forked from baron/baron-sso
71 lines
1.9 KiB
Go
71 lines
1.9 KiB
Go
package main
|
|
|
|
import (
|
|
"baron-sso-backend/internal/domain"
|
|
"baron-sso-backend/internal/service"
|
|
"context"
|
|
"flag"
|
|
"fmt"
|
|
"log"
|
|
)
|
|
|
|
func main() {
|
|
dryRun := flag.Bool("dry-run", true, "변경 대상만 출력하고 Kratos identity를 수정하지 않습니다")
|
|
maintenanceWindow := flag.Bool("maintenance-window", false, "승인된 정비 시간에만 실제 변경을 허용합니다")
|
|
markMirrorStale := flag.Bool("mark-mirror-stale", false, "실행 전 Redis identity mirror를 stale로 표시했음을 확인합니다")
|
|
flag.Parse()
|
|
|
|
if !*dryRun && (!*maintenanceWindow || !*markMirrorStale) {
|
|
log.Fatal("refusing to update Kratos identities: pass --dry-run=false --maintenance-window --mark-mirror-stale after marking identity mirror stale")
|
|
}
|
|
|
|
kratosAdmin := service.NewKratosAdminService()
|
|
ctx := context.Background()
|
|
|
|
identities, err := kratosAdmin.ListIdentities(ctx)
|
|
if err != nil {
|
|
log.Fatalf("Failed to list identities: %v", err)
|
|
}
|
|
|
|
count := 0
|
|
for _, id := range identities {
|
|
traits := id.Traits
|
|
changed := false
|
|
|
|
if r, ok := traits["role"].(string); ok {
|
|
norm := domain.NormalizeRole(r)
|
|
if norm != r && norm == domain.RoleUser {
|
|
traits["role"] = norm
|
|
changed = true
|
|
}
|
|
} else if g, ok := traits["grade"].(string); ok {
|
|
if norm, ok := domain.NormalizeRoleAlias(g); ok {
|
|
traits["role"] = norm
|
|
delete(traits, "grade")
|
|
changed = true
|
|
}
|
|
}
|
|
|
|
if changed {
|
|
if *dryRun {
|
|
count++
|
|
fmt.Printf("Would update %s\n", id.ID)
|
|
continue
|
|
}
|
|
_, err := kratosAdmin.UpdateIdentity(ctx, id.ID, traits, id.State)
|
|
if err != nil {
|
|
log.Printf("Failed to update %s: %v", id.ID, err)
|
|
} else {
|
|
count++
|
|
fmt.Printf("Updated %s\n", id.ID)
|
|
}
|
|
}
|
|
}
|
|
if *dryRun {
|
|
fmt.Printf("Total candidates: %d\n", count)
|
|
} else {
|
|
fmt.Printf("Total updated: %d\n", count)
|
|
fmt.Println("Identity mirror was marked stale before maintenance; run full mirror refresh and drift report before trusting cached user lists.")
|
|
}
|
|
}
|