agent-identity-provisioning/provision-agent.py

#!/usr/bin/env python3
"""
provision-agent.py — Playwright automation for AI agent identity provisioning.

Enrolls AI agent identities in Cloudron, logs into Gitea/Discourse/Redmine via
SSO, generates API keys, and stores all credentials in Bitwarden.

Usage:
    python3 provision-agent.py                       # provision all agents in manifest
    python3 provision-agent.py --agent vp-techops    # provision one agent
    python3 provision-agent.py --phase1-only         # Cloudron enrollment only
    python3 provision-agent.py --dry-run             # validate manifest without browser

Manifest: agents.yaml (see agents.yaml.example)

See: ~/Q3/agent-identity-bootstrap.md for the full architecture.
"""

import argparse
import json
import logging
import os
import sys
import time
from pathlib import Path

import yaml
from playwright.sync_api import BrowserContext, Page, sync_playwright

from bw_helper import BitwardenHelper

# ---------------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------------

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    datefmt="%H:%M:%S",
)
log = logging.getLogger("provision")

# ---------------------------------------------------------------------------
# Constants
# ---------------------------------------------------------------------------

CLOUDRON_BASE = os.environ.get("CLOUDRON_BASE", "https://my.knownelement.com")
GITEA_URL = os.environ.get("GITEA_URL", "https://git.knownelement.com")
DISCOURSE_URL = os.environ.get("DISCOURSE_URL", "https://community.turnsys.com")
REDMINE_URL = os.environ.get("REDMINE_URL", "https://projects.knownelement.com")

STATE_DIR = Path("/app/state")


def _debug_dump(page: Page, label: str) -> None:
    """Save screenshot + DOM dump for debugging selector issues."""
    STATE_DIR.mkdir(parents=True, exist_ok=True)
    ts = time.strftime("%H%M%S")
    screenshot_path = STATE_DIR / f"debug-{label}-{ts}.png"
    dom_path = STATE_DIR / f"debug-{label}-{ts}.txt"
    try:
        page.screenshot(path=str(screenshot_path), full_page=True)
    except Exception:
        pass
    try:
        elements = page.evaluate("""() => {
            const results = [];
            document.querySelectorAll('input, button, select, textarea, label, h2, h3, h4, h5, code, .ui.header, .ui.message, [data-tab], .tw-font-semibold').forEach(el => {
                const tag = el.tagName.toLowerCase();
                const text = el.textContent.trim().substring(0, 80);
                const id = el.id || '';
                const name = el.getAttribute('name') || '';
                const type = el.getAttribute('type') || '';
                const value = el.getAttribute('value') || '';
                const cls = (el.className || '').substring(0, 50);
                if (text || id || name || type || value) results.push(`<${tag}> id=${id} name=${name} type=${type} value=${value} class=${cls} text="${text}"`);
            });
            return results.join('\\n');
        }""")
        dom_path.write_text(f"URL: {page.url}\\n\\n{elements}")
        log.info(f"  Debug dump saved: {screenshot_path.name}, {dom_path.name}")
    except Exception as e:
        log.warning(f"  Debug dump failed: {e}")

# ---------------------------------------------------------------------------
# Cloudron enrollment
# ---------------------------------------------------------------------------


def enroll_cloudron(
    page: Page,
    agent: dict,
    bw: BitwardenHelper,
) -> dict:
    """
    Phase 1: Accept Cloudron invite, set password, enable 2FA.

    Returns a dict with the agent's Cloudron credentials.
    """
    name = agent["name"]
    invite_url = agent["cloudron_invite"]
    display_name = agent.get("display_name", name)

    log.info(f"[{name}] Phase 1: Cloudron enrollment — {invite_url}")

    # Check if already provisioned
    item_name = f"{name} Cloudron"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Cloudron credential already exists in Bitwarden — skipping")
        cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
        return {
            "username": cloudron_email,
            "password": bw.get_item_password(item_name),
        }

    # Generate a strong password
    password = bw.generate_password(length=32)
    log.info(f"[{name}] Generated password ({len(password)} chars)")

    # Navigate to invite link
    page.goto(invite_url, wait_until="networkidle")
    page.wait_for_timeout(2000)

    # Fill in the invite acceptance form using real Cloudron selectors
    page.wait_for_selector('#inputPassword', timeout=15000)

    page.fill('#inputPassword', password)
    page.fill('#inputPasswordRepeat', password)

    # Set display name if field exists
    display_field = page.query_selector('#inputDisplayName')
    if display_field:
        display_field.fill(display_name)

