#!/usr/bin/env bash
# init_grafana_oauth_prole.sh
#
# Bootstrap the Google-OAuth secret for Grafana on the prole.org k3s homelab
# cluster. Companion to the knoe.dev version (init_grafana_oauth.sh) but uses
# prole.org GCP project credentials and targets the k3s kubecontext.
#
# Creates the grafana-google-oidc Secret in the monitoring namespace, which
# kps-grafana mounts via envFromSecret to get GF_AUTH_GOOGLE_CLIENT_ID and
# GF_AUTH_GOOGLE_CLIENT_SECRET for its auth.google sign-in flow.
#
# Auth model (monitoring/kps-values-k3s.yaml):
#   - Kerberos/knoe-auth users auto-login via auth.proxy (X-WEBAUTH-USER).
#   - chrisfu@prole.org (and any future @prole.org Workspace user) signs in
#     with the Google button on the Grafana login page.
#   - chrisfu@prole.org → Admin; all other @prole.org users → Editor.
#
# Usage:
#   ./etc/init_grafana_oauth_prole.sh
#
# Env vars (resolved from etc/secrets/* if not set in the shell):
#   GRAFANA_GOOGLE_CLIENT_ID      ← from etc/secrets/grafana-google-oidc-client-id-prole
#   GRAFANA_GOOGLE_CLIENT_SECRET  ← from etc/secrets/grafana-google-oidc-client-secret-prole
#
# Optional:
#   K3S_KUBECONTEXT   (default: $KUBECONTEXT then ambient)
#   NAMESPACE         (default: monitoring)
#
# Pre-reqs:
#   - OAuth 2.0 Web Application client created in the prole.org GCP project:
#       Authorized JS origins:    https://svc.prole.org
#       Authorized redirect URI:  https://svc.prole.org/grafana/login/google
#       Consent screen:           Internal (prole.org Workspace)
#       Scopes:                   openid, email, profile
#     See deploy/gcp/gke/grafana-google-oidc-secret-prole.example.yaml for details.
#   - Client ID and secret saved (chmod 0600) to:
#       etc/secrets/grafana-google-oidc-client-id-prole
#       etc/secrets/grafana-google-oidc-client-secret-prole

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
MANIFEST_DIR="$REPO_ROOT/deploy/gcp/gke"

NAMESPACE="${NAMESPACE:-monitoring}"
KCTX="${K3S_KUBECONTEXT:-${KUBECONTEXT:-}}"

if [[ -n "$KCTX" ]]; then
  KCTX_FLAG=(--context="$KCTX")
else
  KCTX_FLAG=()
fi

log() { printf "[%s] %s\n" "$(date +%H:%M:%S)" "$*"; }
die() { log "ERROR: $*" >&2; exit 1; }

resolve_secret() {
  local var="$1" file="$2" val="${!1:-}"
  if [[ -z "$val" && -f "$REPO_ROOT/etc/secrets/$file" ]]; then
    val="$(cat "$REPO_ROOT/etc/secrets/$file")"
  fi
  if [[ -z "$val" ]]; then
    die "missing $var (set the env var, or save the value into etc/secrets/$file)"
  fi
  printf '%s' "$val"
}

for tool in kubectl envsubst; do
  command -v "$tool" >/dev/null 2>&1 || die "required tool not found: $tool"
done

GRAFANA_GOOGLE_CLIENT_ID="$(resolve_secret GRAFANA_GOOGLE_CLIENT_ID grafana-google-oidc-client-id-prole)"
GRAFANA_GOOGLE_CLIENT_SECRET="$(resolve_secret GRAFANA_GOOGLE_CLIENT_SECRET grafana-google-oidc-client-secret-prole)"
export GRAFANA_GOOGLE_CLIENT_ID GRAFANA_GOOGLE_CLIENT_SECRET

SECRET_TMPL="$MANIFEST_DIR/grafana-google-oidc-secret-prole.example.yaml"
[[ -f "$SECRET_TMPL" ]] || die "missing manifest: $SECRET_TMPL"

log "==> grafana google-oauth bootstrap (prole.org / k3s)"
log "    namespace : $NAMESPACE"
log "    kubectx   : ${KCTX:-<ambient>}"

log "Applying grafana-google-oidc Secret ..."
envsubst '${GRAFANA_GOOGLE_CLIENT_ID} ${GRAFANA_GOOGLE_CLIENT_SECRET}' \
  < "$SECRET_TMPL" \
  | kubectl "${KCTX_FLAG[@]}" -n "$NAMESPACE" apply -f -

log "==> grafana google-oauth secret applied."
echo ""
echo "  Next steps:"
echo "    1. Helm upgrade kube-prometheus-stack with the k3s values:"
echo "         helm upgrade --reuse-values kps prometheus-community/kube-prometheus-stack \\"
echo "                      --namespace $NAMESPACE \\"
echo "                      -f $REPO_ROOT/monitoring/kps-values-k3s.yaml"
echo "    2. Restart grafana-proxy to pick up the updated configmap:"
echo "         kubectl rollout restart deployment/knoe-grafana-proxy -n $NAMESPACE"
echo "    3. Browser-test: https://svc.prole.org/grafana/login → Google sign-in button"
echo "       present; Kerberos users still auto-login via X-WEBAUTH-USER."
echo ""