#!/usr/bin/env bash
# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
# ZITADEL.
#
# Forgejo stores login sources in its database, not in GitOps, and its REST API
# does not expose them. `tea` has no auth-source command either (tea admin only
# manages users), so the supported writer is the in-pod CLI:
#   gitea admin auth update-oauth
#
# The source name is the label on the "Sign in with ..." button AND the callback
# path (/user/oauth2/<name>/callback), so a rename changes the registered
# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
# before renaming.
#
# Usage:
#   scripts/iam/forgejo-oauth-source.sh status
#   scripts/iam/forgejo-oauth-source.sh rename zitadel
set -euo pipefail

NS="${FORGEJO_NAMESPACE:-cicd}"
SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"

pod() {
  kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
    || kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
}

run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }

case "${1:-status}" in
  status) run list ;;
  rename)
    name="${2:?usage: $0 rename <name>}"
    run update-oauth --id 1 --name "$name"
    run list
    ;;
  *) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
esac