#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/functions.sh"
resolve_paths

require_env
require_command "yq"
require_command "openssl"

SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
MAS_CFG="${VOLUME_PATH}/mas/config.yaml"

require_file "$SYNAPSE_CFG" "Synapse config"
require_file "$MAS_CFG" "MAS config"

CLIENT_ID="synapse-client"
CLIENT_SECRET=$(openssl rand -hex 32)

TEMP_FILTER=$(mktemp)
trap "rm -f $TEMP_FILTER" EXIT

cat > "$TEMP_FILTER" <<EOF
.oidc.providers += [{"id": "synapse", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile", "email"], "issuer": "http://mas:8000"}]
EOF

yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to update MAS config"; exit 1; }

CLIENT_ID=$(yq '.oidc.providers[0].client_id' "$MAS_CFG" | tr -d '"')
CLIENT_SECRET=$(yq '.oidc.providers[0].client_secret' "$MAS_CFG" | tr -d '"')

ISSUER_URL="https://${MAS_FQDN}"

fix_ownership "$SYNAPSE_CFG"

cat > "$TEMP_FILTER" <<EOF
.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
EOF

if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
    yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
fi

if [[ -n "${LIVEKIT_API_KEY:-}" ]]; then
    JWT_URL="https://${JWT_FQDN:-jwt.${DOMAIN}}"
    if yq '.livekit.url' "$SYNAPSE_CFG" 2>/dev/null | grep -q "."; then
        yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
    else
        yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
    fi
fi

log_info "OIDC and LiveKit linking complete"