    # Submit — Cloudron uses a button with class btn-primary or type submit
    submit = page.query_selector('button[type="submit"], button.btn-primary, button:has-text("Setup"), button:has-text("Create"), button:has-text("Accept")')
    if submit:
        submit.click()
    else:
        page.keyboard.press('Enter')

    page.wait_for_load_state("networkidle")
    log.info(f"[{name}] Invite accepted")

    # Enable 2FA
    totp_secret = enable_cloudron_2fa(page, agent, bw)

    # Store credential in Bitwarden
    cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
    bw.create_item(
        name=item_name,
        username=cloudron_email,
        password=password,
        uris=[CLOUDRON_BASE],
        collection_name=name,
        totp_secret=totp_secret,
    )
    log.info(f"[{name}] Cloudron credential stored in Bitwarden (collection: {name})")

    return {"username": cloudron_email, "password": password, "totp_secret": totp_secret}


def enable_cloudron_2fa(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """
    Enable TOTP 2FA on a Cloudron account via the profile page.

    Cloudron's 2FA enrollment flow (discovered via DOM dump):
    1. Navigate to #/profile
    2. Click "Setup" to start 2FA enrollment
    3. Cloudron defaults to Passkey -- click "switchToTotp" to switch
    4. TOTP secret appears in page text (base32 encoded)
    5. Enter TOTP code in #totpTokenInput, click Enable

    Returns the TOTP secret (empty string if already enabled or failed).
    """
    name = agent["name"]
    log.info(f"[{name}] Enabling 2FA on Cloudron account")

    page.evaluate('() => window.location.hash = "#/profile"')
    page.wait_for_timeout(3000)

    # If profile didn't load, try clicking the profile nav link
    if "#/profile" not in page.url:
        for nav_text in ["Profile", "Settings", "Account"]:
            sec_link = page.locator(f'a[href*="#/profile"], a:has-text("{nav_text}")')
            if sec_link.count() > 0:
                sec_link.first.click()
                page.wait_for_timeout(3000)
                break

    _debug_dump(page, f"cloudron-profile-{name}")

    # Check if 2FA is already enabled
    page_text = page.evaluate("() => document.body.innerText")
    if "totp" in page_text.lower() and "enabled" in page_text.lower():
        log.info(f"[{name}] 2FA already enabled on Cloudron")
        return ""

    # Step 1: Click "Setup" to start 2FA enrollment
    setup_clicked = False
    for selector in [
        'text=Setup',
        '[role="button"]:has-text("Setup")',
        'button:has-text("Setup")',
        'a:has-text("Setup")',
    ]:
        loc = page.locator(selector)
        if loc.count() > 0 and loc.first.is_visible():
            loc.first.click()
            page.wait_for_timeout(3000)
            setup_clicked = True
            break

    if not setup_clicked:
        log.warning(f"[{name}] Could not find 2FA Setup button")
        _debug_dump(page, f"cloudron-2fa-no-setup-{name}")
        return ""

    # Step 2: Switch from Passkey to TOTP mode
    page_text = page.evaluate("() => document.body.innerText")
    if "switchToTotp" in page_text or "Passkey" in page_text:
        for selector in [
            'text=switchToTotp',
            'text=profile.enable2FA.switchToTotp',
            'a:has-text("TOTP")',
            '[role="button"]:has-text("TOTP")',
        ]:
            loc = page.locator(selector)
            if loc.count() > 0 and loc.first.is_visible():
                loc.first.click()
                page.wait_for_timeout(3000)
                break

    _debug_dump(page, f"cloudron-2fa-totp-mode-{name}")

    # Step 3: Extract TOTP secret (base32 string in page text)
    import re
    page_text = page.evaluate("() => document.body.innerText")
    totp_secret = ""

    # Look in code/pre elements first
    for el in page.query_selector_all("code, pre"):
        text = el.text_content().strip().replace(" ", "")
        if text and re.match(r'^[A-Z2-7=]+$', text):
            totp_secret = text
            break

    # Fall back to regex in page text
    if not totp_secret:
        matches = re.findall(r'[A-Z2-7]{16,}=?', page_text.replace(" ", ""))
        if matches:
            totp_secret = matches[0]

    if not totp_secret:
        log.error(f"[{name}] Could not extract TOTP secret")
        _debug_dump(page, f"cloudron-2fa-no-secret-{name}")
        return ""

    log.info(f"[{name}] Extracted TOTP secret: {totp_secret[:4]}...")

