feat: add futo discord (#1517)

Author: zackpollard

.github/workflows/terragrunt.yml

@@ -23,6 +23,10 @@ env:
   TG_NON_INTERACTIVE: 'true'
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   check:
     runs-on: ubuntu-latest

tf/deployment/.env

@@ -10,6 +10,7 @@ export TF_VAR_op_connect_url="op://tf/1pass_connect/url"
 export TF_VAR_op_connect_token="op://tf/1pass_connect/token"
 export TF_VAR_futo_op_service_account_token="op://tf_$ENVIRONMENT/yucca_futo_1pass_superuser_service_account/password"
 export TF_VAR_discord_token="op://tf/IMMICH_TF_DISCORD_BOT_TOKEN/password"
+export TF_VAR_futo_discord_token="op://tf/FUTO_TF_DISCORD_BOT_TOKEN/password"
 export TF_VAR_zitadel_profile_json="op://tf/ZITADEL_PROFILE_JSON/password"
 export TF_VAR_zitadel_github_client_id="op://tf/GITHUB_OAUTH_APP_IMMICH_ZITADEL_CLIENT_ID/password"
 export TF_VAR_zitadel_github_client_secret="op://tf/GITHUB_OAUTH_APP_IMMICH_ZITADEL_CLIENT_SECRET/password"
@@ -27,4 +28,5 @@ export DOCKER_PASSWORD="op://tf/dockerhub/password"
 export TF_VAR_grafana_token="op://tf_$ENVIRONMENT/MONITORING_GRAFANA_TF_AUTH_TOKEN/password"
 export TF_VAR_grafana_url="op://tf_$ENVIRONMENT/MONITORING_GRAFANA_URL/password"
 export TF_VAR_discord_server_id="op://tf_$ENVIRONMENT/IMMICH_DISCORD_SERVER_ID/password"
+export TF_VAR_futo_discord_server_id="op://tf_$ENVIRONMENT/FUTO_DISCORD_SERVER_ID/password"
 export TF_VAR_env=$ENVIRONMENT

tf/deployment/data/users.json

@@ -9,8 +9,10 @@
       "id": 285511635735543828
     },
     "roles": [
-      "admin",
-      "immich"
+      "immich_admin",
+      "futo_admin",
+      "immich",
+      "futo"
     ]
   },
   {
@@ -23,10 +25,10 @@
       "id": 613523742479483183
     },
     "roles": [
-      "admin",
-      "immich"
-    ],
-    "dev": true
+      "immich_admin",
+      "immich",
+      "futo"
+    ]
   },
   {
     "github": {
@@ -38,11 +40,11 @@
       "id": 324007594262003722
     },
     "roles": [
-      "admin",
+      "immich_admin",
       "yucca",
-      "immich"
-    ],
-    "dev": true
+      "immich",
+      "futo"
+    ]
   },
   {
     "github": {
@@ -54,11 +56,12 @@
       "id": 185097470215192579
     },
     "roles": [
-      "admin",
+      "immich_admin",
+      "futo_admin",
       "yucca",
-      "immich"
-    ],
-    "dev": true
+      "immich",
+      "futo"
+    ]
   },
   {
     "github": {
@@ -71,7 +74,8 @@
     },
     "roles": [
       "team",
-      "yucca"
+      "yucca",
+      "futo"
     ]
   },
   {
@@ -85,7 +89,8 @@
     },
     "roles": [
       "team",
-      "yucca"
+      "yucca",
+      "futo"
     ]
   },
   {
@@ -99,7 +104,8 @@
     },
     "roles": [
       "team",
-      "yucca"
+      "yucca",
+      "futo"
     ]
   },
   {
@@ -113,9 +119,9 @@
     },
     "roles": [
       "team",
-      "immich"
-    ],
-    "dev": true
+      "immich",
+      "futo"
+    ]
   },
   {
     "github": {
@@ -128,7 +134,8 @@
     },
     "roles": [
       "team",
-      "immich"
+      "immich",
+      "futo"
     ]
   },
   {
@@ -142,9 +149,9 @@
     },
     "roles": [
       "team",
-      "immich"
-    ],
-    "dev": true
+      "immich",
+      "futo"
+    ]
   },
   {
     "github": {
@@ -157,7 +164,8 @@
     },
     "roles": [
       "team",
-      "immich"
+      "immich",
+      "futo"
     ]
   },
   {
@@ -171,7 +179,8 @@
     },
     "roles": [
       "team",
-      "immich"
+      "immich",
+      "futo"
     ]
   },
   {
@@ -185,7 +194,8 @@
     },
     "roles": [
       "team",
-      "yucca"
+      "yucca",
+      "futo"
     ]
   },
   {
@@ -212,7 +222,8 @@
       "id": 1402320140938510398
     },
     "roles": [
-      "futo"
+      "futo",
+      "futo_admin"
     ]
   },
   {
@@ -228,6 +239,36 @@
       "futo"
     ]
   },
+  {
+    "github": null,
+    "discord": {
+      "username": "thekinocorner",
+      "id": 407763616528334848
+    },
+    "roles": [
+      "futo"
+    ]
+  },
+  {
+    "github": null,
+    "discord": {
+      "username": "orhan_08299",
+      "id": 1450543861108838491
+    },
+    "roles": [
+      "futo"
+    ]
+  },
+  {
+    "github": null,
+    "discord": {
+      "username": "somewhatjustin",
+      "id": 396114422906486784
+    },
+    "roles": [
+      "futo"
+    ]
+  },
   {
     "github": {
       "username": "adamantike",

