#!/usr/bin/env bash
# Shared functions for the google-auth dokku plugin.
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x

GOOGLE_AUTH_PLUGIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

export DOKKU_ROOT=${DOKKU_ROOT:-/home/dokku}
export DOKKU_LIB_ROOT=${DOKKU_LIB_ROOT:-/var/lib/dokku}
export PLUGIN_CORE_AVAILABLE_PATH=${PLUGIN_CORE_AVAILABLE_PATH:-$DOKKU_LIB_ROOT/core-plugins/available}

if [[ -f "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" ]]; then
  # shellcheck disable=SC1091
  source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
fi

GOOGLE_AUTH_DATA_ROOT="$DOKKU_LIB_ROOT/data/google-auth"
GOOGLE_AUTH_SERVICE_NAME="dokku-google-auth"
GOOGLE_AUTH_IMAGE="dokku-google-auth:latest"
GOOGLE_AUTH_DEFAULT_PORT="2999"
GOOGLE_AUTH_ROUTE_PREFIX="/_google-auth"
# Where the per-app data directory is bind-mounted inside the service container.
GOOGLE_AUTH_APP_CONFIG_MOUNT="/data/apps"

# Fallbacks so the plugin can be exercised outside a dokku host (tests, dev).
if ! declare -f dokku_log_info1 >/dev/null 2>&1; then
  dokku_log_info1() { echo "-----> $*"; }
  dokku_log_info2() { echo "=====> $*"; }
  dokku_log_verbose() { echo "       $*"; }
  dokku_log_warn() { echo " !     $*" 1>&2; }
  dokku_log_fail() {
    echo " !     $*" 1>&2
    exit 1
  }
  verify_app_name() {
    [[ -n "$1" && -d "$DOKKU_ROOT/$1" ]] || dokku_log_fail "App $1 does not exist"
  }
fi

# --- key/value storage (one file per key under the plugin data dir) ---

fn-ga-global-get() {
  declare KEY="$1" DEFAULT="${2:-}"
  local file="$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
  if [[ -s "$file" ]]; then
    head -n1 "$file"
  else
    printf '%s' "$DEFAULT"
  fi
}

fn-ga-global-set() {
  declare KEY="$1" VALUE="$2"
  mkdir -p "$GOOGLE_AUTH_DATA_ROOT/global"
  printf '%s\n' "$VALUE" >"$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
  chmod 600 "$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
}

# Multi-value keys store one entry per line.
fn-ga-global-get-list() {
  declare KEY="$1"
  cat "$GOOGLE_AUTH_DATA_ROOT/global/$KEY" 2>/dev/null || true
}

fn-ga-global-set-list() {
  declare KEY="$1"
  shift
  mkdir -p "$GOOGLE_AUTH_DATA_ROOT/global"
  local file="$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
  : >"$file"
  local entry
  for entry in "$@"; do
    printf '%s\n' "$entry" >>"$file"
  done
  chmod 600 "$file"
}

# --- access lists, scoped to "global" or to one app ---
#
# An app's allow entries replace the global ones for that app; deny entries from
# both scopes are combined. The auth service implements that precedence — these
# helpers only store the entries.

fn-ga-list-file() {
  declare SCOPE="$1" KEY="$2"
  if [[ "$SCOPE" == "global" ]]; then
    echo "$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
  else
    echo "$(fn-ga-app-dir "$SCOPE")/$KEY"
  fi
}

fn-ga-list-get() {
  declare SCOPE="$1" KEY="$2"
  cat "$(fn-ga-list-file "$SCOPE" "$KEY")" 2>/dev/null || true
}

fn-ga-list-count() {
  declare SCOPE="$1" KEY="$2"
  fn-ga-list-get "$SCOPE" "$KEY" | grep -c . || true
}

fn-ga-list-contains() {
  declare SCOPE="$1" KEY="$2" VALUE="$3"
  grep -qxF "$VALUE" "$(fn-ga-list-file "$SCOPE" "$KEY")" 2>/dev/null
}

