"""Update proxy providers for forward_auth apps (batches 1–3)."""
from authentik.core.models import Application
from authentik.flows.models import Flow
from authentik.outposts.models import Outpost, OutpostType
from authentik.providers.proxy.models import ProxyMode, ProxyProvider

AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")

UPTIME_UNAUTH = """^/status/.*
^/assets/.*
^/api/push/.*
^/api/badge/.*
^/api/status-page/heartbeat/.*
^/icon.svg
^/upload/.*"""

# Proxy-only sites (native OIDC apps managed by setup-batch1-oidc.py).
SITES = [
    # Batch 1 — admin
    ("homelab-code", "code", "code-server", "https://code.ginnoir.com", None, None),
    ("homelab-registry-ui", "registry-ui", "Registry UI", "https://registry-ui.ginnoir.com", None, None),
    ("homelab-vault", "vault", "Vault", "https://vault.ginnoir.com", None, None),
    ("homelab-uptime", "uptime", "Uptime Kuma", "https://uptime.ginnoir.com", "http://uptime-kuma:3001", UPTIME_UNAUTH),
    ("homelab-backup", "backup", "Kopia", "https://backup.ginnoir.com", None, None),
    ("homelab-dbx", "dbx", "DBX", "https://dbx.ginnoir.com", None, None),
    ("homelab-plane", "plane", "Plane", "https://plane.ginnoir.com", None, None),
    # Batch 2 — media
    ("homelab-sonarr", "sonarr", "Sonarr", "https://sonarr.ginnoir.com", None, None),
    ("homelab-radarr", "radarr", "Radarr", "https://radarr.ginnoir.com", None, None),
    ("homelab-bazarr", "bazarr", "Bazarr", "https://bazarr.ginnoir.com", None, None),
    ("homelab-prowlarr", "prowlarr", "Prowlarr", "https://prowlarr.ginnoir.com", None, None),
    ("homelab-tautulli", "tautulli", "Tautulli", "https://tautulli.ginnoir.com", None, None),
    ("homelab-qbit", "qbit", "qBittorrent", "https://qbittorrent.ginnoir.com", None, None),
    ("homelab-deluge", "deluge", "Deluge", "https://deluge.ginnoir.com", None, None),
    ("homelab-nzbget", "nzbget", "NZBGet", "https://nzbget.ginnoir.com", None, None),
    ("homelab-whisparr", "whisparr", "Whisparr", "https://whisparr.ginnoir.com", None, None),
    ("homelab-stash", "stash", "Stash", "https://stash.ginnoir.com", None, None),
]

providers = []
for pname, slug, aname, host, internal, unauth in SITES:
    defaults = {
        "mode": ProxyMode.FORWARD_SINGLE,
        "external_host": host,
        "authorization_flow": AUTHZ,
        "invalidation_flow": INVALID,
        "intercept_header_auth": True,
    }
    if internal:
        defaults["internal_host"] = internal
    if unauth:
        defaults["skip_path_regex"] = unauth

    provider, _ = ProxyProvider.objects.update_or_create(name=pname, defaults=defaults)
    Application.objects.update_or_create(
        slug=slug,
        defaults={
            "name": aname,
            "provider": provider,
            "meta_launch_url": host,
            "policy_engine_mode": "any",
        },
    )
    providers.append(provider)
    print(f"ok {slug} -> {host}")

outpost = Outpost.objects.get(name="authentik Embedded Outpost")
outpost.type = OutpostType.PROXY
outpost.providers.set(providers)
outpost.save()
print(f"outpost providers: {outpost.providers.count()}")