#!/usr/bin/env bash
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"

fn-ga-report-app() {
  declare APP="$1"
  local pattern found
  dokku_log_info2 "$APP google-auth information"
  if fn-google-auth-app-enabled "$APP"; then
    dokku_log_verbose "Enabled:  true"
    found=false
    while IFS= read -r pattern; do
      [[ -z "$pattern" ]] && continue
      if [[ "$found" == "false" ]]; then
        dokku_log_verbose "Excluded: $pattern"
        found=true
      else
        dokku_log_verbose "          $pattern"
      fi
    done < <(fn-ga-excludes "$APP")
    [[ "$found" == "false" ]] && dokku_log_verbose "Excluded: (none)"
  else
    dokku_log_verbose "Enabled:  false"
  fi

  # Access lists are worth showing either way: they are often set before an app
  # is enabled, and they persist across disable/enable.
  local allow_entries=()
    while IFS= read -r pattern; do
      [[ -n "$pattern" ]] && allow_entries+=("$pattern (domain)")
    done < <(fn-ga-list-get "$APP" allowed-domains)
    while IFS= read -r pattern; do
      [[ -n "$pattern" ]] && allow_entries+=("$pattern")
    done < <(fn-ga-list-get "$APP" allowed-emails)
  if [[ ${#allow_entries[@]} -eq 0 ]]; then
    dokku_log_verbose "Allowed:  (inherits the global allow list)"
  else
    dokku_log_verbose "Allowed:  ${allow_entries[0]} (replaces the global allow list)"
    local i
    for ((i = 1; i < ${#allow_entries[@]}; i++)); do
      dokku_log_verbose "          ${allow_entries[i]}"
    done
  fi

  found=false
  while IFS= read -r pattern; do
    [[ -z "$pattern" ]] && continue
    if [[ "$found" == "false" ]]; then
      dokku_log_verbose "Denied:   $pattern"
      found=true
    else
      dokku_log_verbose "          $pattern"
    fi
  done < <(fn-ga-list-get "$APP" denied-emails)
  [[ "$found" == "false" ]] && dokku_log_verbose "Denied:   (none beyond the global deny list)"

  if fn-google-auth-app-enabled "$APP"; then
    if [[ -f "$(fn-ga-conf-path "$APP")" ]]; then
      dokku_log_verbose "Nginx:    $(fn-ga-conf-path "$APP")"
    else
      dokku_log_verbose "Nginx:    (config pending; will be written on next deploy)"
    fi
  fi
  return 0
}

cmd-google-auth-report() {
  declare desc="show global and per-app google-auth status"
  local cmd="google-auth:report"
  [[ "$1" == "$cmd" ]] && shift 1
  declare APP="${1:-}"

  if [[ -n "$APP" ]]; then
    verify_app_name "$APP"
    fn-ga-report-app "$APP"
    return 0
  fi

  dokku_log_info2 "google-auth global information"
  if fn-ga-configured; then
    dokku_log_verbose "Configured:      true"
  else
    dokku_log_verbose "Configured:      false (run dokku google-auth:configure)"
  fi
  local client_id
  client_id="$(fn-ga-global-get client-id)"
  dokku_log_verbose "Client id:       ${client_id:-(unset)}"
  dokku_log_verbose "Client secret:   $([[ -n "$(fn-ga-global-get client-secret)" ]] && echo '(set)' || echo '(unset)')"
  dokku_log_verbose "Auth host:       $(fn-ga-global-get auth-host '(unset)')"
  dokku_log_verbose "Callback URL:    https://$(fn-ga-global-get auth-host '<auth-host>')${GOOGLE_AUTH_ROUTE_PREFIX}/callback"
  dokku_log_verbose "Allowed domains: $(fn-ga-global-get-list allowed-domains | paste -sd' ' -) (global default)"
  dokku_log_verbose "Allowed emails:  $(fn-ga-global-get-list allowed-emails | paste -sd' ' -)"
  dokku_log_verbose "Denied emails:   $(fn-ga-global-get-list denied-emails | paste -sd' ' -) (applies to every app)"
  dokku_log_verbose "Session TTL:     $(fn-ga-global-get session-ttl 24h)"
  dokku_log_verbose "Service port:    127.0.0.1:$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
  if fn-ga-service-running; then
    dokku_log_verbose "Service:         running"
  else
    dokku_log_verbose "Service:         not running"
  fi

  local app
  while IFS= read -r app; do
    [[ -z "$app" ]] && continue
    fn-ga-report-app "$app"
  done < <(fn-ga-enabled-apps)
}

cmd-google-auth-report "$@"