#!/bin/bash
set -euo pipefail
[ -z "${OIDC_CLIENT_ID:-}" ] && exit 0
echo "Waiting for Forgejo API..."
for i in $(seq 1 120); do
  curl -sf http://127.0.0.1:$SERVICE_PORT_HTTP/api/v1/settings/api >/dev/null 2>&1 && break
  sleep 5
done

# The OIDC discovery URL (e.g. https://auth.internal:8443/...) must be
# reachable from inside the forgejo container with valid TLS.
#
# Two issues to fix:
# 1. `.internal` isn't a real DNS zone — inject the auth domain → caddy
#    IP mapping into the container's /etc/hosts.
# 2. Caddy uses a self-signed CA — inject the CA cert so the Forgejo CLI
#    trusts it during OIDC discovery.
AUTH_HOST=$(echo "$OIDC_DISCOVERY_URL" | sed 's|https\?://||; s|[:/].*||')
CADDY_IP=$(podman inspect caddy --format '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' 2>/dev/null | awk '{print $1}')
CADDY_CA="$(dirname "$SERVICE_HOME")/caddy-root-ca.crt"

if [ -n "$CADDY_IP" ] && [ -n "$AUTH_HOST" ]; then
  podman exec forgejo sh -c "echo '$CADDY_IP $AUTH_HOST' >> /etc/hosts" 2>/dev/null || true
fi
if [ -f "$CADDY_CA" ]; then
  podman cp "$CADDY_CA" forgejo:/tmp/caddy-ca.crt 2>/dev/null || true
  podman exec forgejo sh -c "cat /tmp/caddy-ca.crt >> /etc/ssl/certs/ca-certificates.crt" 2>/dev/null || true
fi

# Upsert the auth source. `forgejo admin auth add-oauth` always creates a
# new row, so a naïve add on every container start would accumulate
# duplicate "Authelia" entries. List existing sources, find the one named
# "Authelia", and route to update-oauth (with --id) when it already exists.
#
# `auth list` prints a tab/space-padded table: ID, Name, Type, Enabled.
# `awk -F'\t'` and a literal "Authelia" Name match keeps the parser
# tolerant to padding tweaks across forgejo versions.
#
# Exit 0 intentionally: ExecStartPost failure would cause systemd to
# kill the service. Log the error for debugging instead.
EXISTING_ID=$(podman exec -u git forgejo forgejo admin auth list 2>/dev/null \
  | awk -F'\t' 'NR>1 && $2=="Authelia" {print $1; exit}')

if [ -n "${EXISTING_ID:-}" ]; then
  echo "Updating OIDC provider (id=$EXISTING_ID)..."
  podman exec -u git forgejo forgejo admin auth update-oauth \
    --id "$EXISTING_ID" \
    --name "Authelia" \
    --provider "openidConnect" \
    --key "$OIDC_CLIENT_ID" \
    --secret "$OIDC_CLIENT_SECRET" \
    --auto-discover-url "$OIDC_DISCOVERY_URL" \
    --custom-auth-url "$OIDC_AUTH_URL" \
    --custom-token-url "$OIDC_TOKEN_URL" \
    --custom-profile-url "$OIDC_PROFILE_URL" \
    --scopes "openid email profile" 2>&1 || echo "OIDC update failed (will retry on next restart)"
else
  echo "Registering OIDC provider..."
  podman exec -u git forgejo forgejo admin auth add-oauth \
    --name "Authelia" \
    --provider "openidConnect" \
    --key "$OIDC_CLIENT_ID" \
    --secret "$OIDC_CLIENT_SECRET" \
    --auto-discover-url "$OIDC_DISCOVERY_URL" \
    --custom-auth-url "$OIDC_AUTH_URL" \
    --custom-token-url "$OIDC_TOKEN_URL" \
    --custom-profile-url "$OIDC_PROFILE_URL" \
    --scopes "openid email profile" 2>&1 || echo "OIDC registration failed (will retry on next restart)"
fi
