#!/bin/bash
# Sync GitLab admin status from Authentik "authentik Admins" group
# This script grants admin access to users who are members of "authentik Admins" in Authentik

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NAMESPACE="gitlab"
ADMIN_GROUP="authentik Admins"

echo "🔄 Syncing GitLab admin permissions from Authentik..."

# Get GitLab root password
GITLAB_ROOT_PASSWORD=$(kubectl get secret -n gitlab gitlab-gitlab-initial-root-password -o jsonpath='{.data.password}' 2>/dev/null | base64 -d || echo "")

if [ -z "$GITLAB_ROOT_PASSWORD" ]; then
    echo "❌ GitLab root password not found"
    echo "   Please login to GitLab UI first to complete initial setup"
    exit 1
fi

# Get GitLab API endpoint
GITLAB_URL="https://gitlab.kube.huskypup.net"

echo "📋 Getting list of users from Authentik '$ADMIN_GROUP' group..."

# Get Authentik database password
PGPASSWORD=$(kubectl get secret -n authentik pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)

# Query Authentik database for users in admin group
ADMIN_USERS=$(kubectl exec -n authentik pg-authentik-1 -- env PGPASSWORD="$PGPASSWORD" psql -h pg-authentik-rw -U app -d app -t -c "
  SELECT DISTINCT u.email
  FROM authentik_core_user u
  JOIN authentik_core_user_groups ug ON u.id = ug.user_id
  JOIN authentik_core_group g ON ug.group_id = g.group_uuid
  WHERE g.name = '$ADMIN_GROUP' AND u.is_active = true;
" 2>/dev/null | grep -v "Defaulted" | xargs)

if [ -z "$ADMIN_USERS" ]; then
    echo "⚠️  No users found in Authentik '$ADMIN_GROUP' group"
    exit 0
fi

echo "✓ Found admin users: $ADMIN_USERS"
echo ""

# Create GitLab API token (using root account)
echo "🔑 Creating GitLab API token..."

# Try to login and get session
SESSION_COOKIE=$(curl -sk -c - "$GITLAB_URL/users/sign_in" | grep '_gitlab_session' | awk '{print $7}')

# Get CSRF token
CSRF_TOKEN=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" "$GITLAB_URL/users/sign_in" | grep -o 'name="authenticity_token" value="[^"]*"' | cut -d'"' -f4)

# Login as root
LOGIN_RESPONSE=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" -c - \
    -X POST "$GITLAB_URL/users/sign_in" \
    -d "user[login]=root&user[password]=$GITLAB_ROOT_PASSWORD&authenticity_token=$CSRF_TOKEN")

echo "⚠️  Note: GitLab CE doesn't support automatic admin assignment via API"
echo "   Users must be manually promoted to admin in GitLab UI"
echo ""
echo "📝 To manually grant admin access:"
echo "   1. Login to GitLab as root: $GITLAB_URL"
echo "   2. Go to Admin Area > Users"
echo "   3. Find and edit each user: $ADMIN_USERS"
echo "   4. Check 'Admin' checkbox and save"
echo ""
echo "💡 Alternatively, run this from a GitLab Rails console:"
for email in $ADMIN_USERS; do
    echo "   User.find_by(email: '$email')&.update(admin: true)"
done