fn-ga-list-add() {
  declare SCOPE="$1" KEY="$2" VALUE="$3"
  local file
  file="$(fn-ga-list-file "$SCOPE" "$KEY")"
  if [[ "$SCOPE" == "global" ]]; then
    mkdir -p "$GOOGLE_AUTH_DATA_ROOT/global"
    touch "$file"
    chmod 600 "$file"
  else
    fn-ga-app-dir-ensure "$SCOPE" >/dev/null
    touch "$file"
    # Readable through the service's read-only bind mount; see fn-ga-app-dir-ensure.
    chmod 644 "$file"
  fi
  grep -qxF "$VALUE" "$file" || printf '%s\n' "$VALUE" >>"$file"
}

fn-ga-list-remove() {
  declare SCOPE="$1" KEY="$2" VALUE="$3"
  local file tmp
  file="$(fn-ga-list-file "$SCOPE" "$KEY")"
  [[ -f "$file" ]] || return 0
  tmp="$(mktemp)"
  grep -vxF "$VALUE" "$file" >"$tmp" || true
  cat "$tmp" >"$file"
  rm -f "$tmp"
}

# Sets GA_SCOPE from a command's first argument: "global" for --global,
# otherwise a verified app name. Fails (and exits) on anything else.
fn-ga-resolve-scope() {
  declare CMD="$1" ARG="${2:-}"
  case "$ARG" in
    --global)
      GA_SCOPE=global
      ;;
    "")
      dokku_log_fail "usage: dokku $CMD <app>|--global [<entry>...]"
      ;;
    -*)
      dokku_log_fail "unknown flag '$ARG' — pass an app name or --global"
      ;;
    *)
      verify_app_name "$ARG"
      GA_SCOPE="$ARG"
      ;;
  esac
}

# Human-readable scope for log lines: "globally" or "for my-app".
fn-ga-scope-label() {
  declare SCOPE="$1"
  if [[ "$SCOPE" == "global" ]]; then
    echo "globally"
  else
    echo "for $SCOPE"
  fi
}

# The scope as it is typed on the command line, for suggested commands.
fn-ga-scope-arg() {
  declare SCOPE="$1"
  if [[ "$SCOPE" == "global" ]]; then
    echo "--global"
  else
    echo "$SCOPE"
  fi
}

# Advisory mirror of the service's allow-list precedence (an app's entries
# replace the global ones), used only to warn operators. The authority is
# emailAllowedFor in internal/authproxy.
fn-ga-email-effectively-allowed() {
  declare SCOPE="$1" EMAIL="$2"
  local effective="$SCOPE"
  if [[ "$SCOPE" != "global" ]] &&
    [[ "$(fn-ga-list-count "$SCOPE" allowed-domains)" -eq 0 &&
    "$(fn-ga-list-count "$SCOPE" allowed-emails)" -eq 0 ]]; then
    effective=global
  fi
  fn-ga-list-contains "$effective" allowed-emails "$EMAIL" && return 0
  fn-ga-list-contains "$effective" allowed-domains "${EMAIL##*@}"
}

# Makes a list change take effect. Global lists travel in the container's
# environment and need a restart; per-app lists are read live through the bind
# mount, so they only need the mount to actually be there.
fn-ga-apply-list-change() {
  declare SCOPE="$1"
  if [[ "$SCOPE" == "global" ]]; then
    fn-ga-reload-service-config
    return 0
  fi
  # An app's lists only apply if its nginx config tells the service which app a
  # request belongs to. Configs written before that header existed would make
  # the app fall back to the global lists, so refresh it here rather than wait
  # for the next deploy. This is a no-op when the config is already current.
  if fn-google-auth-app-enabled "$SCOPE"; then
    fn-ga-apply "$SCOPE"
  fi
  if ! fn-ga-service-running; then
    dokku_log_verbose "auth service is not running; changes apply when it starts"
    return 0
  fi
  if ! fn-ga-service-reads-app-lists; then
    dokku_log_info1 "recreating the auth service so it can read per-app lists (this rebuilds the image if the plugin was updated)"
    fn-ga-service-start
    return 0
  fi
  dokku_log_verbose "in effect within a few seconds (no restart needed)"
}

