"""Switch homarr from forward-auth proxy provider to native OIDC (run: ak shell -c exec(open(...).read()))."""
from authentik.core.models import Application
from authentik.flows.models import Flow
from authentik.outposts.models import Outpost
from authentik.providers.oauth2.models import OAuth2Provider, RedirectURI, RedirectURIMatchingMode
from authentik.providers.proxy.models import ProxyProvider

AUTHZ = Flow.objects.get(slug="default-provider-authorization-implicit-consent")
INVALID = Flow.objects.get(slug="default-provider-invalidation-flow")

REDIRECT = "https://homarr.ginnoir.com/api/auth/callback/oidc"

provider, created = OAuth2Provider.objects.update_or_create(
    name="homarr",
    defaults={
        "authorization_flow": AUTHZ,
        "invalidation_flow": INVALID,
        "redirect_uris": [
            RedirectURI(matching_mode=RedirectURIMatchingMode.STRICT, url=REDIRECT),
        ],
        "access_code_validity": "minutes=1",
        "access_token_validity": "hours=24",
        "refresh_token_validity": "days=30",
    },
)
# Required for Homarr profile parsing — without these, userinfo lacks name/email claims.
default_mappings = OAuth2Provider.objects.get(name="famapp").property_mappings.all()
provider.property_mappings.set(default_mappings)
provider.save()
print(f"oauth2 provider homarr created={created} client_id={provider.client_id}")

app = Application.objects.get(slug="homarr")
app.provider = provider
app.save()
print(f"application homarr -> OAuth2Provider homarr")

# Drop homarr from the embedded proxy outpost (native OIDC replaces forward_auth here).
try:
    proxy = ProxyProvider.objects.get(name="homelab-homarr")
    outpost = Outpost.objects.get(name="authentik Embedded Outpost")
    outpost.providers.remove(proxy)
    print("removed homelab-homarr from embedded outpost")
except ProxyProvider.DoesNotExist:
    print("homelab-homarr proxy provider not found (ok)")

print(f"AUTH_OIDC_CLIENT_ID={provider.client_id}")
print(f"AUTH_OIDC_CLIENT_SECRET={provider.client_secret}")