Allow the creation of Authentik OAuth apps via the Nest CLI

[DaInfLoop]

Currently, the only way to authenticate a Nest user is via https://oauth.hackclub.app/, which has been down for a while.

A suggestion was made in #nest-meta to allow users to create and manage OAuth applications via the Nest CLI by using the Authentik API.

[Firepup6500]

https://git.hackclub.app/ seems to go through https://identity.hackclub.app

[DaInfLoop]

https://git.hackclub.app/ is hosted by the Nest Admins, so they can create the OAuth app themselves.

[polypixeldev]

After discussion with @hello-smile6, we've decided that it's better not to create a CLI tool to automatically interface with Authentik to create OAuth apps, as it could easily be abused as well as make it difficult for admins to manage Authentik.

Unless a better suggestion is made, what will most likely happen is that oauth.hackclub.app will be fixed and improved so that there is a good way to create OAuth apps on Nest that is isolated from Nest's internal apps and configuration.

[DaInfLoop]

I think the main reason that took the suggestion to add it to the Nest CLI was the fact that it didn't want to have admin intervention, but now that I think of it, oauth.hackclub.app requires an admin (which I'm pretty sure is just @aboutdavid) to review your app before you're allowed to actually use OAuth.

In that case, why not do the same thing for Authentik OAuth apps? If removing the form to create the apps was an idea, that has the same risks as using the CLI to create the apps.

[polypixeldev]

I hadn't thought fully through the implication of an automated system that didn't require admin intervention before, I think it makes sense to have a system that requires communication with the admins and approval to avoid confusion & misuse

[hello-smile6]

Could we maybe do manual configuration of authentik on a per-case basis with a slack workflow that creates a private slack channel with a user + nest admins for discussing oauth app setup?

[polypixeldev]

Could we use Authentik's access control to allow users to configure settings like the client secret and redirect URIs in Authentik themselves?

[dispherical]

I might take this up