# Entries end up in a comma/space separated env var, so they may contain
# neither.
fn-ga-validate-list-entry() {
  declare ENTRY="$1"
  [[ -n "$ENTRY" ]] || return 1
  ! printf '%s' "$ENTRY" | grep -qE '[,[:space:]]'
}

# "signal.org" and "@signal.org" name a domain; "guest@partner.com" names one
# address. Callers strip any leading "@" themselves.
fn-ga-allow-entry-kind() {
  declare ENTRY="$1"
  if [[ "$ENTRY" == @* || "$ENTRY" != *@* ]]; then
    echo domain
  else
    echo email
  fi
}

# The service reads the allow/deny lists from its env file at startup, so
# changing them means recreating the container.
fn-ga-reload-service-config() {
  if fn-ga-service-running; then
    fn-ga-service-start
  else
    dokku_log_verbose "auth service is not running; changes apply when it starts"
  fi
}

fn-ga-app-dir() {
  declare APP="$1"
  echo "$GOOGLE_AUTH_DATA_ROOT/apps/$APP"
}

# Creates an app's state directory with modes the auth service can use. It reads
# per-app lists through a read-only bind mount as an unprivileged uid, so the
# directories must be traversable and the list files readable. Nothing is
# exposed to other users on the host: $GOOGLE_AUTH_DATA_ROOT itself stays 0700,
# and secrets live in global/, which is never mounted.
fn-ga-app-dir-ensure() {
  declare APP="$1"
  local dir
  dir="$(fn-ga-app-dir "$APP")"
  mkdir -p "$dir"
  chmod 711 "$GOOGLE_AUTH_DATA_ROOT/apps" "$dir" 2>/dev/null || true
  printf '%s' "$dir"
}

fn-google-auth-app-enabled() {
  declare APP="$1"
  [[ -f "$(fn-ga-app-dir "$APP")/enabled" ]]
}

fn-ga-app-set-enabled() {
  declare APP="$1" ENABLED="$2"
  local dir
  dir="$(fn-ga-app-dir "$APP")"
  if [[ "$ENABLED" == "true" ]]; then
    dir="$(fn-ga-app-dir-ensure "$APP")"
    touch "$dir/enabled"
  else
    rm -f "$dir/enabled"
  fi
}

fn-ga-excludes() {
  declare APP="$1"
  cat "$(fn-ga-app-dir "$APP")/excludes" 2>/dev/null || true
}

fn-ga-enabled-apps() {
  local dir
  for dir in "$GOOGLE_AUTH_DATA_ROOT/apps"/*/; do
    [[ -d "$dir" ]] || continue
    local app
    app="$(basename "$dir")"
    fn-google-auth-app-enabled "$app" && echo "$app"
  done
  return 0
}

fn-ga-configured() {
  [[ -n "$(fn-ga-global-get client-id)" ]] || return 1
  [[ -n "$(fn-ga-global-get client-secret)" ]] || return 1
  [[ -n "$(fn-ga-global-get auth-host)" ]] || return 1
  [[ -n "$(fn-ga-global-get cookie-secret)" ]] || return 1
  [[ -s "$GOOGLE_AUTH_DATA_ROOT/global/allowed-domains" || -s "$GOOGLE_AUTH_DATA_ROOT/global/allowed-emails" ]] || return 1
}

