#!/bin/sh
set -eu

ARTIFACTAPI_HOST=artifactapi.k8s.syd1.au.unkin.net

warn() { echo "artifactapi-login: $*, pushing unauthenticated" >&2; }

artifactapi_login() {
  [ "${PLUGIN_DRY_RUN:-false}" != true ] || return 0
  case "${PLUGIN_REGISTRY:-} ${PLUGIN_REPO:-}" in *"$ARTIFACTAPI_HOST"*) ;; *) return 0 ;; esac
  case "${PLUGIN_REGISTRY:-}" in *"$ARTIFACTAPI_HOST"*) [ -z "${PLUGIN_USERNAME:-}${PLUGIN_PASSWORD:-}" ] || return 0 ;; esac
  case "${PLUGIN_LOGINS:-}" in *"$ARTIFACTAPI_HOST"*) return 0 ;; esac

  sa=${SA_TOKEN_FILE:-/var/run/secrets/kubernetes.io/serviceaccount/token}
  [ -r "$sa" ] || { warn "no service account token at $sa"; return 0; }
  vault=${PLUGIN_VAULT_ADDR:-${VAULT_ADDR:-https://vault.service.consul:8200}}
  role=${PLUGIN_VAULT_ROLE:-woodpecker_artifactapi_writer}
  oidc_role=${PLUGIN_VAULT_OIDC_ROLE:-artifactapi-writer}

  client_token=$(SA_JWT=$(cat "$sa") jq -nc --arg role "$role" '{role:$role,jwt:env.SA_JWT}' |
    curl -sfS --max-time 30 -X POST --data @- "$vault/v1/auth/k8s/au/syd1/login" |
    jq -er .auth.client_token) || { warn "vault login as $role failed"; return 0; }
  token=$(printf 'X-Vault-Token: %s\n' "$client_token" |
    curl -sfS --max-time 30 -H @- "$vault/v1/identity/oidc/token/$oidc_role" |
    jq -er .data.token) || { warn "reading identity/oidc/token/$oidc_role failed"; return 0; }

  PLUGIN_LOGINS=$(printf '%s' "${PLUGIN_LOGINS:-[]}" |
    OIDC_JWT=$token jq -c --arg r "$ARTIFACTAPI_HOST" '. + [{registry:$r,username:"woodpecker",password:env.OIDC_JWT}]') ||
    { warn "PLUGIN_LOGINS is not valid JSON"; return 0; }
  export PLUGIN_LOGINS
  echo "artifactapi-login: logged in to $ARTIFACTAPI_HOST via vault role $role" >&2
}

if [ -z "${ARTIFACTAPI_LOGIN_NOEXEC:-}" ]; then
  artifactapi_login
  exec /usr/local/bin/dockerd-entrypoint.sh plugin-docker-buildx "$@"
fi