Two bugs found running this against the live Authentik instance for
the first time:
- jget's <<<"$1" here-string always overrode stdin, so `api ... | jget
- "expr"` never actually read curl's piped output - it fed the
literal string "-" to json.load() instead, and the abandoned pipe
made curl fail with "Failed writing body". Fixed by branching on
$1 == "-" to read the real stdin in that case.
- The prompt stage lives at /stages/prompt/stages/, not /stages/prompt/
(that path is prompt *fields*). Wrong path 404'd.
Also switched `python` -> `python3` throughout for portability.
Verified idempotent end-to-end against auth.jerodrigged.com: provider,
application, lisilou-admin group, and the full enrollment flow
(prompt -> write -> login stages, bound and set as the brand's
enrollment flow) all created successfully, second run reports
everything as already existing.
Creates the OAuth2 provider, application, lisilou-admin group, and the
client enrollment flow via the Authentik API, then prints ready-to-paste
api/.env lines. Run with AUTHENTIK_URL + AUTHENTIK_TOKEN once CT121 is up.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jhodgkin