# --- exclusion patterns ---

# Patterns are either a path prefix ("/api/webhooks") or a regex ("re:^/v[0-9]+/public/").
fn-ga-validate-pattern() {
  declare PATTERN="$1"
  [[ -n "$PATTERN" ]] || return 1
  # Guard against nginx config injection.
  if printf '%s' "$PATTERN" | grep -qE '[;{}"'"'"'[:space:]]'; then
    return 1
  fi
  if [[ "$PATTERN" == re:* ]]; then
    [[ -n "${PATTERN#re:}" ]] || return 1
  else
    [[ "$PATTERN" == /* ]] || return 1
  fi
}

fn-ga-exclude-add() {
  declare APP="$1" PATTERN="$2"
  local dir file
  dir="$(fn-ga-app-dir-ensure "$APP")"
  file="$dir/excludes"
  touch "$file"
  grep -qxF "$PATTERN" "$file" || printf '%s\n' "$PATTERN" >>"$file"
}

fn-ga-exclude-remove() {
  declare APP="$1" PATTERN="$2"
  local file tmp
  file="$(fn-ga-app-dir "$APP")/excludes"
  [[ -f "$file" ]] || return 0
  tmp="$(mktemp)"
  grep -vxF "$PATTERN" "$file" >"$tmp" || true
  cat "$tmp" >"$file"
  rm -f "$tmp"
}

# --- nginx config generation ---

# The app's upstream block is created by dokku's own nginx template; we reuse
# it by name so excluded and protected locations proxy to the same place.
fn-ga-upstream-name() {
  declare APP="$1"
  local nginx_conf="$DOKKU_ROOT/$APP/nginx.conf"
  [[ -f "$nginx_conf" ]] || return 1
  local name
  name="$(awk '$1 == "upstream" {print $2; exit}' "$nginx_conf")"
  [[ -n "$name" ]] || return 1
  printf '%s' "$name"
}

fn-ga-proxy-read-timeout() {
  declare APP="$1"
  local t="" file
  for file in "$DOKKU_LIB_ROOT/config/nginx/$APP/proxy-read-timeout" \
    "$DOKKU_LIB_ROOT/config/nginx/--global/proxy-read-timeout"; do
    if [[ -s "$file" ]]; then
      t="$(head -n1 "$file")"
      break
    fi
  done
  printf '%s' "${t:-60s}"
}

# Mirrors the proxy directives from dokku's default nginx template so
# requests routed through our locations behave like stock dokku routing.
fn-ga-proxy-directives() {
  declare UPSTREAM="$1" TIMEOUT="$2"
  cat <<EOF
    proxy_pass http://${UPSTREAM};
    proxy_http_version 1.1;
    proxy_read_timeout ${TIMEOUT};
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection \$http_connection;
    proxy_set_header Host \$http_host;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Forwarded-Port \$server_port;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Request-Start \$msec;
EOF
}

fn-ga-generate-conf() {
  declare APP="$1"
  local upstream timeout port
  upstream="$(fn-ga-upstream-name "$APP")" || return 1
  timeout="$(fn-ga-proxy-read-timeout "$APP")"
  port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"

  cat <<EOF
# Managed by the dokku google-auth plugin — do not edit by hand.
# Regenerated on every deploy and by google-auth:* commands.

# Every location below sets X-Google-Auth-App explicitly, which both tells the
# auth service whose access lists to apply and overwrites any value a client
# tried to send.
location = ${GOOGLE_AUTH_ROUTE_PREFIX}/verify {
    internal;
    proxy_pass http://127.0.0.1:${port};
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header Host \$host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Google-Auth-App "${APP}";
}

location ^~ ${GOOGLE_AUTH_ROUTE_PREFIX}/ {
    proxy_pass http://127.0.0.1:${port};
    proxy_http_version 1.1;
    proxy_set_header Host \$host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Forwarded-Port \$server_port;
    proxy_set_header X-Auth-Request-Redirect "";
    proxy_set_header X-Google-Auth-App "${APP}";
}

