#!/usr/bin/env bash
# setup-netbird-api-token.sh - Bootstrap Netbird API token for operator + exporter
#
# Creates a service user in Netbird and generates a long-lived PAT (Personal Access Token)
# for automation. Stores the token in Vault for ExternalSecret consumption.
#
# Usage:
#   ./scripts/setup-netbird-api-token.sh <admin-pat>
#
# Prerequisites:
#   - Netbird management server running and accessible
#   - Admin PAT from Netbird dashboard (Settings → Personal Access Tokens)
#   - Vault initialized and unsealed
#   - kubectl configured for the cluster

set -euo pipefail

ADMIN_PAT="${1:?Usage: $0 <admin-pat>}"
NETBIRD_API="https://netbird.kube.huskypup.net"
SERVICE_USER_NAME="k8s-operator"
PAT_NAME="operator-automation"

echo "=== Netbird API Token Bootstrap ==="

# Check for existing service user
echo "Checking for existing service user '${SERVICE_USER_NAME}'..."
USERS=$(curl -sf -H "Authorization: Token ${ADMIN_PAT}" \
  "${NETBIRD_API}/api/users" 2>/dev/null || echo "[]")

SERVICE_USER_ID=$(echo "${USERS}" | jq -r \
  ".[] | select(.name == \"${SERVICE_USER_NAME}\" and .is_service_user == true) | .id" 2>/dev/null || echo "")

if [ -z "${SERVICE_USER_ID}" ]; then
  echo "Creating service user '${SERVICE_USER_NAME}'..."
  RESPONSE=$(curl -sf -X POST \
    -H "Authorization: Token ${ADMIN_PAT}" \
    -H "Content-Type: application/json" \
    -d "{\"name\": \"${SERVICE_USER_NAME}\", \"role\": \"admin\", \"is_service_user\": true, \"auto_groups\": []}" \
    "${NETBIRD_API}/api/users")
  SERVICE_USER_ID=$(echo "${RESPONSE}" | jq -r '.id')
  echo "  Created service user: ${SERVICE_USER_ID}"
else
  echo "  Service user already exists: ${SERVICE_USER_ID}"
fi

# Create PAT for the service user
echo "Creating Personal Access Token '${PAT_NAME}'..."
# Set expiration to 365 days from now
EXPIRES=$(date -u -d "+365 days" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || \
  date -u -v+365d "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null)

PAT_RESPONSE=$(curl -sf -X POST \
  -H "Authorization: Token ${ADMIN_PAT}" \
  -H "Content-Type: application/json" \
  -d "{\"name\": \"${PAT_NAME}\", \"expires_in\": 365}" \
  "${NETBIRD_API}/api/users/${SERVICE_USER_ID}/tokens")

API_TOKEN=$(echo "${PAT_RESPONSE}" | jq -r '.plain_token')

if [ -z "${API_TOKEN}" ] || [ "${API_TOKEN}" = "null" ]; then
  echo "ERROR: Failed to create PAT. Response:"
  echo "${PAT_RESPONSE}" | jq . 2>/dev/null || echo "${PAT_RESPONSE}"
  exit 1
fi

echo "  PAT created successfully"

# Store in Vault
echo "Storing API token in Vault at secret/netbird-api-token..."
ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d)
kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
  vault kv put secret/netbird-api-token api-token="${API_TOKEN}"

echo ""
echo "=== Netbird API Token Bootstrap Complete ==="
echo "  Service User: ${SERVICE_USER_NAME} (${SERVICE_USER_ID})"
echo "  Vault Path:   secret/netbird-api-token"
echo "  Expires:      ~365 days"
echo ""
echo "Next steps:"
echo "  1. Run: helmfile apply  (deploys operator + exporter with the token)"
echo "  2. Annotate services:   kubectl annotate svc <name> -n <ns> netbird.io/expose=true"