hackclub / nest

Free, powerful, and versatile compute infrastructure for all high school hackers!
https://hackclub.app
MIT License
45 stars 7 forks source link

Allow the creation of Authentik OAuth apps via the Nest CLI #57

Open DaInfLoop opened 4 weeks ago

DaInfLoop commented 4 weeks ago

Currently, the only way to authenticate a Nest user is via https://oauth.hackclub.app/, which has been down for a while.

A suggestion was made in #nest-meta to allow users to create and manage OAuth applications via the Nest CLI by using the Authentik API.

Firepup6500 commented 4 weeks ago

https://git.hackclub.app/ seems to go through https://identity.hackclub.app

DaInfLoop commented 4 weeks ago

https://git.hackclub.app/ is hosted by the Nest Admins, so they can create the OAuth app themselves.

polypixeldev commented 4 weeks ago

After discussion with @hello-smile6, we've decided that it's better not to create a CLI tool to automatically interface with Authentik to create OAuth apps, as it could easily be abused as well as make it difficult for admins to manage Authentik.

Unless a better suggestion is made, what will most likely happen is that oauth.hackclub.app will be fixed and improved so that there is a good way to create OAuth apps on Nest that is isolated from Nest's internal apps and configuration.

DaInfLoop commented 3 weeks ago

I think the main reason that took the suggestion to add it to the Nest CLI was the fact that it didn't want to have admin intervention, but now that I think of it, oauth.hackclub.app requires an admin (which I'm pretty sure is just @aboutdavid) to review your app before you're allowed to actually use OAuth.

In that case, why not do the same thing for Authentik OAuth apps? If removing the form to create the apps was an idea, that has the same risks as using the CLI to create the apps.

polypixeldev commented 3 weeks ago

I hadn't thought fully through the implication of an automated system that didn't require admin intervention before, I think it makes sense to have a system that requires communication with the admins and approval to avoid confusion & misuse