#!/usr/bin/env bash
# scripts/k3d-knoe-pf.sh
# Open port-forwards for the k3d-knoe dev cluster and print connection info.
#
# Forwards:
#   localhost:5432  →  service/knoe-db-rw   (CNPG primary, namespace knoe-db-0)
#   localhost:88    →  service/knoe-kdc:88  (Kerberos KDC, namespace knoe-system)
#   localhost:464   →  service/knoe-kdc:464 (kpasswd, namespace knoe-system)
#
# Usage:
#   make k3d-knoe-pf          # foreground; ^C to stop
#   make k3d-knoe-pf &        # background (for scripts)
#
# Prerequisites: kubectl, k3d cluster running (make k3d-knoe-up)

set -euo pipefail

CLUSTER_NAME="${K3D_CLUSTER_NAME:-k3d-knoe}"
CTX="k3d-${CLUSTER_NAME}"
DB_NS="knoe-db-0"
SYS_NS="knoe-system"

log() { echo "[k3d-knoe-pf] $*"; }

kube() { kubectl --context="$CTX" "$@"; }

# ── Verify cluster is reachable ───────────────────────────────────────────────

if ! kube cluster-info >/dev/null 2>&1; then
  echo "[k3d-knoe-pf] ERROR: Cannot reach cluster context '$CTX'." >&2
  echo "  Run: make k3d-knoe-up" >&2
  exit 1
fi

# ── Retrieve DB password for display ─────────────────────────────────────────

DB_PASSWORD=$(kube -n "$DB_NS" get secret knoe-db-user \
  -o jsonpath='{.data.password}' 2>/dev/null | base64 -d 2>/dev/null || echo "knoe-dev-password")

# ── Print connection info ─────────────────────────────────────────────────────

echo ""
echo "┌─────────────────────────────────────────────────────────────────┐"
echo "│  k3d-knoe port-forwards                                         │"
echo "├─────────────────────────────────────────────────────────────────┤"
echo "│  DB:      localhost:5432  (CNPG primary, knoe-db-0)             │"
echo "│  KDC:     localhost:88    (Kerberos KDC, knoe-system)           │"
echo "│  kpasswd: localhost:464   (kpasswd, knoe-system)                │"
echo "├─────────────────────────────────────────────────────────────────┤"
echo "│  JDBC URL:                                                       │"
echo "│    jdbc:postgresql://localhost:5432/knoe-db?sslmode=require     │"
echo "│                                                                  │"
echo "│  Export these before running knoe-auth:                         │"
echo "│    export KRB5_CONFIG=\$PWD/etc/krb5.local.conf                  │"
echo "│    export KNOE_DB_PASSWORD=${DB_PASSWORD}                       │"
echo "│    export SPRING_DATASOURCE_URL=jdbc:postgresql://localhost:5432/knoe-db?sslmode=require │"
echo "│    export SPRING_DATASOURCE_USERNAME=knoe                       │"
echo "│    export SPRING_DATASOURCE_PASSWORD=${DB_PASSWORD}             │"
echo "│    # Phase 2 OIDC signing key (from etc/gen_oidc_signing_key.sh):│"
echo "│    export KNOE_AUTH_OIDC_SIGNING_KEY=\$(cat etc/secrets/knoe-auth-oidc-key.b64)│"
echo "├─────────────────────────────────────────────────────────────────┤"
echo "│  Run knoe-auth with the k3d profile (enables OIDC + dev defaults):│"
echo "│    mvn -pl authority spring-boot:run \\                          │"
echo "│      -Dspring-boot.run.jvmArguments=\"-Djava.security.krb5.conf=\$PWD/etc/krb5.local.conf\" \\│"
echo "│      -Dspring-boot.run.profiles=k3d                             │"
echo "├─────────────────────────────────────────────────────────────────┤"
echo "│  Phase 2 OIDC endpoints (after knoe-auth is up):                │"
echo "│    GET  http://localhost:8080/.well-known/openid-configuration  │"
echo "│    GET  http://localhost:8080/jwks.json                         │"
echo "│    POST http://localhost:8080/token                             │"
echo "├─────────────────────────────────────────────────────────────────┤"
echo "│  Press ^C to stop all port-forwards                             │"
echo "└─────────────────────────────────────────────────────────────────┘"
echo ""

# ── Start port-forwards ───────────────────────────────────────────────────────

PF_PIDS=()

cleanup() {
  log "Stopping port-forwards..."
  for pid in "${PF_PIDS[@]:-}"; do
    kill "$pid" 2>/dev/null || true
  done
  log "Done."
}
trap cleanup EXIT INT TERM

log "Starting port-forward: localhost:5432 → knoe-db-rw:5432 (knoe-db-0)..."
kube -n "$DB_NS" port-forward service/knoe-db-rw 5432:5432 &
PF_PIDS+=($!)

# Brief pause so the DB forward is established before KDC
sleep 1

log "Starting port-forward: localhost:88 → knoe-kdc:88 (knoe-system)..."
kube -n "$SYS_NS" port-forward service/knoe-kdc 88:88 &
PF_PIDS+=($!)

log "Starting port-forward: localhost:464 → knoe-kdc:464 (knoe-system)..."
kube -n "$SYS_NS" port-forward service/knoe-kdc 464:464 &
PF_PIDS+=($!)

log "All port-forwards running. Waiting (^C to stop)..."
wait