError() { | ||
| STATUS_CODE=$? | ||
| if [ $STATUS_CODE -ne 0 ]; then | ||
| echo "$1 Exit Code: $STATUS_CODE" | ||
| exit 1 | ||
| fi | ||
| } | ||
|
|
||
| # Gets the verification code from the email sent by Kratos. | ||
| getVerificationCode() { | ||
| email=$1 | ||
| for i in $(seq 1 "${RETRIES}"); do | ||
| code=$(curl -X GET -sf -H 'Content-Type: application/JSON' \ | ||
| "http://${MAILSLURPER_ADDRESS}/mail?to=${email}\&order=desc" | \ | ||
| jq -r '.mailItems[0].body | capture("code: (?<code>\\w+)").code') | ||
| exitOnError "Failed to get verification code for user: $email." | ||
| if [[ -n "$code" ]]; then | ||
| echo "$code" | ||
| return | ||
| fi | ||
| sleep "$((i*RETRY_PERIOD))" | ||
| done | ||
| echo "Failed to get verification code for user: $email." | ||
| exit 1 | ||
| } | ||
|
|
||
| # Extracts the email from the user credentials file. | ||
| email=$(jq -r '.traits.email' < /user-credentials/data.json) | ||
|
|
||
| echo "Creating user: ${email}" | ||
| curl -X POST -vf -H 'Content-Type: application/json' -d @/user-credentials/data.json "http://${KRATOS_ADMIN_SERVICE_ADDRESS}/admin/identities" | ||
| exitOnError "Failed to create user: ${email}." | ||
|
|
||
| echo "Verifying user: ${email}" | ||
| flowID=$(curl -X GET -sf -H 'Content-Type: application/JSON' \ | ||
| "http://${KRATOS_PUBLIC_SERVICE_ADDRESS}/self-service/verification/api" | \ | ||
| jq -r '.id') | ||
| exitOnError "Failed to create verification flow for user: ${email}." | ||
|
|
||
| curl -X POST -sf -H 'Content-Type: application/JSON' \ | ||
| "http://${KRATOS_PUBLIC_SERVICE_ADDRESS}/self-service/verification?flow=${flowID}" \ | ||
| --data "{\"method\": \"code\", \"email\": \"${email}\"}" | ||
| exitOnError "Failed to initiate verification flow for user: ${email}." | ||
|
|
||
| code=$(getVerificationCode "${email}") | ||
| curl -X POST -sf -H 'Content-Type: application/JSON' \ | ||
| "http://${KRATOS_PUBLIC_SERVICE_ADDRESS}/self-service/verification?flow=${flowID}" \ | ||
| --data "{\"method\": \"code\", \"code\": \"$code\"}" | ||
| exitOnError "Failed finalize verification for user: ${email}." | ||
|
|
||
| echo "User ${email} successfully created" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| # | ||
| # Copyright (c) 2024 - for information on the respective copyright owner | ||
| # see the NOTICE file and/or the repository https://github.com/carbynestack/thymus. | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| # Deployment for mailslurper | ||
| {{- if .Values.thymus.users.enabled }} | ||
| --- | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: {{ include "thymus.fullname" . }}-mailslurper | ||
| namespace: {{ .Release.Namespace }} | ||
| labels: | ||
| app.kubernetes.io/name: {{ include "thymus.name" . }}-mailslurper | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| app.kubernetes.io/version: {{ .Chart.AppVersion }} | ||
| app.kubernetes.io/managed-by: {{ .Release.Service }} | ||
| spec: | ||
| replicas: {{ .Values.thymus.policyCatalogue.replicaCount }} | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: {{ include "thymus.name" . }}-mailslurper | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/name: {{ include "thymus.name" . }}-mailslurper | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| spec: | ||
| {{- if .Values.mailslurper.image.pullSecrets }} | ||
| imagePullSecrets: | ||
| {{- range .Values.mailslurper.image.pullSecrets }} | ||
| - name: {{ . }} | ||
| {{- end}} | ||
| {{- end}} | ||
| containers: | ||
| - name: "{{ .Chart.Name }}-mailslurper" | ||
| image: "{{ .Values.mailslurper.image.registry }}/{{ .Values.mailslurper.image.repository }}:{{ .Values.mailslurper.image.tag }}" | ||
| imagePullPolicy: {{ .Values.mailslurper.image.pullPolicy }} | ||
| ports: | ||
| - name: ui | ||
| containerPort: 4436 | ||
| protocol: TCP | ||
| - name: api | ||
| containerPort: 4437 | ||
| protocol: TCP | ||
| - name: smtp | ||
| containerPort: 1025 | ||
| protocol: TCP | ||
| --- | ||
| # Service for exposing mailslurper | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: {{ include "thymus.fullname" . }}-mailslurper | ||
| namespace: {{ .Release.Namespace }} | ||
| {{- if .Values.mailslurper.service.annotations }} | ||
| annotations: | ||
| {{ .Values.mailslurper.service.annotations | toYaml | trim | indent 4 }} | ||
| {{- end}} | ||
| spec: | ||
| selector: | ||
| app.kubernetes.io/name: {{ include "thymus.name" . }}-mailslurper | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| ports: | ||
| - name: ui | ||
| protocol: TCP | ||
| port: {{ .Values.mailslurper.service.uiPort }} | ||
| targetPort: ui | ||
| - name: api | ||
| protocol: TCP | ||
| port: {{ .Values.mailslurper.service.apiPort }} | ||
| targetPort: api | ||
| - name: smtp | ||
| protocol: TCP | ||
| port: {{ .Values.mailslurper.service.smtpPort }} | ||
| targetPort: smtp | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters