"""Configure Portainer OAuth via API (run on valhalla with admin JWT)."""
import json
import sys
import urllib.error
import urllib.request

JWT = sys.argv[1] if len(sys.argv) > 1 else ""
CLIENT_ID = sys.argv[2] if len(sys.argv) > 2 else ""
CLIENT_SECRET = sys.argv[3] if len(sys.argv) > 3 else ""
if not JWT or not CLIENT_ID or not CLIENT_SECRET:
    print("usage: configure-portainer-oauth.py <admin_jwt> <client_id> <client_secret>")
    sys.exit(1)

BASE = "http://localhost:9100/api"
AUTH = "https://auth.ginnoir.com/application/o"

payload = {
    "AuthenticationMethod": 3,
    "OAuthSettings": {
        "ClientID": CLIENT_ID,
        "ClientSecret": CLIENT_SECRET,
        "AuthorizationURI": f"{AUTH}/authorize/",
        "AccessTokenURI": f"{AUTH}/token/",
        "ResourceURI": f"{AUTH}/userinfo/",
        "RedirectURI": "https://portainer.ginnoir.com/",
        "LogoutURI": f"{AUTH}/portainer/end-session/",
        "UserIdentifier": "email",
        "Scopes": "openid email profile",
        "OAuthAutoCreateUsers": True,
        "DefaultTeamID": 0,
    },
}

req = urllib.request.Request(
    f"{BASE}/settings",
    data=json.dumps(payload).encode(),
    headers={"Authorization": f"Bearer {JWT}", "Content-Type": "application/json"},
    method="PUT",
)
try:
    with urllib.request.urlopen(req) as resp:
        print("portainer oauth configured:", resp.status)
except urllib.error.HTTPError as e:
    print("error:", e.code, e.read().decode())
    sys.exit(1)