    # Step 4: Enter TOTP confirmation code
    import pyotp
    totp_code = pyotp.TOTP(totp_secret).now()

    token_input = page.query_selector("#totpTokenInput")
    if not token_input:
        for sel in ['input[name="totpToken"]', 'input[type="text"]:visible']:
            loc = page.locator(sel)
            if loc.count() > 0 and loc.first.is_visible():
                token_input = loc.first.element_handle()
                break

    if token_input:
        token_input.click()
        page.keyboard.type(totp_code)
        page.wait_for_timeout(500)

        # Click Enable/Confirm button
        for btn_text in ["Enable", "Confirm", "Verify", "OK", "Save"]:
            loc = page.locator(f'[role="button"]:has-text("{btn_text}"), button:has-text("{btn_text}")')
            if loc.count() > 0 and loc.first.is_visible():
                loc.first.click()
                break
        page.wait_for_timeout(3000)
        log.info(f"[{name}] 2FA confirmation submitted")
    else:
        log.warning(f"[{name}] Could not find TOTP confirmation input")
        _debug_dump(page, f"cloudron-2fa-no-input-{name}")

    return totp_secret


def decode_qr_from_base64(data_uri: str) -> str:
    """Decode a TOTP secret from a base64 QR code data URI."""
    import base64
    import io

    from PIL import Image
    from pyzbar.pyzbar import decode

    # Extract base64 data from data URI
    header, b64data = data_uri.split(",", 1)
    img_bytes = base64.b64decode(b64data)
    img = Image.open(io.BytesIO(img_bytes))

    decoded = decode(img)
    if decoded:
        # TOTP URIs look like: otpauth://totp/Label?secret=XXXX&...
        uri = decoded[0].data.decode()
        if "secret=" in uri:
            return uri.split("secret=")[1].split("&")[0]

    raise RuntimeError("Could not decode TOTP secret from QR code")


# ---------------------------------------------------------------------------
# System access (Phase 2)
# ---------------------------------------------------------------------------


def cloudron_panel_login(page: Page, agent: dict, bw: BitwardenHelper) -> bool:
    """
    Login to the Cloudron panel to establish an SSO session.

    Once authenticated to the Cloudron panel, subsequent SSO flows to
    Cloudron-managed apps (Gitea, Redmine, Discourse, etc.) auto-approve
    without requiring a separate consent click.

    Returns True if login succeeded or session already active.
    """
    name = agent["name"]
    cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
    cloudron_item = f"{name} Cloudron"
    password = bw.get_item_password(cloudron_item)

    log.info(f"[{name}] Establishing Cloudron panel session")

    page.goto(f"{CLOUDRON_BASE}/login.html", wait_until="networkidle", timeout=15000)
    page.wait_for_timeout(2000)

    # Already logged in? (must be on the panel, not redirected to OIDC)
    if "login" not in page.url.lower() and "openid" not in page.url.lower():
        log.info(f"[{name}] Cloudron panel session already active")
        return True

    # If redirected to OIDC login page, fill that too
    # (Cloudron login.html and OIDC login look similar, both use #inputUsername/#inputPassword)

    # Fill Cloudron login form (Pankow/Vue needs keyboard events, not fill())
    page.wait_for_selector("#inputPassword", timeout=15000)
    page.click("#inputUsername")
    page.keyboard.type(cloudron_email)
    page.click("#inputPassword")
    page.keyboard.type(password)

    # Submit: Cloudron Pankow UI uses <div role="button"> instead of <button>.
    submitted = False
    for text in ["Log in", "Sign in", "Submit", "Continue"]:
        btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
        if btn.count() > 0 and btn.first.is_visible():
            btn.first.click()
            submitted = True
            break
    if not submitted:
        page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
        submitted = True
    page.wait_for_timeout(5000)

    # Handle TOTP if prompted (Cloudron OIDC uses #inputTotpToken, not #inputTotp)
    totp_input = page.query_selector("#inputTotpToken")
    if totp_input and totp_input.is_visible():
        totp_code = bw.get_totp(cloudron_item)
        totp_input.click()
        page.keyboard.type(totp_code)
        # Cloudron TOTP submit button has specific ID
        submit = page.locator('#totpTokenSubmitButton')
        if submit.count() == 0:
            for text in ["Log in", "Sign in", "Submit", "Continue"]:
                submit = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                if submit.count() > 0 and submit.first.is_visible():
                    break
        if submit.count() > 0:
            submit.first.click()
        else:
            page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
        page.wait_for_timeout(5000)

    # After submit, check if we're past the login form.
    # The OIDC flow stays on /openid/interaction/... but changes from
    # login form to consent page. Check for absence of password field.
    page.wait_for_timeout(3000)
    has_password = page.query_selector('#inputPassword')
    if not has_password or not has_password.is_visible():
        log.info(f"[{name}] Cloudron panel login successful")
        return True