location @google_auth_signin {
    rewrite ^ ${GOOGLE_AUTH_ROUTE_PREFIX}/start break;
    proxy_pass http://127.0.0.1:${port};
    proxy_set_header Host \$host;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header X-Forwarded-For \$remote_addr;
    proxy_set_header X-Auth-Request-Redirect \$request_uri;
    proxy_set_header X-Google-Auth-App "${APP}";
}
EOF

  local pattern
  while IFS= read -r pattern; do
    [[ -z "$pattern" ]] && continue
    echo ""
    if [[ "$pattern" == re:* ]]; then
      echo "# google-auth: path excluded from SSO (${pattern})"
      echo "location ~ ${pattern#re:} {"
    else
      echo "# google-auth: path excluded from SSO (${pattern})"
      echo "location ^~ ${pattern} {"
    fi
    fn-ga-proxy-directives "$upstream" "$timeout"
    cat <<'EOF'
    # Strip identity headers so clients cannot spoof them on open paths.
    proxy_set_header X-Forwarded-User "";
    proxy_set_header X-Forwarded-Email "";
    proxy_set_header X-Auth-Request-User "";
    proxy_set_header X-Auth-Request-Email "";
    proxy_set_header X-Auth-Request-Name "";
    proxy_set_header X-Google-Auth-App "";
}
EOF
  done < <(fn-ga-excludes "$APP")

  cat <<EOF

# Everything else requires a Google session.
location ~ ^/ {
    auth_request ${GOOGLE_AUTH_ROUTE_PREFIX}/verify;
    auth_request_set \$google_auth_user \$upstream_http_x_auth_request_user;
    auth_request_set \$google_auth_email \$upstream_http_x_auth_request_email;
    auth_request_set \$google_auth_name \$upstream_http_x_auth_request_name;
    error_page 401 = @google_auth_signin;

$(fn-ga-proxy-directives "$upstream" "$timeout")
    proxy_set_header X-Forwarded-User \$google_auth_user;
    proxy_set_header X-Forwarded-Email \$google_auth_email;
    proxy_set_header X-Auth-Request-User \$google_auth_user;
    proxy_set_header X-Auth-Request-Email \$google_auth_email;
    proxy_set_header X-Auth-Request-Name \$google_auth_name;
    proxy_set_header X-Google-Auth-App "";
}
EOF
}

fn-ga-conf-path() {
  declare APP="$1"
  echo "$DOKKU_ROOT/$APP/nginx.conf.d/google-auth.conf"
}

# Regenerates (or removes) the app's conf file without touching nginx.
# Prints one of: changed, unchanged, skipped.
fn-ga-write-conf() {
  declare APP="$1"
  local conf dir tmp
  conf="$(fn-ga-conf-path "$APP")"
  dir="$(dirname "$conf")"

  if ! fn-google-auth-app-enabled "$APP"; then
    if [[ -f "$conf" ]]; then
      rm -f "$conf"
      echo changed
    else
      echo unchanged
    fi
    return 0
  fi

  tmp="$(mktemp)"
  if ! fn-ga-generate-conf "$APP" >"$tmp" 2>/dev/null; then
    rm -f "$tmp"
    echo skipped
    return 0
  fi
  mkdir -p "$dir"
  if [[ -f "$conf" ]] && cmp -s "$tmp" "$conf"; then
    rm -f "$tmp"
    echo unchanged
    return 0
  fi
  cat "$tmp" >"$conf"
  rm -f "$tmp"
  echo changed
}

