Rotate gitlab tokens instead of creating new ones

central/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "central"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 license = "Apache-2.0"
 
@@ -19,6 +19,6 @@ anyhow = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 urlencoding = "2.1.3"
-chrono = "0.4"
 icinga-client = { git = "https://github.com/samply/icinga-client.git", tag = "v0.1.0", version = "0.1.0" }
 toml = "0.8.20"
+time = { version = "0.3.41", features = ["serde", "parsing", "macros", "formatting"] }

central/src/auth/authentik/mod.rs

@@ -109,11 +109,11 @@ pub async fn validate_application(
 
 pub async fn create_app_provider(
     name: &str,
-    oidc_client_config: OIDCConfig,
+    oidc_client_config: &OIDCConfig,
     conf: &AuthentikConfig,
 ) -> anyhow::Result<SecretResult> {
     let token = get_access_token(conf).await?;
-    combine_app_provider(&token, name, &oidc_client_config, conf).await
+    combine_app_provider(&token, name, oidc_client_config, conf).await
 }
 
 pub async fn combine_app_provider(

central/src/auth/keycloak/mod.rs

@@ -33,7 +33,7 @@ pub struct KeyCloakConfig {
 
 pub async fn create_client(
     name: &str,
-    oidc_client_config: OIDCConfig,
+    oidc_client_config: &OIDCConfig,
     conf: &KeyCloakConfig,
 ) -> anyhow::Result<SecretResult> {
     let token = get_access_token(conf).await?;

central/src/config.rs

@@ -2,7 +2,7 @@ use std::{convert::Infallible, path::PathBuf};
 
 use beam_lib::{reqwest::Url, AppId};
 use clap::Parser;
-use shared::{OIDCConfig, SecretResult};
+use shared::{OIDCConfig, RequestType, SecretResult};
 
 use crate::auth::{
     authentik::{self, AuthentikConfig},
@@ -47,10 +47,28 @@ impl OIDCProvider {
         }
     }
 
+    pub async fn handle_secret_request(
+        &self,
+        request_type: RequestType,
+        oidc_client_config: &OIDCConfig,
+        from: &AppId,
+    ) -> Result<SecretResult, String> {
+        let name = from.as_ref().split('.').nth(1).unwrap();
+        match request_type {
+            RequestType::ValidateOrCreate(current) if self.validate_client(
+                name,
+                &current,
+                oidc_client_config,
+            ).await? => 
+                Ok(SecretResult::AlreadyValid),
+            _ => self.create_client(name, oidc_client_config).await,
+        }
+    }
+
     pub async fn create_client(
         &self,
         name: &str,
-        oidc_client_config: OIDCConfig,
+        oidc_client_config: &OIDCConfig,
     ) -> Result<SecretResult, String> {
         match self {
             OIDCProvider::Keycloak(conf) => {