    # Handle consent/authorize page if present
    for consent_text in ["Continue", "Authorize", "Allow", "Accept"]:
        consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}")')
        if consent_btn.count() > 0 and consent_btn.first.is_visible():
            consent_btn.first.click()
            page.wait_for_timeout(5000)
            break

    has_password = page.query_selector('#inputPassword')
    if not has_password or not has_password.is_visible():
        log.info(f"[{name}] Cloudron panel login successful")
        return True

    log.error(f"[{name}] Cloudron panel login failed (still on login page: {page.url})")
    return False


def sso_login(page: Page, system_url: str, agent: dict, bw: BitwardenHelper,
              sso_button_selector: str = "") -> bool:
    """
    Log into a Cloudron-managed app via SSO.

    Requires an active Cloudron panel session (call cloudron_panel_login first).
    Clicks the SSO/OAuth button on the app's login page, which redirects
    through Cloudron's OIDC provider and back to the app authenticated.

    Args:
        sso_button_selector: CSS selector for the SSO button. If empty,
            tries common patterns (oauth2 link, "cloudron" text, etc.).

    Returns True if login succeeded.
    """
    name = agent["name"]
    log.info(f"[{name}] SSO login: {system_url}")

    page.goto(system_url, wait_until="networkidle")
    page.wait_for_timeout(2000)

    # Already authenticated?
    if not page.query_selector('input[type="password"]'):
        log.info(f"[{name}] Already authenticated at {system_url}")
        return True

    # Click the SSO/OAuth button
    sso_clicked = False

    if sso_button_selector:
        btn = page.locator(sso_button_selector)
        if btn.count() > 0:
            btn.first.click()
            sso_clicked = True

    if not sso_clicked:
        for selector in [
            'a[href*="oauth2/cloudron"]',
            'a[href*="oauth"]',
            'button[id*="login-oauth"]',
            'a:has-text("cloudron")',
            'a:has-text("Cloud")',
            'button:has-text("cloudron")',
            'button:has-text("Cloud")',
        ]:
            btn = page.locator(selector)
            if btn.count() > 0 and btn.first.is_visible():
                btn.first.click()
                sso_clicked = True
                break

    if not sso_clicked:
        log.error(f"[{name}] Could not find SSO button at {system_url}")
        _debug_dump(page, f"sso-no-button-{name}")
        return False

    page.wait_for_timeout(5000)
    log.info(f"[{name}] SSO redirect: {page.url}")

    # Handle Cloudron OIDC login page if redirected.
    # The OIDC page may show: (a) a login form, (b) a consent page,
    # or (c) nothing visible (auto-redirect). Handle all three.
    if "openid" in page.url or "interaction" in page.url:
        page.wait_for_timeout(2000)

        has_login_form = page.query_selector("#inputPassword")
        if has_login_form and has_login_form.is_visible():
            log.info(f"[{name}] Handling Cloudron OIDC login")
            cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
            cloudron_item = f"{name} Cloudron"
            password = bw.get_item_password(cloudron_item)

            page.click("#inputUsername")
            page.keyboard.type(cloudron_email)
            page.click("#inputPassword")
            page.keyboard.type(password)

            for text in ["Log in", "Sign in", "Submit", "Continue"]:
                btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                if btn.count() > 0 and btn.first.is_visible():
                    btn.first.click()
                    break
            else:
                page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
            page.wait_for_timeout(5000)

            # Handle TOTP if prompted
            totp_input = page.query_selector("#inputTotp")
            if totp_input and totp_input.is_visible():
                totp_code = bw.get_totp(cloudron_item)
                totp_input.fill(totp_code)
                for text in ["Log in", "Sign in", "Submit", "Continue"]:
                    btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                    if btn.count() > 0 and btn.first.is_visible():
                        btn.first.click()
                        break
                page.wait_for_timeout(5000)
        else:
            log.info(f"[{name}] OIDC session active — looking for consent")

        # Try to find and click any consent/authorize button.
        # The OIDC page may require explicit consent even when authenticated.
        page.wait_for_timeout(2000)
        for consent_text in ["Continue", "Authorize", "Allow", "Accept", "Approve"]:
            consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}"), input[value="{consent_text}"]')
            if consent_btn.count() > 0:
                log.info(f"[{name}] Clicking OIDC consent: {consent_text}")
                consent_btn.first.click(force=True)
                page.wait_for_timeout(5000)
                break
        else:
            # No consent button found — try submitting any form on the page
            # (OIDC auto-approve may need a form POST)
            page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
            page.wait_for_timeout(5000)

    page.wait_for_timeout(3000)
    log.info(f"[{name}] SSO result: {page.url}")