# --- nginx validate/reload (via dokku core helpers when available) ---

fn-ga-source-nginx-functions() {
  if [[ -f "$PLUGIN_CORE_AVAILABLE_PATH/nginx-vhosts/functions" ]]; then
    # shellcheck disable=SC1091
    source "$PLUGIN_CORE_AVAILABLE_PATH/nginx-vhosts/functions" 2>/dev/null || true
  fi
}

fn-ga-nginx-validate() {
  fn-ga-source-nginx-functions
  if declare -f validate_nginx >/dev/null 2>&1; then
    (validate_nginx) >/dev/null 2>&1
    return $?
  fi
  return 0
}

fn-ga-nginx-reload() {
  fn-ga-source-nginx-functions
  if declare -f restart_nginx >/dev/null 2>&1; then
    restart_nginx >/dev/null 2>&1 || dokku_log_warn "nginx reload reported an error; check 'nginx -t'"
  else
    dokku_log_warn "could not reload nginx automatically; run: sudo systemctl reload nginx"
  fi
}

# Write conf for one app, validate nginx, roll back on failure, reload.
fn-ga-apply() {
  declare APP="$1"
  local conf backup="" had_file=false status
  conf="$(fn-ga-conf-path "$APP")"
  if [[ -f "$conf" ]]; then
    backup="$(mktemp)"
    cat "$conf" >"$backup"
    had_file=true
  fi

  status="$(fn-ga-write-conf "$APP")"
  case "$status" in
    skipped)
      dokku_log_warn "$APP has no generated nginx config yet (not deployed?). google-auth config will be added on the next deploy."
      ;;
    changed)
      if ! fn-ga-nginx-validate; then
        if [[ "$had_file" == "true" ]]; then
          cat "$backup" >"$conf"
        else
          rm -f "$conf"
        fi
        [[ -n "$backup" ]] && rm -f "$backup"
        dokku_log_fail "nginx rejected the generated config for $APP; change reverted (check exclude patterns)"
      fi
      fn-ga-nginx-reload
      ;;
  esac
  [[ -n "$backup" ]] && rm -f "$backup"
  return 0
}

# Regenerate confs for every enabled app (e.g. after the service port changes).
fn-ga-apply-all() {
  local app any_changed=false status
  while IFS= read -r app; do
    [[ -z "$app" ]] && continue
    status="$(fn-ga-write-conf "$app")"
    [[ "$status" == "changed" ]] && any_changed=true
  done < <(fn-ga-enabled-apps)
  if [[ "$any_changed" == "true" ]]; then
    if fn-ga-nginx-validate; then
      fn-ga-nginx-reload
    else
      dokku_log_warn "nginx validation failed after regenerating google-auth configs; run 'nginx -t' to inspect"
    fi
  fi
  return 0
}

# --- auth service container management ---

fn-ga-image-exists() {
  docker image inspect "$GOOGLE_AUTH_IMAGE" >/dev/null 2>&1
}

# Fingerprint of everything that ends up in the service image. The image is
# labelled with it so an upgraded plugin rebuilds instead of reusing a binary
# built from older source. Without this the shell half of the plugin upgrades
# the moment the files change — new commands, new nginx config, new env var —
# while the binary enforcing them stays whatever was built first, and the
# mismatch is invisible from the outside.
fn-ga-source-hash() {
  local dir="$GOOGLE_AUTH_PLUGIN_DIR" file
  {
    while IFS= read -r file; do
      printf '%s ' "${file#"$dir/"}"
      sha256sum "$file" | awk '{print $1}'
    done < <(
      {
        printf '%s\n' "$dir/Dockerfile" "$dir/go.mod"
        find "$dir/cmd" "$dir/internal" -type f 2>/dev/null
      } | LC_ALL=C sort
    )
  } | sha256sum | awk '{print $1}'
}

