From e81b848a026d86253a38e9176db8d24388f0ae74 Mon Sep 17 00:00:00 2001
From: Sebastian Krupinski <krupinski01@gmail.com>
Date: Wed, 22 Jul 2026 23:44:35 -0400
Subject: [PATCH] feat: console authentication control

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>
---
 .../Tenant/TenantAuthEnableCommand.php        | 98 +++++++++++++++++++
 core/lib/Module/Module.php                    |  1 +
 2 files changed, 99 insertions(+)
 create mode 100644 core/lib/Console/Tenant/TenantAuthEnableCommand.php

diff --git a/core/lib/Console/Tenant/TenantAuthEnableCommand.php b/core/lib/Console/Tenant/TenantAuthEnableCommand.php
new file mode 100644
index 0000000..c63e11e
--- /dev/null
+++ b/core/lib/Console/Tenant/TenantAuthEnableCommand.php
@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Console\Tenant;
+
+use KTXC\Resource\ProviderManager;
+use KTXC\Service\TenantService;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * Tenant Auth Enable Command
+ *
+ * Enables an authentication provider for a tenant's login flow.
+ */
+#[AsCommand(
+    name: 'tenant:auth:enable',
+    description: 'Enable an authentication provider for a tenant',
+)]
+class TenantAuthEnableCommand extends Command
+{
+    public function __construct(
+        private readonly TenantService $tenantService,
+        private readonly ProviderManager $providerManager,
+        private readonly LoggerInterface $logger
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
+            ->addArgument('provider', InputArgument::REQUIRED, 'Authentication provider id (e.g. password, oidc, totp)')
+            ->addOption('label', 'l', InputOption::VALUE_REQUIRED, 'Display label shown for this method during login')
+            ->setHelp('This command enables an authentication provider for a tenant. The provider\'s module must already be installed and enabled.')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+        $tenantIdentifier = $input->getArgument('tenant');
+        $providerId = $input->getArgument('provider');
+
+        $io->title('Enable Tenant Authentication Provider');
+
+        try {
+            $tenant = $this->tenantService->fetchById($tenantIdentifier);
+
+            if (!$tenant) {
+                $io->error("Tenant '{$tenantIdentifier}' not found.");
+                return Command::FAILURE;
+            }
+
+            if (!$this->providerManager->resolve('authentication', $providerId)) {
+                $io->error("Authentication provider '{$providerId}' is not registered. Is its module installed and enabled?");
+                return Command::FAILURE;
+            }
+
+            $authentication = $tenant->getConfiguration()->authentication();
+            $providers = $authentication->providers();
+            $providers[$providerId] = array_filter([
+                'enabled' => true,
+                'label' => $input->getOption('label'),
+            ], fn($value) => $value !== null);
+            $authentication->jsonDeserialize(['providers' => $providers]);
+
+            $this->tenantService->deposit($tenant);
+
+            $this->logger->info('Tenant authentication provider enabled via console', [
+                'tenant' => $tenantIdentifier,
+                'provider' => $providerId,
+                'command' => $this->getName(),
+            ]);
+
+            $io->success("Authentication provider '{$providerId}' enabled for tenant '{$tenantIdentifier}'.");
+
+            return Command::SUCCESS;
+
+        } catch (\Throwable $e) {
+            $io->error('Failed to enable authentication provider: ' . $e->getMessage());
+            $this->logger->error('Tenant auth provider enable failed', [
+                'tenant' => $tenantIdentifier,
+                'provider' => $providerId,
+                'error' => $e->getMessage(),
+            ]);
+            return Command::FAILURE;
+        }
+    }
+}
diff --git a/core/lib/Module/Module.php b/core/lib/Module/Module.php
index 2ec73e5..668d650 100644
--- a/core/lib/Module/Module.php
+++ b/core/lib/Module/Module.php
@@ -108,6 +108,7 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
             \KTXC\Console\Tenant\TenantCreateCommand::class,
             \KTXC\Console\Tenant\TenantListCommand::class,
             \KTXC\Console\Tenant\TenantDeleteCommand::class,
+            \KTXC\Console\Tenant\TenantAuthEnableCommand::class,
             \KTXC\Console\User\UserCreateCommand::class,
             \KTXC\Console\User\UserListCommand::class,
             \KTXC\Console\User\UserDeleteCommand::class,