#!/bin/bash
# scripts/fix-gitlab-auth.sh
# Fix GitLab authentication issues by refreshing passwords

set -euo pipefail

echo "=== GitLab Authentication Fix ==="
echo "This script fixes the 500 errors caused by password synchronization issues"

# Function to restart deployment and wait
restart_deployment() {
  local deployment=$1
  local namespace=$2
  
  echo "Restarting $deployment in $namespace..."
  kubectl rollout restart deployment/$deployment -n $namespace
  kubectl rollout status deployment/$deployment -n $namespace --timeout=120s
}

# 1. Refresh database secrets
echo "Step 1: Refreshing database secrets..."
kubectl delete secret pg-gitlab-app -n gitlab --ignore-not-found=true
echo "Waiting for database secret to be recreated..."
for i in {1..30}; do
  if kubectl -n gitlab get secret pg-gitlab-app >/dev/null 2>&1; then
    echo "✓ Database secret recreated"
    break
  fi
  echo "  waiting... (attempt $i/30)"
  sleep 2
done

# 2. Refresh Redis secrets
echo "Step 2: Refreshing Redis secrets..."
kubectl delete secret redis-gitlab-secret -n gitlab --ignore-not-found=true
echo "Waiting for Redis secret to be recreated..."
for i in {1..30}; do
  if kubectl -n gitlab get secret redis-gitlab-secret >/dev/null 2>&1; then
    echo "✓ Redis secret recreated"
    break
  fi
  echo "  waiting... (attempt $i/30)"
  sleep 2
done

# 3. Trigger PostgreSQL reload
echo "Step 3: Reloading PostgreSQL clusters..."
kubectl annotate cluster pg-gitlab -n gitlab cnpg.io/reload=$(date +%s) --overwrite
kubectl annotate cluster pg-praefect -n gitlab cnpg.io/reload=$(date +%s) --overwrite

# 4. Restart Redis
echo "Step 4: Restarting Redis..."
kubectl rollout restart statefulset/redis-gitlab -n gitlab
kubectl rollout status statefulset/redis-gitlab -n gitlab --timeout=120s

# 5. Restart GitLab services
echo "Step 5: Restarting GitLab services..."
restart_deployment "gitlab-webservice-default" "gitlab"
restart_deployment "gitlab-sidekiq-all-in-1-v2" "gitlab"
restart_deployment "gitlab-toolbox" "gitlab"

# 6. Verify GitLab is working
echo "Step 6: Verifying GitLab functionality..."
sleep 30

# Test GitLab health endpoint
for i in {1..10}; do
  HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" https://gitlab.kube.huskypup.net/-/readiness)
  if [ "$HTTP_CODE" = "200" ]; then
    echo "✓ GitLab is responding correctly"
    break
  fi
  echo "  waiting for GitLab to be ready... (attempt $i/10) - HTTP $HTTP_CODE"
  sleep 10
done

# Test main page
HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" https://gitlab.kube.huskypup.net)
if [ "$HTTP_CODE" = "302" ]; then
  echo "✓ GitLab main page is working (redirecting to login as expected)"
elif [ "$HTTP_CODE" = "200" ]; then
  echo "✓ GitLab main page is working"
else
  echo "⚠ GitLab main page returned HTTP $HTTP_CODE (may still be starting)"
fi

echo ""
echo "===================================================================="
echo "GitLab Authentication Fix Complete"
echo "===================================================================="
echo "✓ Database secrets refreshed"
echo "✓ Redis secrets refreshed"
echo "✓ PostgreSQL clusters reloaded"
echo "✓ Redis restarted"
echo "✓ GitLab services restarted"
echo ""
echo "GitLab should now be accessible at: https://gitlab.kube.huskypup.net"
echo "If you still see 500 errors, check the logs with:"
echo "  kubectl logs -n gitlab -l app=webservice --tail=20"
echo "===================================================================="