# True when the built image matches the plugin's current source.
fn-ga-image-current() {
  fn-ga-image-exists || return 1
  local labelled
  labelled="$(docker image inspect -f '{{index .Config.Labels "google-auth.source-hash"}}' "$GOOGLE_AUTH_IMAGE" 2>/dev/null)"
  # Images built before this label existed report an empty value or "<no value>",
  # and are stale by definition.
  [[ -n "$labelled" && "$labelled" != "<no value>" ]] || return 1
  [[ "$labelled" == "$(fn-ga-source-hash)" ]]
}

fn-ga-build-image() {
  command -v docker >/dev/null 2>&1 || dokku_log_fail "docker is required to build the google-auth service image"
  dokku_log_info1 "Building $GOOGLE_AUTH_IMAGE (first build downloads the Go toolchain image; this can take a few minutes)"
  docker image build \
    --label "google-auth.source-hash=$(fn-ga-source-hash)" \
    -t "$GOOGLE_AUTH_IMAGE" "$GOOGLE_AUTH_PLUGIN_DIR"
}

fn-ga-service-running() {
  [[ "$(docker container inspect -f '{{.State.Running}}' "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null)" == "true" ]]
}

# Asks the running service which per-app config directory it is using, and
# prints it. This is the only check that sees the binary rather than the
# container around it; a build from before per-app lists existed answers with a
# bare "ok" and names no directory. Fails if the service is unreachable or too
# old to answer.
fn-ga-service-app-config-dir() {
  command -v curl >/dev/null 2>&1 || return 1
  local port body dir
  port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
  body="$(curl -fsS --max-time 3 "http://127.0.0.1:${port}${GOOGLE_AUTH_ROUTE_PREFIX}/healthz" 2>/dev/null)" || return 1
  dir="$(sed -n 's/.*"app_config_dir":"\([^"]*\)".*/\1/p' <<<"$body")"
  [[ -n "$dir" ]] || return 1
  printf '%s' "$dir"
}

# True when the running service can actually read per-app lists. That takes
# three things, and missing any of them makes the service ignore every per-app
# list and fall back to the global one — silently, and in the permissive
# direction — so all three are checked:
#
#   the bind mount             — a container from an older plugin has none;
#   the env var naming it      — one recreated from a stale service.env has the
#                                mount without the variable;
#   a binary that reads both   — one recreated from a stale *image* has the
#                                mount and the variable and ignores them, which
#                                no amount of docker metadata can reveal. Only
#                                the service's own answer distinguishes it.
fn-ga-service-reads-app-lists() {
  local inspected
  inspected="$(docker container inspect \
    -f '{{range .Mounts}}mount={{println .Destination}}{{end}}{{range .Config.Env}}env={{println .}}{{end}}' \
    "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null)" || return 1
  grep -qxF "mount=$GOOGLE_AUTH_APP_CONFIG_MOUNT" <<<"$inspected" || return 1
  grep -qxF "env=GOOGLE_AUTH_APP_CONFIG_DIR=$GOOGLE_AUTH_APP_CONFIG_MOUNT" <<<"$inspected" || return 1

  local reported
  if reported="$(fn-ga-service-app-config-dir)"; then
    [[ "$reported" == "$GOOGLE_AUTH_APP_CONFIG_MOUNT" ]]
    return $?
  fi
  # No answer (curl missing, or the service is not reachable on the loopback
  # port): fall back to checking that the image was built from this plugin's
  # current source and that the container is running that image.
  fn-ga-image-current && fn-ga-container-runs-current-image
}

# True when the running container was created from the current service image,
# rather than from an earlier build still tagged over.
fn-ga-container-runs-current-image() {
  local running current
  running="$(docker container inspect -f '{{.Image}}' "$GOOGLE_AUTH_SERVICE_NAME" 2>/dev/null)" || return 1
  current="$(docker image inspect -f '{{.Id}}' "$GOOGLE_AUTH_IMAGE" 2>/dev/null)" || return 1
  [[ -n "$running" && "$running" == "$current" ]]
}

