#!/usr/bin/env bash
# Configure Railiance OpenBao to trust KeyCape for platform-admin OIDC login.
# The OpenBao token is prompted inside the pod TTY and is never placed on the
# local command line or stored by this script.

set -euo pipefail

KUBECTL="${KUBECTL:-kubectl}"
OPENBAO_NAMESPACE="${OPENBAO_NAMESPACE:-openbao}"
OPENBAO_POD="${OPENBAO_POD:-openbao-0}"

"$KUBECTL" exec -it -n "$OPENBAO_NAMESPACE" "$OPENBAO_POD" -- sh -lc '
  set -eu

  restore_tty() { stty echo 2>/dev/null || true; }
  trap restore_tty EXIT INT TERM

  printf "OpenBao root/sudo token: " >&2
  stty -echo
  read -r BAO_TOKEN
  stty echo
  printf "\n" >&2
  export BAO_TOKEN

  # OpenBao requires oidc_client_secret for OIDC auth config. The current
  # KeyCape openbao-admin profile is public PKCE and does not validate this
  # downstream client-secret field, so this compatibility value is not a
  # protected secret. Replace this with a real managed client secret when
  # KeyCape supports confidential downstream clients.
  OPENBAO_OIDC_MOUNTS="netkingdom keycape"

  # The platform-admin role (policies, callbacks, bound claims) is owned and
  # declared by railiance-platform at
  # openbao/auth/netkingdom-platform-admin-role.json. This script never writes
  # the role: it configures the OIDC mount and requires the declared role to
  # exist. Additional allowances belong in that central declaration.
  for mount in $OPENBAO_OIDC_MOUNTS; do
    bao auth enable -path="$mount" oidc >/tmp/openbao-${mount}-auth-enable.out 2>/tmp/openbao-${mount}-auth-enable.err || {
      if grep -q "path is already in use" /tmp/openbao-${mount}-auth-enable.err; then
        printf "auth/%s already exists\n" "$mount" >&2
      else
        cat /tmp/openbao-${mount}-auth-enable.err >&2
        exit 1
      fi
    }

    bao write "auth/${mount}/config" \
      oidc_discovery_url="https://kc.coulomb.social" \
      oidc_client_id="openbao-admin" \
      oidc_client_secret="keycape-public-pkce-compatibility-value" \
      default_role="platform-admin"

    if ! bao read "auth/${mount}/role/platform-admin" >/dev/null 2>&1; then
      printf "auth/%s/role/platform-admin is missing; apply the railiance-platform declaration (openbao/auth/netkingdom-platform-admin-role.json)\n" "$mount" >&2
      exit 1
    fi
    bao write "sys/auth/${mount}/tune" listing_visibility=unauth
    printf "configured auth/%s (role preserved) and listing_visibility=unauth\n" "$mount" >&2
  done

  rm -f /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err
  unset BAO_TOKEN
'