#!/bin/sh
set -eu

project_dir=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
version=$(awk '
  $1 == "chart:" && $2 == "authentik" { chart = 1; next }
  chart && $1 == "targetRevision:" { print $2; exit }
' "$project_dir/bootstrap/authentik.yaml")

if [ -z "$version" ]; then
  echo "Could not determine the Authentik chart version." >&2
  exit 1
fi

shell_log=$(mktemp)
trap 'rm -f "$shell_log"' EXIT HUP INT TERM
if ! pins=$(kubectl --namespace authentik exec deployment/authentik-worker -- \
  ak shell --command \
  'from authentik.outposts.models import Outpost; [print(f"{o.name}={o.config.container_image}") for o in Outpost.objects.filter(name__in=["ldap", "radius", "rac"]).order_by("name")]' \
  2>"$shell_log"); then
  cat "$shell_log" >&2
  exit 1
fi
pin_lines=$(printf '%s\n' "$pins" | grep -E '^(ldap|rac|radius)=' || true)
printf '%s\n' "$pin_lines"
if [ "$(printf '%s\n' "$pin_lines" | wc -l)" -ne 3 ] || \
   printf '%s\n' "$pin_lines" | grep -Ev '^(ldap|rac|radius)=None$' >/dev/null; then
  echo "A managed outpost still has an explicit database image override." >&2
  exit 1
fi

for name in ldap radius rac; do
  expected="ghcr.io/goauthentik/$name:$version"
  actual=$(kubectl --namespace authentik get "deployment/ak-outpost-$name" \
    --output='jsonpath={.spec.template.spec.containers[0].image}')
  replicas=$(kubectl --namespace authentik get "deployment/ak-outpost-$name" \
    --output='jsonpath={.status.updatedReplicas}/{.status.readyReplicas}/{.status.availableReplicas}')
  if [ "$actual" != "$expected" ] || [ "$replicas" != "1/1/1" ]; then
    echo "ak-outpost-$name: expected $expected at 1/1/1, found $actual at $replicas" >&2
    exit 1
  fi
  echo "ak-outpost-$name: $actual, $replicas"
done