locals {
  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
  oauth2_labels = merge(var.labels, {
    "app.kubernetes.io/component" = "authentik-oauth2"
  })
}
resource "random_password" "client_id" {
  length           = 32
  special          = false
}

data "authentik_certificate_key_pair" "ca" {
  name = "authentik Self-signed Certificate"
}

data "authentik_scope_mapping" "oauth2" {
  managed_list = [
    "goauthentik.io/providers/oauth2/scope-email",
    "goauthentik.io/providers/oauth2/scope-openid",
    "goauthentik.io/providers/oauth2/scope-profile"
  ]
}
data "authentik_flow" "default-authorization-flow" {
  slug = "default-provider-authorization-implicit-consent"
}
data "authentik_flow" "default-authentication-flow" {
  slug = "default-authentication-flow"
}

resource "authentik_provider_oauth2" "oauth2" {
  name                = "${local.app_slug}"
  client_id           = random_password.client_id.result
  authentication_flow = data.authentik_flow.default-authentication-flow.id
  authorization_flow  = data.authentik_flow.default-authorization-flow.id
  client_type         = "confidential"
  sub_mode            = "user_username"
  signing_key         = data.authentik_certificate_key_pair.ca.id
  property_mappings   = data.authentik_scope_mapping.oauth2.ids
  redirect_uris = [
    "https://${var.redirect_path!=""?"${var.dns_name}/${var.redirect_path}":"${var.dns_name}"}"
  ]
}

resource "kubernetes_secret_v1" "oauth2-client-id" {
  metadata {
    name      = "${local.app_slug}-id"
    namespace = var.namespace
    labels    = local.oauth2_labels
  }
  data = {
    client-id = random_password.client_id.result
  }
}

resource "kubernetes_secret_v1" "oauth2-client-secret" {
  metadata {
    name      = "${local.app_slug}-secret"
    namespace = var.namespace
    labels    = local.oauth2_labels
  }
  data = {
    client-id = random_password.client_id.result
    client-secret = authentik_provider_oauth2.oauth2.client_secret
  }
}

data "kubernetes_secret_v1" "oauth2-client-secret" {
  depends_on = [kubernetes_secret_v1.oauth2-client-secret]
  metadata {
    name      = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
    namespace = var.namespace
  }
}

data "kubernetes_ingress_v1" "authentik" {
  metadata {
    name      = "authentik"
    namespace = "${var.domain}-auth"
  }
}