#!/usr/bin/env bash
# Configure OpenBao as an OpenID Connect provider for the expense tracker and store the
# resulting client credentials + CA certificate in the KV secret the chart reads.
#
#   export BAO_ADDR=https://192.168.2.218:30200 BAO_SKIP_VERIFY=true BAO_TOKEN=<admin token>
#   scripts/openbao-oidc.sh
#
# Prerequisites: `bao` and `kubectl` on PATH; the KV secret secret/expense-tracker/app
# already exists (see README step 1). Afterwards enable it: `auth.openbao.enabled: true`.
#
# NOTE: written against the OpenBao OIDC provider API docs; not run against a live server
# from the machine that authored it - check the output of each step.
set -euo pipefail

NAME="${NAME:-expense-tracker}"
# scheme://host:port that both browser and pod can reach; the effective issuer becomes
# <ISSUER_ADDR>/v1/identity/oidc/provider/<NAME> and must equal auth.openbao.issuer in values.yaml
ISSUER_ADDR="${ISSUER_ADDR:-https://192.168.2.218:30200}"
REDIRECT_URI="${REDIRECT_URI:-https://budget.smokyzone.de:30444/auth/callback/openbao}"
KV_MOUNT="${KV_MOUNT:-secret}"
KV_PATH="${KV_PATH:-expense-tracker/app}"

echo "1/5 signing key"
bao write "identity/oidc/key/$NAME" allowed_client_ids="*" algorithm=RS256 rotation_period=24h verification_ttl=24h

echo "2/5 scope 'email' (claim comes from the entity's metadata)"
bao write identity/oidc/scope/email template='{"email": {{identity.entity.metadata.email}}}'

echo "3/5 client"
bao write "identity/oidc/client/$NAME" redirect_uris="$REDIRECT_URI" assignments="allow_all" \
  key="$NAME" id_token_ttl=30m access_token_ttl=1h
CLIENT_ID="$(bao read -field=client_id "identity/oidc/client/$NAME")"
CLIENT_SECRET="$(bao read -field=client_secret "identity/oidc/client/$NAME")"

echo "4/5 provider"
bao write "identity/oidc/provider/$NAME" issuer="$ISSUER_ADDR" allowed_client_ids="$CLIENT_ID" scopes_supported="email"

echo "5/5 store credentials + CA in $KV_MOUNT/$KV_PATH"
CA_FILE="$(mktemp)"; trap 'rm -f "$CA_FILE"' EXIT
kubectl -n openbao get secret openbao-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > "$CA_FILE"
[ -s "$CA_FILE" ] || { echo "could not read the CA from secret openbao/openbao-tls" >&2; exit 1; }
bao kv patch -mount="$KV_MOUNT" "$KV_PATH" \
  openbao_client_id="$CLIENT_ID" openbao_client_secret="$CLIENT_SECRET" openbao_ca_cert=@"$CA_FILE"

echo
echo "Issuer: $ISSUER_ADDR/v1/identity/oidc/provider/$NAME"
curl -sk "$ISSUER_ADDR/v1/identity/oidc/provider/$NAME/.well-known/openid-configuration" | head -c 300 || true
echo
cat <<MSG

Remaining manual steps
  * The person signing in needs an OpenBao *entity* whose metadata carries their email, e.g.
      bao write identity/entity name=<name> metadata=email=<address>
      bao write identity/entity-alias name=<login> canonical_id=<entity id> mount_accessor=<auth mount accessor>
    (or add metadata to the existing entity of the userpass/OIDC user you log in with).
  * Set auth.openbao.enabled=true in values.yaml, commit and push.
  * The address must also be listed in allowed_emails.
MSG