#!/bin/bash
set -euo pipefail

# sync-percona-everest-oauth.sh
# Retrieves Percona Everest OIDC provider credentials from Authentik and stores them in Vault
# Everest uses PKCE (public client) so the client_secret is not strictly required,
# but we store it in Vault for reference and potential future use.

AUTHENTIK_NAMESPACE="authentik"
VAULT_NAMESPACE="vault"
VAULT_SECRET_PATH="secret/percona-everest-oauth"

echo "=== Syncing Percona Everest OAuth Credentials from Authentik to Vault ==="

# Check if Authentik is running
if ! kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --no-headers 2>/dev/null | grep -q Running; then
  echo "ERROR: Authentik is not running. Please deploy Authentik first."
  exit 1
fi

# Wait for Authentik to be fully ready
echo "Waiting for Authentik to be ready..."
kubectl -n "${AUTHENTIK_NAMESPACE}" wait --for=condition=Ready pod -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --timeout=60s || {
  echo "WARNING: Authentik may not be fully ready yet. Continuing anyway..."
}

# Get Authentik pod name
AUTHENTIK_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')

if [ -z "$AUTHENTIK_POD" ]; then
  echo "ERROR: Could not find Authentik server pod"
  exit 1
fi

echo "Found Authentik pod: ${AUTHENTIK_POD}"

# Retrieve OAuth2 provider credentials from Authentik
echo "Retrieving Percona Everest OAuth credentials from Authentik..."

# Method 1: Try to get credentials directly from Authentik CLI
CLIENT_ID=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "Percona Everest"' | grep '"client_id"' | cut -d'"' -f4 || echo "")

# If Method 1 fails, try using PostgreSQL directly
if [ -z "$CLIENT_ID" ]; then
  echo "Attempting to retrieve credentials from Authentik PostgreSQL database..."

  CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik,role=primary -o jsonpath='{.items[0].metadata.name}')

  if [ -z "$CNPG_POD" ]; then
    echo "ERROR: Could not find Authentik PostgreSQL pod"
    exit 1
  fi

  # Query the database for Percona Everest provider credentials
  PROVIDER_DATA=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -- psql -U authentik -d authentik -t -c \
    "SELECT client_id FROM authentik_providers_oauth2_oauth2provider WHERE name='Percona Everest';" 2>/dev/null || echo "")

  if [ -n "$PROVIDER_DATA" ]; then
    CLIENT_ID=$(echo "$PROVIDER_DATA" | tr -d ' ' | tr -d '\n')
  fi
fi

# Validate credentials were retrieved
if [ -z "$CLIENT_ID" ]; then
  echo "WARNING: Could not retrieve Percona Everest OAuth credentials from Authentik"
  echo "The OIDC provider may not be configured yet (blueprint not processed)."
  echo "Everest will use local admin authentication until OIDC is available."
  exit 0
fi

echo "Successfully retrieved credentials:"
echo "  Client ID: ${CLIENT_ID}"

# Check if Vault is unsealed and ready
echo "Checking Vault status..."
VAULT_POD=$(kubectl get pods -n "${VAULT_NAMESPACE}" -l app.kubernetes.io/name=vault -o jsonpath='{.items[0].metadata.name}')

if [ -z "$VAULT_POD" ]; then
  echo "ERROR: Vault pod not found"
  exit 1
fi

VAULT_STATUS=$(kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault status -format=json 2>/dev/null || echo "{}")
SEALED=$(echo "$VAULT_STATUS" | grep -o '"sealed":[^,}]*' | cut -d':' -f2 | tr -d ' ')

if [ "$SEALED" = "true" ]; then
  echo "ERROR: Vault is sealed. Please unseal Vault first."
  exit 1
fi

# Store credentials in Vault
echo "Storing Percona Everest OAuth credentials in Vault at ${VAULT_SECRET_PATH}..."
kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault kv put "${VAULT_SECRET_PATH}" \
  client-id="${CLIENT_ID}"

if [ $? -eq 0 ]; then
  echo "Successfully stored Percona Everest OAuth credentials in Vault"
else
  echo "ERROR: Failed to store credentials in Vault"
  exit 1
fi

echo ""
echo "=== Percona Everest OAuth Sync Complete ==="