#!/usr/bin/env bash
# Obtains a kubeconfig for a socialweb-computer hosted tenant cluster.
#
# Sign-in is driven by socialweb-computer-kcp's oauth-signin.ts with the
# alice credential file. Credential values are read by that script, never
# by this one. The session cookie and the kubeconfig are written 0600 under
# ~/.tmp/knotless-runner-k8s/tenant.
#
# Environment:
#   CREDS       credential file (default ~/.aliceoa_bsky_social_source)
#   ACCOUNT     account prefix in CREDS (default ALICE)
#   GATEWAY     gateway origin (default https://k8s.socialweb.computer)
#   CLUSTER     cluster name, DNS label (default knotless-poc)
#   SWC_REPO    socialweb-computer-kcp checkout
#   CHROME      Chrome or Chromium binary
#   FORCE_SIGNIN=1  sign in again even if a cookie file exists
#   DELETE=1    delete the cluster instead and exit
set -euo pipefail

CREDS=${CREDS:-$HOME/.aliceoa_bsky_social_source}
ACCOUNT=${ACCOUNT:-ALICE}
GATEWAY=${GATEWAY:-https://k8s.socialweb.computer}
CLUSTER=${CLUSTER:-knotless-poc}
TENANT_TTL=${TENANT_TTL:-28800}
NO_CREATE=${NO_CREATE:-0}
SWC_REPO=${SWC_REPO:-/home/baptist777/src/socialweb-computer-kcp}
STATE_DIR=${STATE_DIR:-$HOME/.tmp/knotless-runner-k8s/tenant}
COOKIE=$STATE_DIR/cookies.json
KUBECONFIG=$STATE_DIR/$CLUSTER.kubeconfig.yaml
CREATE=$STATE_DIR/create.json
LIST=$STATE_DIR/clusters.json
GRANT=$STATE_DIR/kubeconfig.json

if [ ! -r "$CREDS" ]; then
  echo "tenant-kubeconfig: cannot read $CREDS" >&2
  exit 2
fi
mkdir -p "$STATE_DIR"
chmod 0700 "$STATE_DIR"

auth_header() {
  local token
  token=$(jq -r '.[] | select(.name == "swc_session") | .value' "$COOKIE" 2>/dev/null | head -1)
  if [ -z "$token" ] || [ "$token" = "null" ]; then
    echo "tenant-kubeconfig: no swc_session in $COOKIE; rerun with FORCE_SIGNIN=1" >&2
    exit 1
  fi
  printf 'Cookie: swc_session=%s' "$token"
}

api() {
  local path=$1 body=${2:-} out=$3
  local code
  code=$(curl -sS -o "$out" -w '%{http_code}' -X POST "$GATEWAY$path" \
    -H 'content-type: application/json' \
    -H "Origin: $GATEWAY" \
    -H "$(auth_header)" \
    --data "$body")
  if [ "$code" != 200 ]; then
    echo "tenant-kubeconfig: POST $path answered $code" >&2
    jq -r '.message // .error // .' "$out" >&2 2>/dev/null || cat "$out" >&2
    return 1
  fi
}

if [ ! -s "$COOKIE" ] || [ "${FORCE_SIGNIN:-0}" = 1 ]; then
  chrome=${CHROME:-}
  if [ -z "$chrome" ]; then
    for candidate in /usr/bin/google-chrome /usr/bin/chromium-browser /usr/bin/chromium; do
      if [ -x "$candidate" ]; then chrome=$candidate; break; fi
    done
  fi
  if [ -z "$chrome" ]; then
    echo "tenant-kubeconfig: no Chrome or Chromium found; set CHROME" >&2
    exit 2
  fi
  echo "tenant-kubeconfig: signing in $ACCOUNT at $GATEWAY" >&2
  deno run -A --no-lock "$SWC_REPO/scripts/oauth-signin.ts" \
    --creds "$CREDS" --account "$ACCOUNT" --url "$GATEWAY/" --start-api \
    --chrome "$chrome" --cookie-file "$COOKIE" >/dev/null
  chmod 0600 "$COOKIE"
fi

if [ "${DELETE:-0}" = 1 ]; then
  api /api/clusters/delete "{\"name\":\"$CLUSTER\"}" "$STATE_DIR/delete.json"
  echo "deleted tenant cluster $CLUSTER"
  exit 0
fi

if [ "$NO_CREATE" != 1 ]; then
  api /api/clusters/create "{\"name\":\"$CLUSTER\"}" "$CREATE"
fi
phase=$(jq -r '.phase // "Initializing"' "$CREATE" 2>/dev/null || echo Initializing)

for _ in $(seq 1 180); do
  api /api/clusters/list '{}' "$LIST"
  phase=$(jq -r --arg name "$CLUSTER" '.clusters[] | select(.name == $name) | .phase' "$LIST" | head -1)
  case "$phase" in
    Ready) break ;;
    Failed) echo "tenant-kubeconfig: cluster $CLUSTER failed" >&2; exit 1 ;;
    "") echo "tenant-kubeconfig: cluster $CLUSTER not listed yet" >&2 ;;
  esac
  sleep 5
done
if [ "$phase" != Ready ]; then
  echo "tenant-kubeconfig: cluster $CLUSTER is $phase after 15 minutes" >&2
  exit 1
fi

api /api/clusters/kubeconfig "{\"name\":\"$CLUSTER\",\"ttlSeconds\":$TENANT_TTL}" "$GRANT"
jq -r '.kubeconfig // empty' "$GRANT" > "$KUBECONFIG"
if [ ! -s "$KUBECONFIG" ]; then
  echo "tenant-kubeconfig: gateway returned no kubeconfig" >&2
  exit 1
fi
chmod 0600 "$KUBECONFIG"
printf '%s\n' "$KUBECONFIG"