#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — print-openldap-requirements.sh
# -----------------------------------------------------------------------------
# Mencetak KEBUTUHAN OpenLDAP (nilai konkret dari .env) untuk diserahkan ke
# administrator LDAP — pasangan dari docs/openldap-existing-requirements.md.
#
# Read-only: hanya menampilkan.
#
# Usage:
#   ./scripts/print-openldap-requirements.sh
#   ./scripts/print-openldap-requirements.sh --env-file generated/host-control/.env
#   ./scripts/print-openldap-requirements.sh --mask      # sembunyikan bind password
# =============================================================================
set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
# shellcheck source=../config/environment.defaults.sh
source "${SCRIPT_DIR}/config/environment.defaults.sh"

MASK=0
ARGS=()
for _a in "$@"; do
  case "${_a}" in
    --mask) MASK=1 ;;
    *) ARGS+=("${_a}") ;;
  esac
done
sicabe_load_env "${SCRIPT_DIR}" "${ARGS[@]}"

BASE_DN="${LDAP_BASE_DN:-dc=sicabe,dc=local}"
USERS_DN="${LDAP_USERS_DN:-ou=users,${BASE_DN}}"
GROUPS_DN="${LDAP_GROUPS_DN:-ou=groups,${BASE_DN}}"
BIND_DN="${LDAP_ADMIN_DN:-cn=admin,${BASE_DN}}"
LDAP_URL="${LDAP_URL:-ldap://openldap:389}"
LDAP_HOST="${LDAP_HOST:-localhost}"
LDAP_PORT="${LDAP_PORT:-389}"

show_secret() { # <value> <dev-default>
  local v="${1:-}" d="${2:-}"
  if [[ -z "${v}" ]]; then echo "(KOSONG!)"; return; fi
  if [[ "${MASK}" == "1" ]]; then echo "********"; return; fi
  if [[ "${v}" == "${d}" ]]; then echo "${v}   ← DEFAULT DEV, ganti di produksi"; else echo "${v}"; fi
}

printf '%s\n' "================================================================================"
printf '%s\n' " KEBUTUHAN OPENLDAP (existing) — dari: ${SICABE_ENV_FILE:-${SCRIPT_DIR}/.env}"
printf '%s\n' "================================================================================"
printf '%s\n' " Peran LDAP di SiCABE = SUMBER GRUP (bukan autentikasi; auth = Keycloak OIDC)."
printf '\n'
printf ' URL (dari container) : %s\n' "${LDAP_URL}"
printf ' host:port (dari host): %s:%s\n' "${LDAP_HOST}" "${LDAP_PORT}"
printf '\n'
printf ' Base DN              : %s\n' "${BASE_DN}"
printf ' OU users             : %s\n' "${USERS_DN}"
printf ' OU groups            : %s\n' "${GROUPS_DN}"
printf '\n'
printf ' Akun BIND (buat baca) : %s\n' "${BIND_DN}"
printf '   → boleh akun READ-ONLY, bukan harus admin.\n'
printf ' password              : %s\n' "$(show_secret "${LDAP_ADMIN_PASSWORD:-}" "ldap_admin_DevOnly")"
printf '\n'
printf '%s\n' " Grup (WAJIB, objectClass=groupOfNames, atribut cn + member=DN user):"
printf '%s\n' "   data-admin   data-engineer   data-analyst   data-viewer"
printf '%s\n' "   → nama ini HARUS sama dengan kunci roles di config/opa/data.json"
printf '%s\n' "     DAN permitted_groups StarRocks."
printf '\n'
printf '%s\n' " User (objectClass inetOrgPerson + posixAccount):"
printf '%s\n' "   uid  HARUS = username Keycloak (preferred_username)  ← krusial"
printf '%s\n' "   atribut minimal: uid, cn, sn, mail, uidNumber, gidNumber, homeDirectory"
printf '\n'
printf '%s\n' " Kembalikan ke SiCABE: LDAP_URL, host:port, bind DN + password, base DN/OU,"
printf '%s\n' " dan konfirmasi bahwa uid user = username Keycloak & keanggotaan grup benar."
if [[ "${MASK}" == "0" ]]; then
  printf '\n'
  printf '%s\n' " ⚠ KELUARAN MEMUAT PASSWORD — kirim lewat kanal aman; jangan tempel di tiket publik."
fi
printf '%s\n' "================================================================================"