#!/usr/bin/env bash
set -euo pipefail
umask 077
cd "$(dirname "${BASH_SOURCE[0]}")"
[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo 'Wrong Kubernetes context' >&2; exit 1; }

workdir=$(mktemp -d)
display_name='brunner.ninja Auth'
chmod 700 "$workdir"
trap 'rm -rf "$workdir"' EXIT

if kubectl -n paperless-ngx get secret paperless-oidc -o jsonpath='{.data.providers}' 2>/dev/null | base64 -d > "$workdir/providers.json" && [[ -s "$workdir/providers.json" ]]; then
  echo 'Keeping the existing Paperless OIDC client secret.'
else
  openssl rand -hex 32 | tr -d '\n' > "$workdir/client-secret"
  jq -n --arg name "$display_name" --rawfile secret "$workdir/client-secret" '{openid_connect:{OAUTH_PKCE_ENABLED:true,APPS:[{provider_id:"authentik",name:$name,client_id:"paperless-ngx",secret:$secret,settings:{server_url:"https://auth.brunner.ninja/application/o/paperless-ngx/.well-known/openid-configuration",fetch_userinfo:true}}],SCOPE:["openid","profile","email"]}}' > "$workdir/providers.json"
  kubectl -n paperless-ngx create secret generic paperless-oidc --from-file="providers=$workdir/providers.json"
fi

if ! jq -e --arg name "$display_name" '.openid_connect.APPS[] | select(.provider_id == "authentik" and .name == $name)' "$workdir/providers.json" >/dev/null; then
  jq --arg name "$display_name" '(.openid_connect.APPS[] | select(.provider_id == "authentik") | .name) = $name' "$workdir/providers.json" > "$workdir/providers-updated.json"
  kubectl -n paperless-ngx create secret generic paperless-oidc --from-file="providers=$workdir/providers-updated.json" --dry-run=client -o yaml | kubectl apply -f -
  cp "$workdir/providers-updated.json" "$workdir/providers.json"
fi

jq -er '.openid_connect.APPS[] | select(.provider_id == "authentik") | .secret' "$workdir/providers.json" | tr -d '\n' > "$workdir/client-secret"
{
  printf 'CLIENT_SECRET = '
  jq -Rs . < "$workdir/client-secret"
  cat authentik-setup.py
} > "$workdir/setup.py"
chmod 600 "$workdir"/*
kubectl -n authentik exec -i deployment/authentik-worker -- ak shell --no-imports --interface python < "$workdir/setup.py"