tf/deployment/modules/scoped/discord/community/.terraform.lock.hcl

@@ -11,5 +11,9 @@ terraform {
       source  = "1Password/onepassword"
       version = "~> 2.1"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "~> 2.3"
+    }
   }
 }

tf/deployment/modules/scoped/discord/community/config.tf

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="$(cat)"
+token="$(jq -r '.token' <<<"$input")"
+server_id="$(jq -r '.server_id' <<<"$input")"
+user_ids_csv="$(jq -r '.user_ids' <<<"$input")"
+
+members=()
+
+if [[ -n "$user_ids_csv" ]]; then
+  IFS=',' read -ra user_ids <<<"$user_ids_csv"
+  for uid in "${user_ids[@]}"; do
+    [[ -z "$uid" ]] && continue
+
+    while :; do
+      headers_file="$(mktemp)"
+      status="$(curl -sS -o /dev/null -D "$headers_file" -w '%{http_code}' \
+        -H "Authorization: Bot $token" \
+        "https://discord.com/api/v10/guilds/$server_id/members/$uid" || echo '000')"
+
+      case "$status" in
+        200)
+          members+=("$uid")
+          rm -f "$headers_file"
+          break
+          ;;
+        404)
+          rm -f "$headers_file"
+          break
+          ;;
+        429)
+          reset="$(awk 'BEGIN{IGNORECASE=1} /^X-RateLimit-Reset-After:/ {print $2}' "$headers_file" | tr -d '\r')"
+          rm -f "$headers_file"
+          sleep "${reset:-5}"
+          ;;
+        *)
+          echo "uid=$uid returned status=$status" >&2
+          rm -f "$headers_file"
+          break
+          ;;
+      esac
+    done
+  done
+fi
+
+if [[ ${#members[@]} -eq 0 ]]; then
+  member_ids_json='[]'
+else
+  member_ids_json="$(printf '%s\n' "${members[@]}" | jq -R . | jq -sc .)"
+fi
+jq -nc --arg member_ids "$member_ids_json" '{member_ids: $member_ids}'

tf/deployment/modules/scoped/discord/community/scripts/check-members.sh

@@ -1,20 +1,37 @@
 locals {
   users = jsondecode(file(var.users_data_file_path))
+
+  candidate_users = {
+    for user in local.users : user.discord.id => user
+    if try(user.discord.username, "") != ""
+  }
+}
+
+data "external" "members" {
+  program = ["${path.module}/scripts/check-members.sh"]
+  query = {
+    token     = var.discord_token
+    server_id = discord_server.server.id
+    user_ids  = join(",", [for user in local.candidate_users : user.discord.id])
+  }
 }
 
 resource "discord_member_roles" "roles" {
-  for_each = { for user in local.users : user.discord.id => user if(var.env == "prod" || lookup(user, "dev", false)) && try(user.discord.username, "") != "" }
+  for_each = {
+    for id, user in local.candidate_users : id => user
+    if contains(jsondecode(data.external.members.result.member_ids), id)
+  }
 
   server_id = discord_server.server.id
   user_id   = each.value.discord.id
   role {
     role_id  = discord_role.admin.id
-    has_role = contains(each.value.roles, "admin")
+    has_role = contains(each.value.roles, "immich_admin")
   }
 
   role {
     role_id  = discord_role.team.id
-    has_role = length(setintersection(toset(each.value.roles), toset(["yucca", "team", "admin"]))) > 0
+    has_role = length(setintersection(toset(each.value.roles), toset(["yucca", "team", "immich_admin"]))) > 0
   }
 
   role {
@@ -24,12 +41,12 @@ resource "discord_member_roles" "roles" {
 
   role {
     role_id  = discord_role.contributor.id
-    has_role = length(setintersection(toset(each.value.roles), toset(["contributor", "futo", "yucca", "team", "admin"]))) > 0
+    has_role = length(setintersection(toset(each.value.roles), toset(["contributor", "futo", "yucca", "team", "immich_admin"]))) > 0
   }
 
   role {
     role_id  = discord_role.futo.id
-    has_role = length(setintersection(toset(each.value.roles), toset(["futo", "yucca", "team", "admin"]))) > 0
+    has_role = length(setintersection(toset(each.value.roles), toset(["futo", "yucca", "team", "immich_admin"]))) > 0
   }
 
   role {