fn-ga-write-env-file() {
  local envfile="$GOOGLE_AUTH_DATA_ROOT/service.env"
  local domains emails denied
  domains="$(fn-ga-global-get-list allowed-domains | paste -sd, -)"
  emails="$(fn-ga-global-get-list allowed-emails | paste -sd, -)"
  denied="$(fn-ga-global-get-list denied-emails | paste -sd, -)"
  mkdir -p "$GOOGLE_AUTH_DATA_ROOT"
  # The umask stays inside this subshell. Leaking it left every directory
  # created later in the same command at 0700 — including an app's config
  # directory during google-auth:enable, which the service then could not
  # traverse to read that app's lists.
  (
    umask 077
    cat >"$envfile" <<EOF
GOOGLE_AUTH_CLIENT_ID=$(fn-ga-global-get client-id)
GOOGLE_AUTH_CLIENT_SECRET=$(fn-ga-global-get client-secret)
GOOGLE_AUTH_COOKIE_SECRET=$(fn-ga-global-get cookie-secret)
GOOGLE_AUTH_AUTH_HOST=$(fn-ga-global-get auth-host)
GOOGLE_AUTH_ALLOWED_DOMAINS=$domains
GOOGLE_AUTH_ALLOWED_EMAILS=$emails
GOOGLE_AUTH_DENIED_EMAILS=$denied
GOOGLE_AUTH_APP_CONFIG_DIR=$GOOGLE_AUTH_APP_CONFIG_MOUNT
GOOGLE_AUTH_COOKIE_NAME=$(fn-ga-global-get cookie-name _google_auth)
GOOGLE_AUTH_SESSION_TTL=$(fn-ga-global-get session-ttl 24h)
GOOGLE_AUTH_ALLOW_INSECURE=$(fn-ga-global-get allow-insecure false)
GOOGLE_AUTH_LISTEN=:2999
EOF
  )
}

fn-ga-service-start() {
  fn-ga-configured || dokku_log_fail "google-auth is not fully configured; run: dokku google-auth:configure"
  # Rebuild whenever the source moved, not merely when the image is missing.
  # Starting the service is how an operator expects to pick up an upgraded
  # plugin, and reusing the old binary there is what makes a new feature look
  # broken rather than absent.
  fn-ga-image-current || fn-ga-build-image
  fn-ga-write-env-file
  local port
  port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
  mkdir -p "$GOOGLE_AUTH_DATA_ROOT/apps"
  chmod 711 "$GOOGLE_AUTH_DATA_ROOT/apps" 2>/dev/null || true
  docker container rm -f "$GOOGLE_AUTH_SERVICE_NAME" >/dev/null 2>&1 || true
  docker container run -d \
    --name "$GOOGLE_AUTH_SERVICE_NAME" \
    --restart=unless-stopped \
    -p "127.0.0.1:${port}:2999" \
    --env-file "$GOOGLE_AUTH_DATA_ROOT/service.env" \
    -v "$GOOGLE_AUTH_DATA_ROOT/apps:${GOOGLE_AUTH_APP_CONFIG_MOUNT}:ro" \
    "$GOOGLE_AUTH_IMAGE" >/dev/null
  dokku_log_info1 "google-auth service running on 127.0.0.1:${port}"
}

fn-ga-service-stop() {
  docker container rm -f "$GOOGLE_AUTH_SERVICE_NAME" >/dev/null 2>&1 || true
}

# Warn when the configured auth host is not served by any enabled app,
# because Google's callback would then land on nothing.
fn-ga-warn-if-auth-host-unrouted() {
  local auth_host app vhost_file
  auth_host="$(fn-ga-global-get auth-host)"
  [[ -n "$auth_host" ]] || return 0
  while IFS= read -r app; do
    [[ -z "$app" ]] && continue
    vhost_file="$DOKKU_ROOT/$app/VHOST"
    [[ -f "$vhost_file" ]] && grep -qxF "$auth_host" "$vhost_file" && return 0
  done < <(fn-ga-enabled-apps)
  dokku_log_warn "auth host '$auth_host' is not a domain of any google-auth-enabled app."
  dokku_log_warn "Google's OAuth callback (https://$auth_host$GOOGLE_AUTH_ROUTE_PREFIX/callback) must route to an enabled app."
  return 0
}