#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — print-keycloak-requirements.sh
# -----------------------------------------------------------------------------
# Mencetak KEBUTUHAN Keycloak (nilai konkret dari .env) untuk diserahkan ke
# administrator Keycloak — pasangan dari docs/keycloak-existing-requirements.md.
#
# Read-only: tidak mengubah apa pun; hanya menampilkan.
#
# Usage:
#   ./scripts/print-keycloak-requirements.sh
#   ./scripts/print-keycloak-requirements.sh --env-file generated/host-control/.env
#   ./scripts/print-keycloak-requirements.sh --mask      # sembunyikan client secret
#
# Keluaran bisa disalin ke tiket/email ke pengelola Keycloak.
# =============================================================================
set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
# shellcheck source=../config/environment.defaults.sh
source "${SCRIPT_DIR}/config/environment.defaults.sh"

MASK=0
ARGS=()
for _a in "$@"; do
  case "${_a}" in
    --mask) MASK=1 ;;
    *) ARGS+=("${_a}") ;;
  esac
done
sicabe_load_env "${SCRIPT_DIR}" "${ARGS[@]}"

REALM="${SICABE_REALM:-sicabe}"
KC_PUB="${KEYCLOAK_PUBLIC_URL:-http://localhost:${KEYCLOAK_PORT:-12080}}"
SSL_REQ="${KEYCLOAK_SSL_REQUIRED:-external}"
SR_HTTP_PORT="${STARROCKS_HTTP_PORT:-12030}"

# Tampilkan secret: nilai asli, atau '********' bila --mask.
show_secret() { # <value> <dev-default>
  local v="${1:-}" d="${2:-}"
  if [[ -z "${v}" ]]; then echo "(KOSONG!)"; return; fi
  if [[ "${MASK}" == "1" ]]; then echo "********"; return; fi
  if [[ "${v}" == "${d}" ]]; then echo "${v}   ← DEFAULT DEV, ganti di produksi"; else echo "${v}"; fi
}

printf '%s\n' "================================================================================"
printf '%s\n' " KEBUTUHAN KEYCLOAK (existing) — dari: ${SICABE_ENV_FILE:-${SCRIPT_DIR}/.env}"
printf '%s\n' "================================================================================"
printf ' Realm              : %s\n' "${REALM}"
printf ' Issuer             : %s/realms/%s\n' "${KC_PUB}" "${REALM}"
printf ' sslRequired        : %s   (external bila ada TLS; none utk http lokal)\n' "${SSL_REQ}"
printf '\n'
printf '%s\n' " Realm roles        : admin  engineer  analyst  viewer"
printf '%s\n' " Users (opsional)   : admin  engineer  analyst  viewer"
printf '%s\n' "                      (atau petakan user organisasi ke 4 role di atas)"
printf '\n'
printf '%s\n' " OIDC clients — SEMUA: type=OpenID Connect, client authentication ON,"
printf '%s\n' "               Standard flow ON, Service accounts ON (publicClient=false)"
printf '\n'
printf '   %-13s %-34s %s\n' "clientId" "client secret (harus sama)" "redirect URI"
printf '   %-13s %-34s %s\n' "------------" "---------------------------" "--------------------------"
printf '   %-13s %-34s %s/*\n' "trino"        "$(show_secret "${TRINO_CLIENT_SECRET:-}" "trino-secret")"        "${TRINO_PUBLIC_URL:-}"
printf '   %-13s %-34s %s\n'   "starrocks"    "$(show_secret "${STARROCKS_CLIENT_SECRET:-}" "starrocks-secret")" "http://<host-starrocks>:${SR_HTTP_PORT}/api/oauth2"
printf '   %-13s %-34s %s/*\n' "airflow"      "$(show_secret "${AIRFLOW_CLIENT_SECRET:-}" "airflow-secret")"      "${AIRFLOW_PUBLIC_URL:-}"
printf '   %-13s %-34s %s/*\n' "openmetadata" "$(show_secret "${OPENMETADATA_CLIENT_SECRET:-}" "om-secret")"   "${OPENMETADATA_PUBLIC_URL:-}"
printf '   %-13s %-34s %s/*\n' "grafana"      "$(show_secret "${GRAFANA_CLIENT_SECRET:-}" "grafana-secret")"    "${GRAFANA_PUBLIC_URL:-}"
printf '\n'
printf '%s\n' "   Semua client juga sertakan: http://localhost:* dan https://localhost:*"
printf '\n'
printf '%s\n' " Protocol mapper (WAJIB tiap client): Audience 'account' (oidc-audience-mapper)"
printf '%s\n' "   → Tanpa ini Trino MENOLAK token (Trino memverifikasi aud=account)."
printf '%s\n' " StarRocks: tambahan audience 'starrocks' (required_audience=starrocks)."
printf '\n'
printf '%s\n' " Kembalikan ke SiCABE: nama realm, issuer URL, dan 5 client secret di atas."
if [[ "${MASK}" == "0" ]]; then
  printf '\n'
  printf '%s\n' " ⚠ KELUARAN MEMUAT SECRET — kirim lewat kanal aman; jangan tempel di tiket publik."
fi
printf '%s\n' "================================================================================"