#!/usr/bin/env bash

################################## GET KAFKA CLUSTER ID ########################
ZK_CONTAINER=zookeeper
ZK_PORT=2181
echo "Retrieving Kafka cluster id from docker-container '$ZK_CONTAINER' port '$ZK_PORT'"
KAFKA_CLUSTER_ID=$(docker exec -it $ZK_CONTAINER zookeeper-shell localhost:$ZK_PORT get /cluster/id 2> /dev/null | grep \"version\" | jq -r .id)
if [ -z "$KAFKA_CLUSTER_ID" ]; then
    echo "Failed to retrieve kafka cluster id from zookeeper"
    exit 1
fi

## Login into MDS
XX_CONFLUENT_USERNAME=professor XX_CONFLUENT_PASSWORD=professor confluent login --url http://localhost:8090

SUPER_USER=professor
SUPER_USER_PASSWORD=professor
SUPER_USER_PRINCIPAL="User:$SUPER_USER"

## Create Service Roles
CONNECT_PRINCIPAL="User:fry"
C3_PRINCIPAL="User:hermes"
SR_PRINCIPAL="User:leela"
OTHER_PRINCIPAL="User:zoidberg"

CONNECT=connect-cluster
SR=schema-registry
C3=c3-cluster

################################### SETUP SUPERUSER ###################################
echo "Creating Super User role bindings"

confluent iam rbac role-binding create \
    --principal $SUPER_USER_PRINCIPAL  \
    --role SystemAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID

confluent iam rbac role-binding create \
    --principal $SUPER_USER_PRINCIPAL \
    --role SystemAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID \
    --schema-registry-cluster $SR

confluent iam rbac role-binding create \
    --principal $SUPER_USER_PRINCIPAL \
    --role SystemAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID \
    --connect-cluster $CONNECT

################################### SCHEMA REGISTRY ###################################
echo "Creating Schema Registry role bindings"

# SecurityAdmin on SR cluster itself
confluent iam rbac role-binding create \
    --principal $SR_PRINCIPAL \
    --role SecurityAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID \
    --schema-registry-cluster $SR

# ResourceOwner for groups and topics on broker
for resource in Topic:_schemas Group:schema-registry
do
    confluent iam rbac role-binding create \
        --principal $SR_PRINCIPAL \
        --role ResourceOwner \
        --resource $resource \
        --kafka-cluster $KAFKA_CLUSTER_ID
done

################################### CONNECT ###################################
echo "Creating Connect role bindings"

# SecurityAdmin on the connect cluster itself
confluent iam rbac role-binding create \
    --principal $CONNECT_PRINCIPAL \
    --role SecurityAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID \
    --connect-cluster $CONNECT

# ResourceOwner for groups and topics on broker
declare -a ConnectResources=(
    "Topic:connect-configs"
    "Topic:connect-offsets"
    "Topic:connect-status"
    "Group:connect-cluster"
    "Group:secret-registry"
    "Topic:_confluent-secrets"
)
for resource in ${ConnectResources[@]}
do
    confluent iam rbac role-binding create \
        --principal $CONNECT_PRINCIPAL \
        --role ResourceOwner \
        --resource $resource \
        --kafka-cluster $KAFKA_CLUSTER_ID
done

################################### C3 ###################################
echo "Creating C3 role bindings"

# C3 only needs SystemAdmin on the kafka cluster itself
confluent iam rbac role-binding create \
    --principal $C3_PRINCIPAL \
    --role SystemAdmin \
    --kafka-cluster $KAFKA_CLUSTER_ID

################################### OTHER ROLE ###################################

confluent iam rbac role-binding create \
    --principal $OTHER_PRINCIPAL \
    --role DeveloperWrite \
    --resource "Topic:connect-configs" \
    --kafka-cluster $KAFKA_CLUSTER_ID


confluent iam rbac role-binding create \
    --principal $OTHER_PRINCIPAL \
    --role ResourceOwner \
    --resource "Topic:zaragoza." \
    --prefix \
    --kafka-cluster $KAFKA_CLUSTER_ID

echo "Finished setting up role bindings"
echo "    kafka cluster id: $KAFKA_CLUSTER_ID"
echo "    connect cluster id: $CONNECT"
echo "    schema registry cluster id: $SR"
echo
echo "    super user account: $SUPER_USER_PRINCIPAL"
echo "    connect service account: $CONNECT_PRINCIPAL"
echo "    schema registry service account: $SR_PRINCIPAL"
echo "    C3 service account: $C3_PRINCIPAL"
echo "    Other service account: $OTHER_PRINCIPAL"
