#!/bin/bash
# Grant GitLab admin access to users in Authentik "authentik Admins" group
# Run this after users login via Authentik SSO

set -euo pipefail

ADMIN_GROUP="authentik Admins"

echo "🔄 Granting GitLab admin access to Authentik admin group members..."
echo ""

# Get Authentik database password
PGPASSWORD=$(kubectl get secret -n authentik pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)

# Query Authentik for users in admin group
echo "📋 Getting users from Authentik '$ADMIN_GROUP' group..."
ADMIN_EMAILS=$(kubectl exec -n authentik pg-authentik-1 -- env PGPASSWORD="$PGPASSWORD" psql -h pg-authentik-rw -U app -d app -t -c "
  SELECT DISTINCT u.email
  FROM authentik_core_user u
  JOIN authentik_core_user_groups ug ON u.id = ug.user_id
  JOIN authentik_core_group g ON ug.group_id = g.group_uuid
  WHERE g.name = '$ADMIN_GROUP' AND u.is_active = true;
" 2>&1 | grep -v "Defaulted" | grep '@' | xargs)

if [ -z "$ADMIN_EMAILS" ]; then
    echo "⚠️  No users found in Authentik '$ADMIN_GROUP' group"
    exit 0
fi

echo "✓ Found admin users: $ADMIN_EMAILS"
echo ""

# Check if gitlab-toolbox pod exists
TOOLBOX_POD=$(kubectl get pods -n gitlab -l app=toolbox,release=gitlab -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")

if [ -z "$TOOLBOX_POD" ]; then
    echo "❌ GitLab toolbox pod not found"
    echo "   Toolbox is required to run Rails commands"
    exit 1
fi

echo "🔧 Using toolbox pod: $TOOLBOX_POD"
echo ""

# For each admin user, grant admin access
for email in $ADMIN_EMAILS; do
    echo "🔐 Processing: $email"

    kubectl exec -n gitlab "$TOOLBOX_POD" -- gitlab-rails runner "
      user = User.find_by(email: '$email')
      if user
        if user.admin?
          puts '   ✓ Already admin'
        else
          user.update!(admin: true)
          puts '   ✅ Promoted to admin'
        end
      else
        puts '   ⚠️  User not found (needs to login via Authentik SSO first)'
      end
    " 2>&1 | grep -v "^$"
done

echo ""
echo "✅ Admin sync complete!"
echo ""
echo "💡 Note: Users must login via Authentik SSO at least once before they can be promoted"