    # Verify we're back on the target app (not stuck on OIDC/login)
    if "openid" in page.url or "interaction" in page.url:
        log.error(f"[{name}] SSO login failed (stuck on OIDC page)")
        _debug_dump(page, f"sso-stuck-{name}")
        return False

    if "login" in page.url.lower():
        log.error(f"[{name}] SSO login failed (still on login page)")
        _debug_dump(page, f"sso-failed-{name}")
        return False

    log.info(f"[{name}] SSO login successful")
    return True


def provision_gitea(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """Generate a Gitea API token via SSO login. Returns the token."""
    name = agent["name"]
    systems = agent.get("systems", {})
    gitea_cfg = systems.get("gitea", {})

    if not gitea_cfg:
        log.info(f"[{name}] No Gitea config — skipping")
        return ""

    item_name = f"{name} Gitea"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Gitea token already exists — skipping")
        return bw.get_item_password(item_name)

    url = gitea_cfg.get("url", GITEA_URL)
    token_name = gitea_cfg.get("token_name", f"{name}-api")

    sso_login(page, f"{url}/user/login", agent, bw,
              sso_button_selector='a[href*="oauth2/cloudron"]')

    # Navigate to API token settings
    page.goto(f"{url}/user/settings/applications", wait_until="domcontentloaded")
    page.wait_for_timeout(3000)
    _debug_dump(page, f"gitea-settings-{name}")

    # Generate new token — the input may not be visible to Playwright
    # (behind flash message or in collapsed section). Use JS to fill.
    page.evaluate(f"""() => {{
        const input = document.querySelector('#name');
        if (input) {{
            input.value = '{token_name}';
            input.dispatchEvent(new Event('input', {{bubbles: true}}));
            input.dispatchEvent(new Event('change', {{bubbles: true}}));
        }}
    }}""")

    # Select scopes via JS (radio buttons may also be non-visible)
    scope_map = {
        "repository": "write:repository",
        "user": "write:user",
        "organization": "write:organization",
        "issue": "write:issue",
        "package": "write:package",
        "notification": "read:notification",
        "misc": "read:misc",
    }
    page.evaluate("""(scopes) => {
        for (const [cat, val] of Object.entries(scopes)) {
            const radio = document.querySelector('input[value="' + val + '"]');
            if (radio) { radio.checked = true; radio.dispatchEvent(new Event('change', {bubbles: true})); }
        }
    }""", scope_map)

    # Click Generate Token via JS
    page.evaluate("""() => {
        const btns = document.querySelectorAll('button');
        for (const b of btns) {
            if (b.textContent.trim() === 'Generate Token') { b.click(); return; }
        }
    }""")
    page.wait_for_timeout(3000)

    # Extract the generated token.
    # Gitea shows it in a flash-info message div as plain text (the token
    # string itself, not wrapped in <code>).
    token_el = page.query_selector('.ui.info.message.flash-info, .ui.info.message')
    if not token_el:
        token_el = page.query_selector('.ui.message code, input[readonly]')

    token = ""
    if token_el:
        token = token_el.text_content().strip()
        # The flash message may contain extra text; extract just the token
        # (Gitea tokens are 40-char hex strings)
        import re
        match = re.search(r'[a-f0-9]{40}', token)
        if match:
            token = match.group(0)
    if not token:
        log.error(f"[{name}] Could not extract Gitea API token")
        _debug_dump(page, f"gitea-no-token-{name}")
        return ""

    log.info(f"[{name}] Gitea token generated: {token[:8]}...")

    # Store in Bitwarden
    bw.create_item(
        name=item_name,
        username=name,
        password=token,
        uris=[url],
        collection_name=name,
        custom_fields={"token_name": token_name},
    )
    log.info(f"[{name}] Gitea token stored in Bitwarden")

    return token


def provision_discourse(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """
    Generate a Discourse API key via SSO login.

