#!/usr/bin/env bash
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x

case "$1" in
  help | google-auth:help)
    help_content() {
      cat <<help_content
    google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
    google-auth:allow <app>|--global [<domain|address>...], Let a domain or address sign in (no entries lists the allow list)
    google-auth:unallow <app>|--global <domain|address...>, Remove a domain or address from an allow list
    google-auth:deny <app>|--global [<address>...], Block an address even if the allow list covers it (no entries lists the deny list)
    google-auth:undeny <app>|--global <address...>, Remove an address from a deny list
    google-auth:enable <app>, Require Google sign-in for all requests to <app>
    google-auth:disable <app>, Remove Google sign-in from <app>
    google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
    google-auth:unexclude <app> <pattern...>, Remove previously excluded patterns
    google-auth:report [app], Show global and per-app google-auth status
    google-auth:start, Start the shared auth service container
    google-auth:stop, Stop the shared auth service container
    google-auth:restart, Restart the shared auth service container (picks up config changes)
    google-auth:logs [--tail|-t], Show logs from the shared auth service container
help_content
    }

    if [[ "$1" == "google-auth:help" ]]; then
      echo -e 'Usage: dokku google-auth[:COMMAND]'
      echo ''
      echo 'Put Google OAuth SSO in front of dokku apps.'
      echo ''
      echo 'Commands:'
      help_content | sort | column -c2 -t -s,
      echo ''
      echo 'google-auth:configure options (all persisted; re-run to change any of them):'
      echo ''
      echo '    --client-id <id>              Google OAuth client id'
      echo '    --client-secret <secret>      Google OAuth client secret'
      echo '    --auth-host <host>            the one host registered as a redirect URI with Google'
      echo '    --allow-domain <domain>       allow any verified account at <domain> (repeatable)'
      echo '    --allow-email <address>       allow one specific address (repeatable)'
      echo '    --deny-email <address>        block one address, even if a rule above allows it (repeatable)'
      echo '    --clear-deny-emails           empty the deny list'
      echo '    --session-ttl <duration>      how long a sign-in lasts (default 24h)'
      echo '    --cookie-name <name>          session cookie name (default _google_auth)'
      echo '    --port <port>                 127.0.0.1 port for the auth service (default 2999)'
      echo '    --regenerate-cookie-secret    rotate the session key (signs everyone out)'
      echo ''
      echo 'These flags set the GLOBAL lists and REPLACE the list they name, so they suit'
      echo 'initial setup. To change one entry afterwards — globally or for a single app —'
      echo 'use google-auth:allow / :unallow / :deny / :undeny.'
      echo ''
      echo 'Who gets in:'
      echo ''
      echo '    * The allow rules are a strict allowlist: an account matching none of them'
      echo '      is rejected, and at least one global rule is required.'
      echo '    * An app with its own allow entries uses ONLY those, ignoring the global'
      echo '      list. An app with none inherits the global list.'
      echo '    * Deny lists combine: an address denied globally or for the app is'
      echo '      rejected, and no app can lift a global denial.'
    else
      # Plain `dokku help` gets a single summary line, the way dokku's own
      # plugins behave; the command list belongs to `dokku google-auth:help`.
      cat <<help_desc
    google-auth, Put Google OAuth SSO in front of dokku apps
help_desc
    fi
    ;;

  *)
    exit "${DOKKU_NOT_IMPLEMENTED_EXIT:-10}"
    ;;
esac