#!/usr/bin/env bash
set -euo pipefail

log() { echo "[vault-oidc] $*"; }

status_json="$(vault status -format=json || true)"
if [[ -z "${status_json}" ]]; then
  log "vault status failed; check VAULT_ADDR and VAULT_TOKEN"
  exit 1
fi

if ! grep -q '"initialized":true' <<<"${status_json}"; then
  log "vault not initialized; skipping"
  exit 0
fi

if grep -q '"sealed":true' <<<"${status_json}"; then
  log "vault sealed; skipping"
  exit 0
fi

: "${VAULT_OIDC_DISCOVERY_URL:?set VAULT_OIDC_DISCOVERY_URL}"
: "${VAULT_OIDC_CLIENT_ID:?set VAULT_OIDC_CLIENT_ID}"
: "${VAULT_OIDC_CLIENT_SECRET:?set VAULT_OIDC_CLIENT_SECRET}"

role="${VAULT_OIDC_DEFAULT_ROLE:-atlas}"
scopes="${VAULT_OIDC_SCOPES:-openid profile email groups}"
user_claim="${VAULT_OIDC_USER_CLAIM:-preferred_username}"
groups_claim="${VAULT_OIDC_GROUPS_CLAIM:-groups}"
token_policies="${VAULT_OIDC_TOKEN_POLICIES:-default}"
redirect_uris="${VAULT_OIDC_REDIRECT_URIS:-https://secret.bstein.dev/ui/vault/auth/oidc/oidc/callback}"
bound_audiences="${VAULT_OIDC_BOUND_AUDIENCES:-${VAULT_OIDC_CLIENT_ID}}"
bound_claims="${VAULT_OIDC_BOUND_CLAIMS:-}"
bound_claims_type="${VAULT_OIDC_BOUND_CLAIMS_TYPE:-}"

if ! vault auth list -format=json | grep -q '"oidc/"'; then
  log "enabling oidc auth method"
  vault auth enable oidc
fi

log "configuring oidc auth"
vault write auth/oidc/config \
  oidc_discovery_url="${VAULT_OIDC_DISCOVERY_URL}" \
  oidc_client_id="${VAULT_OIDC_CLIENT_ID}" \
  oidc_client_secret="${VAULT_OIDC_CLIENT_SECRET}" \
  default_role="${role}"

vault auth tune -listing-visibility=unauth oidc >/dev/null

role_args=(
  "user_claim=${user_claim}"
  "oidc_scopes=${scopes}"
  "token_policies=${token_policies}"
  "bound_audiences=${bound_audiences}"
)

if [[ -n "${groups_claim}" ]]; then
  role_args+=("groups_claim=${groups_claim}")
fi
if [[ -n "${bound_claims}" ]]; then
  role_args+=("bound_claims=${bound_claims}")
fi
if [[ -n "${bound_claims_type}" ]]; then
  role_args+=("bound_claims_type=${bound_claims_type}")
fi

IFS=',' read -r -a redirect_items <<<"${redirect_uris}"
for uri in "${redirect_items[@]}"; do
  trimmed="${uri#"${uri%%[![:space:]]*}"}"
  trimmed="${trimmed%"${trimmed##*[![:space:]]}"}"
  if [[ -n "${trimmed}" ]]; then
    role_args+=("allowed_redirect_uris=${trimmed}")
  fi
done

log "configuring oidc role ${role}"
vault write "auth/oidc/role/${role}" "${role_args[@]}"