#!/usr/bin/env bash
set -euo pipefail

# TB-006 batch 3: app-side auth so Authentik is not a second login screen.
# Run on valhalla after setup-batch1-oidc.py prints client_id/secret values.
#
# Requires OWNCLOUD_OIDC_* in owncloud stack.env and OAUTH_* in resume stack.env.

OWNCLOUD_ENV="${OWNCLOUD_ENV:-/tmp/owncloud-stack.env}"
RESUME_ENV="${RESUME_ENV:-/tmp/resume-stack.env}"

read_env() {
  local file="$1" key="$2"
  grep -E "^${key}=" "$file" | head -1 | cut -d= -f2-
}

echo "=== FreshRSS: switch to HTTP auth (Remote-User from Authentik via Caddy) ==="
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
docker cp "$SCRIPT_DIR/patch-freshrss-http-auth.php" freshrss:/tmp/patch-freshrss-http-auth.php
docker exec freshrss php /tmp/patch-freshrss-http-auth.php
docker exec freshrss grep -E "auth_type|http_auth_auto_register" /var/www/FreshRSS/data/config.php

echo "=== ownCloud: write oidc.config.php ==="
OC_ID="$(read_env "$OWNCLOUD_ENV" OWNCLOUD_OIDC_CLIENT_ID)"
OC_SECRET="$(read_env "$OWNCLOUD_ENV" OWNCLOUD_OIDC_CLIENT_SECRET)"
if [[ -z "$OC_ID" || -z "$OC_SECRET" ]]; then
  echo "ERROR: set OWNCLOUD_OIDC_CLIENT_ID/SECRET in owncloud stack.env first" >&2
  exit 1
fi

TMP_OC="$(mktemp)"
cat >"$TMP_OC" <<PHP
<?php
\$CONFIG = [
  'http.cookie.samesite' => 'None',
  'openid-connect' => [
    'provider-url' => 'https://auth.ginnoir.com/application/o/owncloud/',
    'client-id' => '${OC_ID}',
    'client-secret' => '${OC_SECRET}',
    'loginButtonName' => 'Log in with Authentik',
    'mode' => 'userid',
    'search-attribute' => 'preferred_username',
    'autoRedirectOnLoginPage' => true,
  ],
];
PHP
docker cp "$TMP_OC" owncloud_server:/mnt/data/config/oidc.config.php
rm -f "$TMP_OC"
echo "  wrote /mnt/data/config/oidc.config.php"
docker exec owncloud_server occ app:enable openidconnect >/dev/null 2>&1 || true
echo "  owncloud openidconnect enabled"

echo "=== done — recreate resume container after stack.env OAuth vars are set ==="
if grep -q '^OAUTH_CLIENT_ID=' "$RESUME_ENV" 2>/dev/null; then
  echo "  resume stack.env has OAUTH_CLIENT_ID (Portainer redeploy or recreate app container)"
else
  echo "  WARN: add OAUTH_* vars to resume stack.env and redeploy the resume stack"
fi