#!/usr/bin/env bash
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
#
# script to sync RBAC configuration from ./config/rbac to the Helm Chart.
#
# NOTE: this script only supports syncing the editor and viewer roles, the manager
# role etc, requires manual syncing
# requires yq (Go), not python-yq

set -e -o pipefail

REPO_ROOT="$(git rev-parse --show-toplevel || echo .)"
# yq should be in the PATH after running 'make yq'
export PATH="${REPO_ROOT?}/bin:$PATH"

tempdir=$(mktemp -d)
function cleanup {
  rm -rf "${tempdir}"
}
trap cleanup EXIT SIGINT

CHART_ROOT="${CHART_ROOT-$(readlink -f ${REPO_ROOT}/chart)}"

cp -a ${CHART_ROOT} ${tempdir}/.

CHART_TEMPLATE_ROOT="${CHART_ROOT?}/templates"
KUSTOMIZE_ROOT="${KUSTOMIZE_ROOT-$(readlink -f ${REPO_ROOT}/config)}"
RBAC_ROOT="${KUSTOMIZE_ROOT?}/rbac"

function mungeIt {
  local infile="${1}"
  local outfile="${2}"
  if ! [ -f ${infile} ]; then
    echo "${infile} does not exist'" >&2
    return 1
  fi

  local output="$(cat ${infile})"
  local apiVersion="$(echo "${output}" | yq .apiVersion)"
  local kind="$(echo "${output}" | yq .kind)"
  local metadataName="$(echo "${output}" | yq .metadata.name)"
  local rules="$(echo "${output}"| yq .rules)"

  local aggregate=
  local aggregateLabel=
  case "${metadataName}" in
    *-editor-role)
      aggregate='editor'
      ;;
    *-viewer-role)
      aggregate='viewer'
      ;;
  esac

  if [ -n "${aggregate}" ]; then
    aggregateLabel="vso.hashicorp.com/aggregate-to-${aggregate}: \"true\""
  fi

  cat <<HERE > ${outfile}
{{- /*
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1

# auto generated by ${0##*/} from .${infile#"$REPO_ROOT"} -- do not edit
*/ -}}

apiVersion: ${apiVersion}
kind: ${kind}
metadata:
  name: {{ printf "%s-%s" (include "vso.chart.fullname" .) "${metadataName}" }}
  labels:
    app.kubernetes.io/component: rbac
    # allow for selecting on the canonical name
    vso.hashicorp.com/role-instance: ${metadataName}
    ${aggregateLabel}
  {{- include "vso.chart.labels" . | nindent 4 }}
rules:
${rules}
HERE
}

resultDir="${tempdir}/result"
mkdir -p "${resultDir}"
for f in ${RBAC_ROOT}/*_{editor,viewer}_role.yaml ${RBAC_ROOT}/role.yaml
do
   fn="${f##*/}"
   mungeIt "${f}" "${tempdir}/chart/templates/${fn}" || exit 1
   # validate it
   pushd "${tempdir}/chart" > /dev/null
   helm template -s templates/${fn} . > /dev/null || exit 1
   cp -a templates/${fn} ${resultDir}/.
   popd > /dev/null
done


rm -f ${CHART_TEMPLATE_ROOT}/*_{editor,viewer}_role.yaml
cp -a ${resultDir}/*.yaml ${CHART_TEMPLATE_ROOT}/.