    Note: Discourse API keys typically require admin to create.
    If the agent can't self-generate, this logs a warning.
    Returns the API key (empty string if not possible).
    """
    name = agent["name"]
    systems = agent.get("systems", {})
    discourse_cfg = systems.get("discourse", {})

    if not discourse_cfg:
        log.info(f"[{name}] No Discourse config — skipping")
        return ""

    item_name = f"{name} Discourse"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Discourse key already exists — skipping")
        return bw.get_item_password(item_name)

    url = discourse_cfg.get("url", DISCOURSE_URL)

    # Discourse uses a login modal — can't use sso_login (it reloads the page).
    # Handle the full flow inline.
    page.goto(f"{url}/", wait_until="domcontentloaded", timeout=15000)
    page.wait_for_timeout(3000)

    # Already authenticated?
    if not page.query_selector('input[type="password"]'):
        # Check if we're on the homepage without login form
        login_btn = page.locator('button:has-text("Log In")')
        if login_btn.count() == 0 or not login_btn.first.is_visible():
            log.info(f"[{name}] Already authenticated at Discourse")
        else:
            # Open login modal and look for SSO
            login_btn.first.click()
            page.wait_for_timeout(3000)
            log.info(f"[{name}] Opened Discourse login modal")

            # Dump modal content for debugging
            _debug_dump(page, f"discourse-modal-{name}")

            # Look for SSO/social login buttons in the modal
            sso_clicked = False
            for selector in [
                'button.btn-social',
                'a[href*="auth/cloudron"]',
                'button:has-text("Cloud")',
                'button:has-text("KNEL")',
                'a:has-text("Cloud")',
                '[data-login-name*="cloud"]',
                'button.social-buttons-button',
            ]:
                btn = page.locator(selector)
                if btn.count() > 0 and btn.first.is_visible():
                    btn.first.click()
                    sso_clicked = True
                    log.info(f"[{name}] Clicked Discourse SSO button: {selector}")
                    break

            if not sso_clicked:
                log.warning(f"[{name}] No SSO button found in Discourse modal")
                _debug_dump(page, f"discourse-no-sso-{name}")

            page.wait_for_timeout(5000)

            # Handle OIDC redirect if needed
            if "openid" in page.url or "interaction" in page.url:
                page.wait_for_timeout(2000)
                has_login = page.query_selector("#inputPassword")
                if has_login and has_login.is_visible():
                    # Need to login on OIDC
                    cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
                    cloudron_item = f"{name} Cloudron"
                    password = bw.get_item_password(cloudron_item)
                    page.click("#inputUsername")
                    page.keyboard.type(cloudron_email)
                    page.click("#inputPassword")
                    page.keyboard.type(password)
                    for text in ["Log in", "Sign in", "Continue"]:
                        btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                        if btn.count() > 0 and btn.first.is_visible():
                            btn.first.click()
                            break
                    page.wait_for_timeout(5000)

                # Consent
                for consent_text in ["Continue", "Authorize", "Allow"]:
                    consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}")')
                    if consent_btn.count() > 0:
                        consent_btn.first.click(force=True)
                        page.wait_for_timeout(5000)
                        break

            page.wait_for_timeout(3000)
            log.info(f"[{name}] Discourse URL after SSO: {page.url}")

    # Try to generate an API key from user preferences
    # Note: In Discourse, only admin can create API keys via UI
    # Non-admin users may not have this option
    page.goto(f"{url}/u/{name}/preferences/account", wait_until="networkidle")

    api_key_section = page.query_selector('.api-keys, [data-section="api-keys"]')

    if not api_key_section:
        log.warning(
            f"[{name}] Discourse API key self-generation not available. "
            "An admin must create the key. The agent will need a manually-created key."
        )
        return ""

    # If the section exists, try to create a key
    revoke_btn = page.query_selector('.api-keys button:has-text("Revoke")')
    if not revoke_btn:
        # No existing keys — create one
        gen_btn = page.query_selector('button:has-text("New API Key"), button:has-text("Create")')
        if gen_btn:
            gen_btn.click()
            page.wait_for_timeout(2000)

            # Read the key
            key_el = page.query_selector('.api-key-value, code')
            api_key = key_el.text_content().strip() if key_el else ""

            if api_key:
                bw.create_item(
                    name=item_name,
                    username=name,
                    password=api_key,
                    uris=[url],
                    collection_name=name,
                )
                log.info(f"[{name}] Discourse API key stored in Bitwarden")
                return api_key

    log.warning(f"[{name}] Could not generate Discourse API key")
    return ""


def provision_redmine(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """Get the Redmine API access key via SSO login. Returns the key."""
    name = agent["name"]
    systems = agent.get("systems", {})
    redmine_cfg = systems.get("redmine", {})

    if not redmine_cfg:
        log.info(f"[{name}] No Redmine config — skipping")
        return ""

    item_name = f"{name} Redmine"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Redmine key already exists — skipping")
        return bw.get_item_password(item_name)

    url = redmine_cfg.get("url", REDMINE_URL)

    sso_login(page, f"{url}/login", agent, bw,
              sso_button_selector='button[id*="login-oauth"]')

