List groups

//native

/**

 * List groups

 * List configuration group names, one page at a time (max 100 per page). Returns { total, data } plus next_offset (null on the last page).

 */

export async function main(

  auth: RT.ArubaCentralOnprem,

  limit: number | undefined,

  offset: number | undefined

) {

  const token = await getAccessToken(auth, "read")

  const base = auth.base_url.replace(/\/+$/, "")

  const pageSize = limit || 20

  const start = offset || 0

  const url = new URL(`${base}/configuration/v2/groups`)

  url.searchParams.append("limit", String(pageSize))

  url.searchParams.append("offset", String(start))

  const response = await fetch(url, {

    headers: {

      Authorization: `Bearer ${token}`,

      Accept: "application/json",

    },

  })

  if (!response.ok) {

    throw new Error(`${response.status} ${await response.text()}`)

  }

  const page = (await response.json()) as { total: number; data: string[] }

  const next = start + page.data.length

  return {

    ...page,

    next_offset: page.data.length > 0 && next < page.total ? next : null,

  }

}

// OAuth grant mechanism documented for Central On-Premises (API Gateway > OAuth grant):

// login -> authorization code -> access token. Tokens last 2 hours, so a fresh one is minted per run.

async function getAccessToken(

  auth: RT.ArubaCentralOnprem,

  scope: "read" | "all"

): Promise<string> {

  const base = auth.base_url.replace(/\/+$/, "")

  const loginUrl = new URL(`${base}/oauth2/authorize/central/api/login`)

  loginUrl.searchParams.append("client_id", auth.client_id)

  const login = await fetch(loginUrl, {

    method: "POST",

    headers: { "Content-Type": "application/json", Accept: "application/json" },

    body: JSON.stringify({ username: auth.username, password: auth.password }),

  })

  if (!login.ok) {

    throw new Error(`login: ${login.status} ${await login.text()}`)

  }

  const cookies = login.headers.get("set-cookie") ?? ""

  const csrf = cookies.match(/csrftoken=([^;,\s]+)/)?.[1]

  const session = cookies.match(/session=([^;,\s]+)/)?.[1]

  if (!csrf || !session) {

    throw new Error(

      "login: response did not set the csrftoken and session cookies"

    )

  }

  const authorizeUrl = new URL(`${base}/oauth2/authorize/central/api`)

  authorizeUrl.searchParams.append("client_id", auth.client_id)

  authorizeUrl.searchParams.append("response_type", "code")

  authorizeUrl.searchParams.append("scope", scope)

  const authorize = await fetch(authorizeUrl, {

    method: "POST",

    headers: {

      "Content-Type": "application/json",

      Accept: "application/json",

      Cookie: `session=${session}`,

      "X-CSRF-Token": csrf,

    },

    body: JSON.stringify({ customer_id: auth.customer_id }),

  })

  if (!authorize.ok) {

    throw new Error(`authorize: ${authorize.status} ${await authorize.text()}`)

  }

  const { auth_code } = (await authorize.json()) as { auth_code: string }

  const tokenUrl = new URL(`${base}/oauth2/token`)

  tokenUrl.searchParams.append("client_id", auth.client_id)

  tokenUrl.searchParams.append("client_secret", auth.client_secret)

  tokenUrl.searchParams.append("grant_type", "authorization_code")

  tokenUrl.searchParams.append("code", auth_code)

  const token = await fetch(tokenUrl, {

    method: "POST",

    headers: { Accept: "application/json" },

  })

  if (!token.ok) {

    throw new Error(`token: ${token.status} ${await token.text()}`)

  }

  const { access_token } = (await token.json()) as { access_token: string }

  return access_token

}