---
# Job to sync GitLab admin status from Authentik groups
# Run this after users login via Authentik SSO to grant them admin access
apiVersion: batch/v1
kind: Job
metadata:
  name: gitlab-sync-admin
  namespace: gitlab
spec:
  ttlSecondsAfterFinished: 3600  # Clean up after 1 hour
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: sync-admin
        image: docker.io/library/alpine:3.21
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        command:
        - /bin/sh
        - -c
        - |
          set -e

          apk add --no-cache postgresql-client curl

          echo "🔄 Syncing GitLab admin permissions from Authentik..."

          # Get list of users in "authentik Admins" group
          ADMIN_USERS=$(PGPASSWORD="$AUTHENTIK_DB_PASSWORD" psql -h pg-authentik-rw.authentik.svc.cluster.local -U app -d app -t -c "
            SELECT DISTINCT u.email
            FROM authentik_core_user u
            JOIN authentik_core_user_groups ug ON u.id = ug.user_id
            JOIN authentik_core_group g ON ug.group_id = g.group_uuid
            WHERE g.name = 'authentik Admins' AND u.is_active = true;
          " | xargs)

          if [ -z "$ADMIN_USERS" ]; then
            echo "⚠️  No users found in 'authentik Admins' group"
            exit 0
          fi

          echo "✓ Found admin users: $ADMIN_USERS"
          echo ""

          # For each admin user, grant admin access in GitLab
          for email in $ADMIN_USERS; do
            echo "🔐 Checking user: $email"

            # Use GitLab Rails runner to promote user
            kubectl exec -n gitlab deployment/gitlab-toolbox -- \
              gitlab-rails runner "
                user = User.find_by(email: '$email')
                if user
                  if user.admin?
                    puts '  ✓ Already admin'
                  else
                    user.update(admin: true)
                    puts '  ✅ Promoted to admin'
                  end
                else
                  puts '  ⚠️  User not found (needs to login via SSO first)'
                end
              " || echo "  ❌ Failed to update user"
          done

          echo ""
          echo "✅ Admin sync complete"
        env:
        - name: AUTHENTIK_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: pg-authentik-app
              namespace: authentik
              key: password
      serviceAccountName: gitlab-sync-admin
---
# ServiceAccount for the sync job
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-sync-admin
  namespace: gitlab
---
# Role to allow exec into toolbox pod
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-sync-admin
  namespace: gitlab
rules:
- apiGroups: [""]
  resources: ["pods", "pods/exec"]
  verbs: ["get", "list", "create"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list"]
---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitlab-sync-admin
  namespace: gitlab
subjects:
- kind: ServiceAccount
  name: gitlab-sync-admin
  namespace: gitlab
roleRef:
  kind: Role
  name: gitlab-sync-admin
  apiGroup: rbac.authorization.k8s.io