    # Navigate to account page where API key lives
    page.goto(f"{url}/my/account", wait_until="networkidle")
    page.wait_for_timeout(2000)
    _debug_dump(page, f"redmine-account-{name}")

    # The API key is in the right sidebar under "API access key"
    show_link = page.query_selector('a:has-text("Show"), #api_access_key + a, a[href*="access_key"]')
    if show_link:
        show_link.click()
        page.wait_for_timeout(1000)

    key_el = page.query_selector('#api_access_key, .api-key code, .api-access-key')
    api_key = key_el.text_content().strip() if key_el else ""

    if not api_key:
        reset_link = page.query_selector('a:has-text("Reset"), a:has-text("Generate")')
        if reset_link:
            reset_link.click()
            page.wait_for_timeout(2000)
            page.click('button:has-text("OK"), button:has-text("Confirm")')
            page.wait_for_timeout(1000)
            key_el = page.query_selector('#api_access_key, .api-key code')
            api_key = key_el.text_content().strip() if key_el else ""

    if not api_key:
        log.error(f"[{name}] Could not get Redmine API key")
        _debug_dump(page, f"redmine-no-key-{name}")
        return ""

    log.info(f"[{name}] Redmine API key obtained: {api_key[:8]}...")

    # Store in Bitwarden
    bw.create_item(
        name=item_name,
        username=name,
        password=api_key,
        uris=[url],
        collection_name=name,
    )
    log.info(f"[{name}] Redmine API key stored in Bitwarden")

    return api_key


# ---------------------------------------------------------------------------
# Verification
# ---------------------------------------------------------------------------


def verify_gitea(token: str, agent: dict) -> bool:
    """Verify the Gitea API token works."""
    import urllib.request

    url = agent.get("systems", {}).get("gitea", {}).get("url", GITEA_URL)
    req = urllib.request.Request(f"{url}/api/v1/user", headers={"Authorization": f"token {token}"})
    try:
        resp = urllib.request.urlopen(req, timeout=10)
        data = json.loads(resp.read())
        log.info(f"  Gitea verify: user={data.get('login', '?')}")
        return resp.status == 200
    except Exception as e:
        log.error(f"  Gitea verify FAILED: {e}")
        return False


def verify_redmine(key: str, agent: dict) -> bool:
    """Verify the Redmine API key works."""
    import urllib.request

    url = agent.get("systems", {}).get("redmine", {}).get("url", REDMINE_URL)
    req = urllib.request.Request(f"{url}/users/current.json", headers={"X-Redmine-API-Key": key})
    try:
        resp = urllib.request.urlopen(req, timeout=10)
        data = json.loads(resp.read())
        log.info(f"  Redmine verify: user={data.get('user', {}).get('login', '?')}")
        return resp.status == 200
    except Exception as e:
        log.error(f"  Redmine verify FAILED: {e}")
        return False


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------


def load_manifest(path: str) -> list[dict]:
    """Load and validate the agent manifest."""
    with open(path) as f:
        data = yaml.safe_load(f)

    agents = data.get("agents", [])
    if not agents:
        log.error("No agents found in manifest")
        sys.exit(1)

    for agent in agents:
        if "cloudron_invite" not in agent or "REPLACE" in agent["cloudron_invite"]:
            log.warning(f"Agent {agent.get('name', '?')} has no valid Cloudron invite")

    return agents


def provision_agent(
    context: BrowserContext,
    agent: dict,
    bw: BitwardenHelper,
    phase1_only: bool = False,
) -> dict:
    """Provision a single agent identity."""
    name = agent["name"]
    results = {"name": name, "cloudron": False, "gitea": False, "discourse": False, "redmine": False}

    page = context.new_page()

    try:
        # Phase 1: Cloudron enrollment
        enroll_cloudron(page, agent, bw)
        results["cloudron"] = True
        log.info(f"[{name}] Phase 1 complete: Cloudron identity enrolled")

        if phase1_only:
            log.info(f"[{name}] Phase 1 only — skipping system access")
            return results

        systems = agent.get("systems", {})
        if not systems:
            log.info(f"[{name}] No systems configured — Phase 1 only")
            return results

        # Establish Cloudron panel session for SSO (shared across all apps)
        sso_page = context.new_page()
        cloudron_panel_login(sso_page, agent, bw)
        sso_page.close()

