#!/usr/bin/env bash
# One-time bootstrap: register the wallet auth-proxy as Forgejo's OIDC provider.
# Idempotent — safe to re-run; will fail with "already exists" on second run.
#
# Run this AFTER `docker compose up -d` and after Forgejo's healthcheck passes
# (its Postgres schema needs to be initialised before we can add an auth source).
#
# Usage:
#   bash scripts/bootstrap-auth.sh
set -euo pipefail

# shellcheck disable=SC1091
[[ -f "$(dirname "$0")/../.env" ]] && source "$(dirname "$0")/../.env"

: "${AUTH_PROXY_CLIENT_ID:?}"
: "${AUTH_PROXY_CLIENT_SECRET:?}"
: "${AUTH_PROXY_ISSUER:?}"

echo "Waiting for Forgejo to be ready…"
for i in {1..60}; do
  if docker compose exec -T forgejo forgejo --version >/dev/null 2>&1; then
    break
  fi
  sleep 2
done

# Same wait for auth-proxy — its /.well-known/openid-configuration must return 200
# before Forgejo will accept the auth source (it calls discovery on add).
echo "Waiting for auth-proxy to be ready…"
for i in {1..60}; do
  if docker compose exec -T forgejo wget -qO- "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" >/dev/null 2>&1; then
    break
  fi
  sleep 2
done

ADMIN_USER="${HEPHAESTUS_ADMIN_USER:-hephaestus-admin}"
ADMIN_PW="${HEPHAESTUS_ADMIN_PASSWORD:-$(openssl rand -base64 24 | tr -d '=+/' | cut -c1-24)}"
ADMIN_EMAIL="${HEPHAESTUS_ADMIN_EMAIL:-admin@hephaestus.local}"

echo "Creating admin user '${ADMIN_USER}' (idempotent — 'already exists' is fine)…"
docker compose exec -T --user 1000 forgejo forgejo admin user create \
  --admin \
  --username "${ADMIN_USER}" \
  --email "${ADMIN_EMAIL}" \
  --password "${ADMIN_PW}" \
  --must-change-password=false 2>&1 | tail -3 || true

echo ""
echo "Registering OIDC auth source 'hephaestus-wallet' in Forgejo…"
docker compose exec -T --user 1000 forgejo forgejo admin auth add-oauth \
  --provider openidConnect \
  --name hephaestus-wallet \
  --key "${AUTH_PROXY_CLIENT_ID}" \
  --secret "${AUTH_PROXY_CLIENT_SECRET}" \
  --auto-discover-url "${AUTH_PROXY_ISSUER}/.well-known/openid-configuration" \
  --scopes "openid profile" \
  --group-claim-name "" \
  --skip-local-2fa 2>&1 | tail -5

echo ""
echo "=== Bootstrap complete ==="
echo "Admin credentials (save these somewhere — needed for site admin):"
echo "  URL:      ${FORGEJO_ROOT_URL}"
echo "  Username: ${ADMIN_USER}"
echo "  Password: ${ADMIN_PW}"
echo ""
echo "For normal use: log in at ${FORGEJO_ROOT_URL} → 'Sign in with hephaestus-wallet'."