#!/usr/bin/env python3
"""Idempotently register the user-engine portal in the live KeyCape Secret.

The complete Secret travels over stdin/stdout between kubectl and this
process. Secret values are never printed to the terminal or written to disk.
"""

from __future__ import annotations

import base64
import json
import sys

import yaml

CLIENT_ID = "user-engine-portal"
CLIENT = {
    "clientId": CLIENT_ID,
    "displayName": "User Engine Portal",
    "redirectUris": ["https://users.92-205-62-239.nip.io/oidc/callback"],
    "allowedScopes": ["openid", "profile", "email", "groups"],
    "grantTypes": ["authorization_code"],
    "clientType": "public",
}


def main() -> None:
    secret = json.load(sys.stdin)
    encoded = secret.get("data", {}).get("config.yaml")
    if not encoded:
        raise SystemExit("keycape-config does not contain config.yaml")
    config = yaml.safe_load(base64.b64decode(encoded))
    clients = config.setdefault("clients", [])
    existing = next(
        (index for index, client in enumerate(clients) if client.get("clientId") == CLIENT_ID),
        None,
    )
    if existing is None:
        clients.append(CLIENT)
    else:
        clients[existing] = CLIENT
    rendered = yaml.safe_dump(config, sort_keys=False).encode()
    secret["data"]["config.yaml"] = base64.b64encode(rendered).decode()
    secret.pop("status", None)
    metadata = secret.get("metadata", {})
    for key in ("creationTimestamp", "managedFields", "resourceVersion", "uid"):
        metadata.pop(key, None)
    json.dump(secret, sys.stdout, separators=(",", ":"))


if __name__ == "__main__":
    main()