#!/bin/bash
# =============================================================================
# Gitea OAuth Application Setup for Authentik
# =============================================================================
# Creates OAuth2 provider and application in Authentik for Gitea
# Outputs credentials for manual Gitea UI configuration
#
# Generated by ansible - do not edit manually
# =============================================================================

set -e

AUTHENTIK_DOMAIN="{{ authentik_domain }}"
GITEA_DOMAIN="{{ gitea_domain }}"
CLIENT_ID="{{ gitea_oauth_client_id }}"
PROVIDER_NAME="{{ gitea_oauth_provider_name }}"
OUTPUT_FILE="/tmp/gitea-oauth-credentials.json"

# Bootstrap token from Authentik
API_TOKEN="{{ vault_authentik_bootstrap_token }}"

echo "============================================"
echo "Gitea OAuth Application Setup"
echo "============================================"
echo ""
echo "Authentik: https://${AUTHENTIK_DOMAIN}"
echo "Gitea:     https://${GITEA_DOMAIN}"
echo ""

# -----------------------------------------------------------------------------
# Test API access
# -----------------------------------------------------------------------------
echo "Testing Authentik API access..."
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://${AUTHENTIK_DOMAIN}/api/v3/core/brands/" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")

if [ "$HTTP_CODE" != "200" ]; then
    echo "ERROR: API authentication failed (HTTP $HTTP_CODE)"
    echo "Check that vault_authentik_bootstrap_token is correct"
    exit 1
fi
echo "Authentik API ready!"
echo ""

# -----------------------------------------------------------------------------
# Get authorization flow PK
# -----------------------------------------------------------------------------
echo "Finding authorization flow..."
AUTH_FLOW_RESPONSE=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/flows/instances/?designation=authorization" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")
AUTH_FLOW_PK=$(echo "$AUTH_FLOW_RESPONSE" | jq -r '.results[0].pk')
echo "Authorization flow: $AUTH_FLOW_PK"

# -----------------------------------------------------------------------------
# Get invalidation flow PK
# -----------------------------------------------------------------------------
echo "Finding invalidation flow..."
INVALID_FLOW_RESPONSE=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/flows/instances/?designation=invalidation" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")
INVALID_FLOW_PK=$(echo "$INVALID_FLOW_RESPONSE" | jq -r '.results[0].pk')
echo "Invalidation flow: $INVALID_FLOW_PK"

# -----------------------------------------------------------------------------
# Get signing certificate
# -----------------------------------------------------------------------------
echo "Finding signing certificate..."
CERT_RESPONSE=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/crypto/certificatekeypairs/" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")
SIGNING_KEY_PK=$(echo "$CERT_RESPONSE" | jq -r '.results[0].pk')
echo "Signing key: $SIGNING_KEY_PK"

# -----------------------------------------------------------------------------
# Get scope mappings
# -----------------------------------------------------------------------------
echo "Getting scope mappings..."
SCOPE_MAPPINGS=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/propertymappings/provider/scope/" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")

OPENID_PK=$(echo "$SCOPE_MAPPINGS" | jq -r '.results[] | select(.scope_name=="openid") | .pk')
PROFILE_PK=$(echo "$SCOPE_MAPPINGS" | jq -r '.results[] | select(.scope_name=="profile") | .pk')
EMAIL_PK=$(echo "$SCOPE_MAPPINGS" | jq -r '.results[] | select(.scope_name=="email") | .pk')

echo "Scopes: openid=$OPENID_PK, profile=$PROFILE_PK, email=$EMAIL_PK"
echo ""

# -----------------------------------------------------------------------------
# Check if provider already exists
# -----------------------------------------------------------------------------
echo "Checking for existing Gitea provider..."
EXISTING_PROVIDER=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/providers/oauth2/?name=Gitea" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")
EXISTING_PK=$(echo "$EXISTING_PROVIDER" | jq -r '.results[0].pk // empty')

if [ -n "$EXISTING_PK" ] && [ "$EXISTING_PK" != "null" ]; then
    echo "Provider already exists (PK: $EXISTING_PK), updating..."

    # Update existing provider
    PROVIDER_RESPONSE=$(curl -s -X PATCH \
        "https://${AUTHENTIK_DOMAIN}/api/v3/providers/oauth2/${EXISTING_PK}/" \
        -H "Authorization: Bearer ${API_TOKEN}" \
        -H "Accept: application/json" \
        -H "Content-Type: application/json" \
        -d "{
            \"redirect_uris\": [
                {\"matching_mode\": \"strict\", \"url\": \"https://${GITEA_DOMAIN}/user/oauth2/${PROVIDER_NAME}/callback\"}
            ]
        }")

