#!/usr/bin/env bash
# Register coulomb.social as a public KeyCape OIDC client (idempotent).
# Never prints Secret values.
set -euo pipefail

NAMESPACE="${KEYCAPE_NAMESPACE:-sso}"
SECRET="${KEYCAPE_CONFIG_SECRET:-keycape-config}"
KUBECTL="${KUBECTL:-kubectl}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

"$KUBECTL" get secret "$SECRET" -n "$NAMESPACE" -o json \
  | python3 "$SCRIPT_DIR/register-coulomb-social.py" \
  | "$KUBECTL" apply -f -

echo "Registered coulomb-social client in $NAMESPACE/$SECRET"

# KeyCape loads config at process start.
"$KUBECTL" -n "$NAMESPACE" rollout restart deploy/keycape
"$KUBECTL" -n "$NAMESPACE" rollout status deploy/keycape --timeout=120s
echo "KeyCape rolled out."