#!/usr/bin/env bash
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x

case "$1" in
  help | google-auth:help)
    help_content() {
      cat <<help_content
    google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
    google-auth:allow [<domain|address>...], Let a domain or address sign in (no arguments lists the allow list)
    google-auth:unallow <domain|address...>, Remove a domain or address from the allow list
    google-auth:deny [<address>...], Block an address even if the allow list covers it (no arguments lists the deny list)
    google-auth:undeny <address...>, Remove an address from the deny list
    google-auth:enable <app>, Require Google sign-in for all requests to <app>
    google-auth:disable <app>, Remove Google sign-in from <app>
    google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
    google-auth:unexclude <app> <pattern...>, Remove previously excluded patterns
    google-auth:report [app], Show global and per-app google-auth status
    google-auth:start, Start the shared auth service container
    google-auth:stop, Stop the shared auth service container
    google-auth:restart, Restart the shared auth service container (picks up config changes)
    google-auth:logs [--tail|-t], Show logs from the shared auth service container
help_content
    }

    if [[ "$1" == "google-auth:help" ]]; then
      echo -e 'Usage: dokku google-auth[:COMMAND]'
      echo ''
      echo 'Put Google OAuth SSO in front of dokku apps.'
      echo ''
      echo 'Commands:'
      help_content | sort | column -c2 -t -s,
      echo ''
      echo 'google-auth:configure options (all persisted; re-run to change any of them):'
      echo ''
      echo '    --client-id <id>              Google OAuth client id'
      echo '    --client-secret <secret>      Google OAuth client secret'
      echo '    --auth-host <host>            the one host registered as a redirect URI with Google'
      echo '    --allow-domain <domain>       allow any verified account at <domain> (repeatable)'
      echo '    --allow-email <address>       allow one specific address (repeatable)'
      echo '    --deny-email <address>        block one address, even if a rule above allows it (repeatable)'
      echo '    --clear-deny-emails           empty the deny list'
      echo '    --session-ttl <duration>      how long a sign-in lasts (default 24h)'
      echo '    --cookie-name <name>          session cookie name (default _google_auth)'
      echo '    --port <port>                 127.0.0.1 port for the auth service (default 2999)'
      echo '    --regenerate-cookie-secret    rotate the session key (signs everyone out)'
      echo ''
      echo 'The allow rules are a strict allowlist: an account that matches none of them'
      echo 'is rejected, and at least one rule is required. The deny list wins over both.'
      echo ''
      echo 'These flags REPLACE the list they name, so they suit initial setup. To add or'
      echo 'remove one person afterwards, use google-auth:allow / :unallow / :deny /'
      echo ':undeny, which change one entry at a time and restart the service for you.'
    else
      help_content
    fi
    ;;

  *)
    exit "${DOKKU_NOT_IMPLEMENTED_EXIT:-10}"
    ;;
esac