    PROVIDER_PK="$EXISTING_PK"
    CLIENT_SECRET=$(echo "$EXISTING_PROVIDER" | jq -r '.results[0].client_secret // empty')
else
    # -----------------------------------------------------------------------------
    # Create OAuth2 Provider (confidential client for Gitea)
    # -----------------------------------------------------------------------------
    echo "Creating Gitea OAuth2 Provider..."
    PROVIDER_RESPONSE=$(curl -s -X POST \
        "https://${AUTHENTIK_DOMAIN}/api/v3/providers/oauth2/" \
        -H "Authorization: Bearer ${API_TOKEN}" \
        -H "Accept: application/json" \
        -H "Content-Type: application/json" \
        -d "{
            \"name\": \"Gitea\",
            \"authorization_flow\": \"${AUTH_FLOW_PK}\",
            \"invalidation_flow\": \"${INVALID_FLOW_PK}\",
            \"signing_key\": \"${SIGNING_KEY_PK}\",
            \"client_type\": \"confidential\",
            \"client_id\": \"${CLIENT_ID}\",
            \"redirect_uris\": [
                {\"matching_mode\": \"strict\", \"url\": \"https://${GITEA_DOMAIN}/user/oauth2/${PROVIDER_NAME}/callback\"}
            ],
            \"access_code_validity\": \"minutes=10\",
            \"access_token_validity\": \"hours=1\",
            \"refresh_token_validity\": \"days=30\",
            \"property_mappings\": [\"${OPENID_PK}\", \"${PROFILE_PK}\", \"${EMAIL_PK}\"],
            \"sub_mode\": \"user_email\",
            \"include_claims_in_id_token\": true,
            \"issuer_mode\": \"per_provider\"
        }")

    PROVIDER_PK=$(echo "$PROVIDER_RESPONSE" | jq -r '.pk // empty')
    CLIENT_SECRET=$(echo "$PROVIDER_RESPONSE" | jq -r '.client_secret // empty')

    if [ -z "$PROVIDER_PK" ] || [ "$PROVIDER_PK" = "null" ]; then
        echo "ERROR: Failed to create provider"
        echo "$PROVIDER_RESPONSE" | jq .
        exit 1
    fi
fi

echo "Provider PK: $PROVIDER_PK"
echo ""

# -----------------------------------------------------------------------------
# Check if application already exists
# -----------------------------------------------------------------------------
echo "Checking for existing Gitea application..."
EXISTING_APP=$(curl -s \
    "https://${AUTHENTIK_DOMAIN}/api/v3/core/applications/?slug=gitea" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Accept: application/json")
EXISTING_APP_SLUG=$(echo "$EXISTING_APP" | jq -r '.results[0].slug // empty')

if [ -z "$EXISTING_APP_SLUG" ] || [ "$EXISTING_APP_SLUG" = "null" ]; then
    # -----------------------------------------------------------------------------
    # Create Application
    # -----------------------------------------------------------------------------
    echo "Creating Gitea Application..."
    APP_RESPONSE=$(curl -s -X POST \
        "https://${AUTHENTIK_DOMAIN}/api/v3/core/applications/" \
        -H "Authorization: Bearer ${API_TOKEN}" \
        -H "Accept: application/json" \
        -H "Content-Type: application/json" \
        -d "{
            \"name\": \"Gitea\",
            \"slug\": \"gitea\",
            \"provider\": ${PROVIDER_PK},
            \"meta_launch_url\": \"https://${GITEA_DOMAIN}\",
            \"open_in_new_tab\": false
        }")

    APP_SLUG=$(echo "$APP_RESPONSE" | jq -r '.slug // empty')
    if [ -z "$APP_SLUG" ] || [ "$APP_SLUG" = "null" ]; then
        echo "WARNING: Failed to create application (may already exist)"
    else
        echo "Application created: $APP_SLUG"
    fi
else
    echo "Application already exists: $EXISTING_APP_SLUG"
fi

echo ""

# -----------------------------------------------------------------------------
# Output credentials
# -----------------------------------------------------------------------------
cat > "$OUTPUT_FILE" << EOF
{
    "client_id": "${CLIENT_ID}",
    "client_secret": "${CLIENT_SECRET}",
    "auto_discover_url": "https://${AUTHENTIK_DOMAIN}/application/o/gitea/.well-known/openid-configuration",
    "scopes": "email profile",
    "provider_name": "${PROVIDER_NAME}"
}
EOF

echo "============================================"
echo "OAuth Setup Complete!"
echo "============================================"
echo ""
echo "Credentials saved to: ${OUTPUT_FILE}"
echo ""
echo "========================================"
echo "MANUAL CONFIGURATION REQUIRED IN GITEA"
echo "========================================"
echo ""
echo "1. Log into Gitea as admin:"
echo "   https://${GITEA_DOMAIN}/user/login"
echo ""
echo "2. Navigate to:"
echo "   Site Administration -> Authentication Sources -> Add"
echo ""
echo "3. Fill in the form:"
echo "   Authentication Type: OAuth2"
echo "   Authentication Name: ${PROVIDER_NAME}"
echo "   OAuth2 Provider:     OpenID Connect"
echo "   Client ID:           ${CLIENT_ID}"
echo "   Client Secret:       ${CLIENT_SECRET}"
echo "   OpenID Connect Auto Discovery URL:"
echo "     https://${AUTHENTIK_DOMAIN}/application/o/gitea/.well-known/openid-configuration"
echo "   Additional Scopes:   email profile"
echo ""
echo "4. Click 'Add Authentication Source'"
echo ""
echo "5. Test by logging out and clicking 'Sign in with ${PROVIDER_NAME}'"
echo ""
echo "========================================"
echo ""
echo "Credentials JSON:"
cat "$OUTPUT_FILE"
echo ""