from authentik.outposts.models import Outpost
from authentik.core.models import Token

# (outpost name, desired token key) for every outpost we pin a known
# token on: the LDAP outpost plus any proxy outpost that declares a
# `token` (co-located proxy outposts authenticate with it against the
# authentik server).
_targets = [
{% if authentik_ldap_outpost.name is defined %}
    ('{{ authentik_ldap_outpost.name }}', '{{ authentik_ldap_outpost.token }}'),
{% endif %}
{% for o in authentik_proxy_outposts | default([]) if o.token is defined %}
    ('{{ o.name }}', '{{ o.token }}'),
{% endfor %}
]

changed = False
for name, key in _targets:
    o = Outpost.objects.get(name=name)
    t = Token.objects.get(identifier=o.token_identifier)
    if t.key != key:
        t.key = key
        t.save(update_fields=['key'])
        changed = True

print('changed' if changed else 'ok')