#!/bin/bash
set -euo pipefail

# setup-ceph-saml.sh
# Configures Ceph Dashboard SAML2 SSO with Authentik
# This script should be run after both Ceph and Authentik are deployed

CEPH_NAMESPACE="rook-ceph"
AUTHENTIK_NAMESPACE="authentik"
CEPH_BASE_URL="https://ceph.kube.huskypup.net"
AUTHENTIK_SAML_METADATA="https://auth.kube.huskypup.net/application/saml/ceph-dashboard/metadata/"
USERNAME_ATTRIBUTE="username"

echo "=== Setting up Ceph Dashboard SAML2 SSO ==="

# Check if Ceph tools pod is available
echo "Checking for Ceph tools pod..."
if ! kubectl -n "${CEPH_NAMESPACE}" get deploy rook-ceph-tools >/dev/null 2>&1; then
  echo "ERROR: rook-ceph-tools deployment not found"
  exit 1
fi

# Wait for Ceph tools to be ready
echo "Waiting for Ceph tools pod to be ready..."
kubectl -n "${CEPH_NAMESPACE}" wait --for=condition=Available deployment/rook-ceph-tools --timeout=120s || {
  echo "WARNING: Ceph tools pod may not be ready. Continuing anyway..."
}

# Check Ceph cluster health
echo "Checking Ceph cluster health..."
CEPH_HEALTH=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- ceph health 2>/dev/null || echo "UNKNOWN")
echo "Ceph health: ${CEPH_HEALTH}"

if [[ "$CEPH_HEALTH" == "UNKNOWN" ]]; then
  echo "ERROR: Cannot communicate with Ceph cluster"
  exit 1
fi

# Check if Authentik SAML metadata is accessible
echo "Verifying Authentik SAML metadata endpoint..."
HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" "${AUTHENTIK_SAML_METADATA}" 2>/dev/null || echo "000")
if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "302" ]]; then
  echo "WARNING: Authentik SAML metadata endpoint returned HTTP ${HTTP_CODE}"
  echo "The Ceph SAML application may not be configured in Authentik yet."
  echo "Ensure the ceph-blueprint.yaml is applied to Authentik."
fi

# Configure SAML2 SSO
echo "Configuring SAML2 SSO..."
SAML_CONFIG=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
  ceph dashboard sso setup saml2 \
    "${CEPH_BASE_URL}" \
    "${AUTHENTIK_SAML_METADATA}" \
    "${USERNAME_ATTRIBUTE}" 2>&1) || {
  echo "ERROR: Failed to configure SAML2 SSO"
  echo "$SAML_CONFIG"
  exit 1
}

echo "SAML2 configuration applied successfully"

# Enable SSO
echo "Enabling SAML2 SSO..."
kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
  ceph dashboard sso enable saml2

# Verify SSO status
SSO_STATUS=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
  ceph dashboard sso status 2>/dev/null)
echo "SSO Status: ${SSO_STATUS}"

# Create SSO users from Authentik
echo ""
echo "Creating SSO users in Ceph Dashboard..."

# Get active users from Authentik database
CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")

if [ -n "$CNPG_POD" ]; then
  # Get password from secret
  DB_PASSWORD=$(kubectl -n "${AUTHENTIK_NAMESPACE}" get secret pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)

  # Query for active non-service users
  USERS=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -c postgres -- \
    sh -c "PGPASSWORD='${DB_PASSWORD}' psql -h localhost -U app -d app -t -c \"SELECT username FROM authentik_core_user WHERE is_active = true AND username NOT LIKE 'ak-%' AND username != 'AnonymousUser';\"" 2>/dev/null | tr -d ' ' | grep -v '^$' || echo "")

  if [ -n "$USERS" ]; then
    echo "Found users in Authentik: $(echo $USERS | tr '\n' ' ')"

    # Get existing Ceph users
    EXISTING_USERS=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
      ceph dashboard ac-user-show 2>/dev/null | tr -d '[]"' | tr ',' '\n' | tr -d ' ')

    for USER in $USERS; do
      if echo "$EXISTING_USERS" | grep -q "^${USER}$"; then
        echo "  User '${USER}' already exists in Ceph"
      else
        echo "  Creating user '${USER}' with administrator role..."
        # Create user with a temporary password (SSO will bypass password auth)
        echo "sso-managed-password-$(date +%s)" | kubectl -n "${CEPH_NAMESPACE}" exec -i deploy/rook-ceph-tools -- \
          ceph dashboard ac-user-create "${USER}" -i - administrator 2>/dev/null && \
          echo "    Created user '${USER}'" || \
          echo "    WARNING: Failed to create user '${USER}'"
      fi
    done
  else
    echo "No users found in Authentik to sync"
  fi
else
  echo "WARNING: Could not find Authentik PostgreSQL pod. Skipping user sync."
  echo "You may need to manually create Ceph users matching your Authentik usernames."
fi

echo ""
echo "=== Ceph Dashboard SAML2 SSO Setup Complete ==="
echo ""
echo "Configuration:"
echo "  Base URL: ${CEPH_BASE_URL}"
echo "  IdP Metadata: ${AUTHENTIK_SAML_METADATA}"
echo "  Username Attribute: ${USERNAME_ATTRIBUTE}"
echo ""
echo "To login:"
echo "  1. Navigate to ${CEPH_BASE_URL}/auth/saml2/login"
echo "  2. Authenticate with Authentik"
echo "  3. You will be redirected to Ceph Dashboard"
echo ""