        # Phase 2: System access (fresh page for each system)
        for system_name in ["gitea", "discourse", "redmine"]:
            system_page = context.new_page()
            try:
                if system_name == "gitea":
                    token = provision_gitea(system_page, agent, bw)
                    results["gitea"] = bool(token) and verify_gitea(token, agent)
                elif system_name == "discourse":
                    key = provision_discourse(system_page, agent, bw)
                    results["discourse"] = bool(key)
                elif system_name == "redmine":
                    key = provision_redmine(system_page, agent, bw)
                    results["redmine"] = bool(key) and verify_redmine(key, agent)
            except Exception as e:
                log.error(f"[{name}] {system_name} provisioning failed: {e}")
            finally:
                system_page.close()

        log.info(f"[{name}] All phases complete: {results}")

    except Exception as e:
        log.error(f"[{name}] Provisioning failed: {e}")
        results["error"] = str(e)
    finally:
        page.close()

    # Save state (in finally so partial results survive failures)
    state_file = STATE_DIR / f"{name}.json"
    try:
        with open(state_file, "w") as f:
            json.dump(results, f, indent=2)
    except OSError:
        log.warning(f"[{name}] Could not write state file: {state_file}")

    return results


def main():
    parser = argparse.ArgumentParser(description="Provision AI agent identities")
    parser.add_argument("--manifest", default="agents.yaml", help="Path to manifest file")
    parser.add_argument("--agent", help="Provision only this agent")
    parser.add_argument("--phase1-only", action="store_true", help="Cloudron enrollment only")
    parser.add_argument("--enable-2fa", action="store_true", help="Enable 2FA on existing Cloudron accounts")
    parser.add_argument("--dry-run", action="store_true", help="Validate manifest without browser")
    parser.add_argument("--headed", action="store_true", help="Show browser (debugging)")
    args = parser.parse_args()

    # Ensure state directory exists (deferred from module level so --dry-run works)
    STATE_DIR.mkdir(parents=True, exist_ok=True)

    # Load manifest
    agents = load_manifest(args.manifest)
    if args.agent:
        agents = [a for a in agents if a["name"] == args.agent]
        if not agents:
            log.error(f"Agent '{args.agent}' not found in manifest")
            sys.exit(1)

    log.info(f"Manifest: {len(agents)} agent(s) to provision")
    for a in agents:
        log.info(f"  - {a['name']} ({a.get('display_name', '?')}) [{a.get('priority', '?')}]")

    if args.dry_run:
        log.info("Dry run — manifest validated successfully")
        return

    # Initialize Bitwarden
    bw = BitwardenHelper(
        client_id=os.environ["BW_CLIENTID"],
        client_secret=os.environ["BW_CLIENTSECRET"],
        password=os.environ["BW_PASSWORD"],
        totp_secret=os.environ.get("BW_TOTP_SECRET", ""),
        server_url=os.environ.get("BW_SERVER", ""),
    )
    log.info("Connecting to Bitwarden...")
    bw.login()
    log.info("Bitwarden session established")

    # Launch Playwright
    headless = not args.headed
    if os.environ.get("HEADFUL", "false").lower() == "true":
        headless = False

    all_results = []

    with sync_playwright() as pw:
        browser = pw.chromium.launch(headless=headless)

        for agent in agents:
            # Fresh context per agent (no cookie/session bleed)
            context = browser.new_context(
                accept_downloads=False,
                java_script_enabled=True,
            )
            log.info(f"=== Provisioning: {agent['name']} ===")
            try:
                if args.enable_2fa:
                    page = context.new_page()
                    cloudron_panel_login(page, agent, bw)
                    totp_secret = enable_cloudron_2fa(page, agent, bw)
                    if totp_secret:
                        item_name = f"{agent['name']} Cloudron"
                        bw.update_item(item_name, totp_secret=totp_secret)
                        log.info(f"[{agent['name']}] Updated BW item with TOTP secret (in place)")
                    page.close()
                    all_results.append({"name": agent["name"], "2fa": bool(totp_secret)})
                else:
                    result = provision_agent(context, agent, bw, args.phase1_only)
                    all_results.append(result)
            except Exception as e:
                log.error(f"FAILED: {agent['name']}: {e}")
                all_results.append({"name": agent["name"], "error": str(e)})
            finally:
                context.close()

        browser.close()

    # Summary
    log.info("\n=== PROVISIONING SUMMARY ===")
    for r in all_results:
        status = "OK" if "error" not in r else "FAILED"
        systems = []
        for s in ["cloudron", "gitea", "discourse", "redmine"]:
            if r.get(s):
                systems.append(s)
        log.info(f"  {r['name']}: {status} — {', '.join(systems) if systems else '(none)'}")

    # Exit non-zero if any failed
    if any("error" in r for r in all_results):
        sys.exit(1)


if __name__ == "__main__":
    main()