#!/usr/bin/env bash
set -euo pipefail

VAULT_NS="${VAULT_NS:-vault}"
SECRET_NAME="${SECRET_NAME:-vault-init-keys}"
KV_MOUNT="${KV_MOUNT:-secret}"
JOB_NS_FOR_ROLE="${JOB_NS_FOR_ROLE:-auth-proxy}"
JOB_SA_FOR_ROLE="${JOB_SA_FOR_ROLE:-oauth2-bootstrap}"
POLICY_NAME="${POLICY_NAME:-oauth2-writer}"
ROLE_NAME="${ROLE_NAME:-eso-writer}"

# --- prereqs ---
command -v kubectl >/dev/null || { echo "kubectl not found"; exit 1; }
command -v vault   >/dev/null || { echo "vault CLI not found"; exit 1; }
command -v jq      >/dev/null || { echo "jq not found"; exit 1; }

# --- port-forward Vault locally ---
echo "==> Port-forwarding Vault service (ctrl-c in another terminal to stop when done)"
kubectl -n "$VAULT_NS" port-forward svc/vault 8200:8200 >/dev/null 2>&1 &
pf_pid=$!
trap 'kill $pf_pid >/dev/null 2>&1 || true' EXIT
sleep 2

export VAULT_ADDR="http://127.0.0.1:8200"

# --- check init/seal status ---
status_json="$(vault status -format=json || true)"
initialized="$(jq -r '.initialized // empty' <<<"$status_json")"
sealed="$(jq -r '.sealed // empty' <<<"$status_json")"

root_token=""
unseal_key=""

# pull existing secret if present
if kubectl -n "$VAULT_NS" get secret "$SECRET_NAME" >/dev/null 2>&1; then
  root_token="$(kubectl -n "$VAULT_NS" get secret "$SECRET_NAME" -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d || true)"
  unseal_key="$(kubectl -n "$VAULT_NS" get secret "$SECRET_NAME" -o jsonpath='{.data.VAULT_UNSEAL_KEY}' | base64 -d || true)"
fi

# initialize if needed
if [[ "$initialized" != "true" ]]; then
  echo "==> Vault not initialized; initializing..."
  init_json="$(vault operator init -key-shares=1 -key-threshold=1 -format=json)"
  root_token="$(jq -r .root_token <<<"$init_json")"
  unseal_key="$(jq -r '.unseal_keys_b64[0]' <<<"$init_json")"
  sealed="true"

  echo "==> Storing root token & unseal key in Secret ${VAULT_NS}/${SECRET_NAME}"
  kubectl -n "$VAULT_NS" create secret generic "$SECRET_NAME" \
    --from-literal=VAULT_ROOT_TOKEN="$root_token" \
    --from-literal=VAULT_UNSEAL_KEY="$unseal_key" \
    --dry-run=client -o yaml | kubectl apply -f -
else
  echo "==> Vault already initialized."
fi

# unseal if needed
if [[ "$sealed" == "true" ]]; then
  [[ -n "$unseal_key" ]] || { echo "ERROR: sealed and no unseal key available"; exit 1; }
  echo "==> Unsealing..."
  vault operator unseal "$unseal_key" >/dev/null
fi

# login
if [[ -z "$root_token" ]]; then
  echo "==> Reading root token from Secret..."
  root_token="$(kubectl -n "$VAULT_NS" get secret "$SECRET_NAME" -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d)"
fi
vault login "$root_token" >/dev/null

# ensure KV v2 enabled
if ! vault secrets list -format=json | jq -e "has(\"${KV_MOUNT}/\")" >/dev/null; then
  echo "==> Enabling KV v2 at ${KV_MOUNT}/"
  vault secrets enable -path="$KV_MOUNT" -version=2 kv >/dev/null
fi

# configure Kubernetes auth with a reviewer token from a local SA
echo "==> Ensuring reviewer SA + binding"
kubectl -n "$VAULT_NS" get sa vault-auth >/dev/null 2>&1 || kubectl -n "$VAULT_NS" create sa vault-auth
kubectl get clusterrolebinding vault-auth-delegator >/dev/null 2>&1 || \
  kubectl create clusterrolebinding vault-auth-delegator \
    --clusterrole=system:auth-delegator \
    --serviceaccount="${VAULT_NS}:vault-auth"

reviewer_jwt="$(kubectl -n "$VAULT_NS" create token vault-auth)"
kube_ca="$(kubectl -n kube-system get configmap kube-root-ca.crt -o jsonpath='{.data.ca\.crt}')"
kube_host="https://kubernetes.default.svc:443"

vault auth enable kubernetes >/dev/null 2>&1 || true
vault write auth/kubernetes/config \
  token_reviewer_jwt="$reviewer_jwt" \
  kubernetes_host="$kube_host" \
  kubernetes_ca_cert="$kube_ca" >/dev/null

# policy + role for ESO/oauth2 job
vault policy write "$POLICY_NAME" - >/dev/null <<'HCL'
path "secret/data/*" {
  capabilities = ["create", "update", "read", "list"]
}

path "secret/metadata/*" {
  capabilities = ["create", "update", "read", "list"]
}
HCL

vault write auth/kubernetes/role/${ROLE_NAME} \
  bound_service_account_names="${JOB_SA_FOR_ROLE},external-secrets" \
  bound_service_account_namespaces="${JOB_NS_FOR_ROLE},external-secrets" \
  policies="${POLICY_NAME}" \
  ttl="24h" >/dev/null

echo "==> Done."
echo "K8s Secret with init creds: ${VAULT_NS}/${SECRET_NAME}"
echo "IMPORTANT: back these up securely and delete the Secret when you’re comfortable:"
echo "  kubectl -n ${VAULT_NS} delete secret ${SECRET_NAME}"