#!/bin/sh
# Corregge due impostazioni che l'import di realm-export.json non copre (vedi CLAUDE.md):
# 1. il client-scope built-in "organization" (creato da Keycloak con organizationsEnabled:true,
#    non presente nel JSON) di default non include l'id dell'org nel claim JWT
# 2. il service account di scouthub-home-be non ha i client role di realm-management necessari
#    a operare sulla Admin API (organizations, users, roles)
#
# Idempotente: eseguibile ad ogni avvio senza effetti collaterali se già a posto.
set -eu

KEYCLOAK_URL="http://keycloak:8080"
REALM="scouthub"
SA_CLIENT_ID="scouthub-home-be"
REQUIRED_REALM_MANAGEMENT_ROLES="manage-organizations manage-users view-realm view-users"

echo "[keycloak-init] attendo che $KEYCLOAK_URL sia pronto..."
until curl -sf "$KEYCLOAK_URL/realms/master/.well-known/openid-configuration" >/dev/null 2>&1; do
  sleep 2
done

echo "[keycloak-init] attendo che il realm '$REALM' sia importato..."
until curl -sf "$KEYCLOAK_URL/realms/$REALM/.well-known/openid-configuration" >/dev/null 2>&1; do
  sleep 2
done

get_admin_token() {
  curl -sf -X POST "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" \
    -d "client_id=admin-cli" \
    -d "username=$KEYCLOAK_ADMIN" \
    -d "password=$KEYCLOAK_ADMIN_PASSWORD" \
    -d "grant_type=password" | jq -r '.access_token'
}

TOKEN="$(get_admin_token)"
if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
  echo "[keycloak-init] impossibile ottenere il token admin, esco." >&2
  exit 1
fi

auth_get() { curl -sf -H "Authorization: Bearer $TOKEN" "$KEYCLOAK_URL$1"; }

# --- 1. client-scope "organization": abilita addOrganizationId -------------------------------
SCOPE_ID="$(auth_get "/admin/realms/$REALM/client-scopes" | jq -r '.[] | select(.name=="organization") | .id')"

if [ -z "$SCOPE_ID" ]; then
  echo "[keycloak-init] client-scope 'organization' non trovato, salto." >&2
else
  MAPPER_JSON="$(auth_get "/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models" \
    | jq -c '.[] | select(.name=="organization")')"
  MAPPER_ID="$(echo "$MAPPER_JSON" | jq -r '.id')"
  ALREADY_SET="$(echo "$MAPPER_JSON" | jq -r '.config.addOrganizationId // "false"')"

  if [ "$ALREADY_SET" = "true" ]; then
    echo "[keycloak-init] mapper 'organization': addOrganizationId già attivo."
  else
    UPDATED_MAPPER="$(echo "$MAPPER_JSON" | jq '.config.addOrganizationId = "true"')"
    curl -sf -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
      "$KEYCLOAK_URL/admin/realms/$REALM/client-scopes/$SCOPE_ID/protocol-mappers/models/$MAPPER_ID" \
      -d "$UPDATED_MAPPER" >/dev/null
    echo "[keycloak-init] mapper 'organization': addOrganizationId attivato."
  fi
fi

# --- 2. service account di scouthub-home-be: ruoli realm-management ---------------------------
SA_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=$SA_CLIENT_ID" | jq -r '.[0].id')"
if [ -z "$SA_UUID" ] || [ "$SA_UUID" = "null" ]; then
  echo "[keycloak-init] client '$SA_CLIENT_ID' non trovato, salto." >&2
else
  SA_USER_ID="$(auth_get "/admin/realms/$REALM/clients/$SA_UUID/service-account-user" | jq -r '.id')"
  RM_UUID="$(auth_get "/admin/realms/$REALM/clients?clientId=realm-management" | jq -r '.[0].id')"

  GIA_ASSEGNATI="$(auth_get "/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" | jq -r '.[].name')"
  DISPONIBILI="$(auth_get "/admin/realms/$REALM/clients/$RM_UUID/roles")"

  DA_ASSEGNARE="[]"
  for ROLE in $REQUIRED_REALM_MANAGEMENT_ROLES; do
    if echo "$GIA_ASSEGNATI" | grep -qx "$ROLE"; then
      continue
    fi
    ROLE_REPR="$(echo "$DISPONIBILI" | jq -c --arg name "$ROLE" '.[] | select(.name==$name)')"
    if [ -z "$ROLE_REPR" ]; then
      echo "[keycloak-init] ruolo '$ROLE' non esiste su questa versione di Keycloak, salto." >&2
      continue
    fi
    DA_ASSEGNARE="$(echo "$DA_ASSEGNARE" | jq -c --argjson r "$ROLE_REPR" '. + [$r]')"
  done

  if [ "$(echo "$DA_ASSEGNARE" | jq 'length')" = "0" ]; then
    echo "[keycloak-init] service account '$SA_CLIENT_ID': ruoli realm-management già a posto."
  else
    curl -sf -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
      "$KEYCLOAK_URL/admin/realms/$REALM/users/$SA_USER_ID/role-mappings/clients/$RM_UUID" \
      -d "$DA_ASSEGNARE" >/dev/null
    echo "[keycloak-init] service account '$SA_CLIENT_ID': assegnati $(echo "$DA_ASSEGNARE" | jq -r '[.[].name] | join(", ")')."
  fi
fi

echo "[keycloak-init] completato."