#!/usr/bin/env python3
"""wikijs-config.py — idempotenter Bootstrap + Konfiguration von Wiki.js.

Deploybares Äquivalent des manuellen Setup-Assistenten (ADR-0014, #0048/#0049).
Läuft als k8s-Job, nachdem Wiki.js oben ist; treibt die Admin-GraphQL-API. Nur
stdlib. Alle Verträge wurden am 2026-08-12 live gegen die laufende Instanz geprüft.

Ablauf:
  warten -> (falls Setup) /finalize mit SOPS-Admin -> warten auf Normalmodus
  -> login -> OIDC-Strategy setzen -> Gruppen + Seitenregeln (Abschottung).
Idempotent: jeder Schritt prüft erst den Ist-Zustand.
"""
from __future__ import annotations

import json
import os
import sys
import time
import urllib.request
import urllib.error

WIKI = os.environ.get("WIKI_URL", "http://wikijs:3000")
ADMIN_EMAIL = os.environ["WIKI_ADMIN_EMAIL"]
ADMIN_PW = os.environ["WIKI_ADMIN_PASSWORD"]
SITE_URL = os.environ.get("WIKI_SITE_URL", "https://wiki.axion1337.chat")
CLIENT_ID = os.environ["OIDC_CLIENT_ID"]
CLIENT_SECRET = os.environ["OIDC_CLIENT_SECRET"]
AUTH = os.environ.get("AUTHENTIK_URL", "https://auth.axion1337.chat")
APP_SLUG = os.environ.get("OIDC_APP_SLUG", "wiki-js")
# Der Strategy-Key bestimmt die Callback-URL (/login/<key>/callback) und MUSS mit
# der redirect_uri im Authentik-Provider übereinstimmen.
STRATEGY_KEY = os.environ.get("OIDC_STRATEGY_KEY", "d3e7d0e4-adff-4421-b016-7758c44fd697")

ADMIN_PERMS = [
    "manage:system", "manage:users", "manage:groups", "manage:navigation",
    "manage:pages", "write:pages", "read:pages", "manage:assets", "write:assets",
    "read:assets", "manage:comments", "write:comments", "read:comments",
    "read:history", "read:source", "write:styles", "write:scripts",
    "manage:theme", "manage:api",
]
READER_PERMS = ["read:pages", "read:assets", "read:comments"]


def log(msg: str) -> None:
    print(f"[wikijs-config] {msg}", flush=True)


def req(path: str, data=None, headers=None, method=None):
    body = json.dumps(data).encode() if data is not None else None
    r = urllib.request.Request(WIKI + path, data=body, method=method or ("POST" if body else "GET"))
    r.add_header("Content-Type", "application/json")
    for k, v in (headers or {}).items():
        r.add_header(k, v)
    with urllib.request.urlopen(r, timeout=30) as resp:
        raw = resp.read().decode()
        return resp.status, (json.loads(raw) if raw else {})


def gql(query: str, jwt: str | None = None, variables: dict | None = None):
    h = {"Authorization": f"Bearer {jwt}"} if jwt else {}
    _, d = req("/graphql", {"query": query, "variables": variables or {}}, h)
    if d.get("errors"):
        raise RuntimeError(json.dumps(d["errors"]))
    return d["data"]


def wait_reachable():
    # Startseite ist HTML, nicht JSON -> nicht über req()/json.loads prüfen.
    for _ in range(60):
        try:
            with urllib.request.urlopen(WIKI + "/", timeout=10) as r:
                if r.status < 500:
                    return
        except urllib.error.HTTPError as e:
            if e.code < 500:
                return
        except Exception:
            pass
        time.sleep(3)
    sys.exit("Wiki.js nicht erreichbar")


def in_setup_mode() -> bool:
    # Normalmodus: die (öffentliche) login-Mutation ist beantwortbar. Setup-Modus:
    # das Haupt-Schema ist nicht geladen -> die Mutation wirft.
    try:
        gql('mutation{authentication{login(username:"probe@invalid",password:"x",'
            'strategy:"local"){responseResult{succeeded}}}}')
        return False
    except Exception:
        return True


def finalize():
    log("Setup-Modus -> finalize mit SOPS-Admin")
    _, d = req("/finalize", {
        "adminEmail": ADMIN_EMAIL,
        "adminPassword": ADMIN_PW,
        "adminPasswordConfirm": ADMIN_PW,
        "siteUrl": SITE_URL,
        "telemetry": False,
    })
    if not d.get("ok"):
        sys.exit(f"finalize fehlgeschlagen: {d}")
    log("finalize ok, warte auf Normalmodus (Neustart)")
    time.sleep(10)
    for _ in range(40):
        if not in_setup_mode():
            return
        time.sleep(3)
    sys.exit("Normalmodus nicht erreicht")


def login() -> str:
    d = gql(
        'mutation($u:String!,$p:String!){authentication{login(username:$u,password:$p,'
        'strategy:"local"){responseResult{succeeded message} jwt}}}',
        variables={"u": ADMIN_EMAIL, "p": ADMIN_PW},
    )["authentication"]["login"]
    if not d["responseResult"]["succeeded"]:
        sys.exit(f"Login fehlgeschlagen: {d['responseResult']['message']}")
    return d["jwt"]


def _set_strategies(jwt: str, oidc_config: list):
    strategies = [
        {  # local muss in der Liste bleiben (Admin nutzt es), sonst Fehler.
            "key": "local", "strategyKey": "local", "displayName": "Local",
            "order": 0, "isEnabled": True, "selfRegistration": False,
            "domainWhitelist": [], "autoEnrollGroups": [], "config": [],
        },
        {
            "key": STRATEGY_KEY, "strategyKey": "oidc", "displayName": "Authentik",
            "order": 1, "isEnabled": True, "selfRegistration": True,
            "domainWhitelist": [], "autoEnrollGroups": [], "config": oidc_config,
        },
    ]
    r = gql(
        'mutation($s:[AuthenticationStrategyInput]!){authentication{updateStrategies(strategies:$s)'
        '{responseResult{succeeded message}}}}',
        jwt, {"s": strategies},
    )["authentication"]["updateStrategies"]["responseResult"]
    if not r["succeeded"]:
        sys.exit(f"updateStrategies fehlgeschlagen: {r['message']}")


def ensure_oidc(jwt: str):
    # Quellcode-verifiziert: Wiki.js liest jeden Config-Wert via
    # _.get(JSON.parse(value), 'v', null) -> der Wert MUSS als {"v": …} kodiert sein.
    cfg = {
        "clientId": CLIENT_ID, "clientSecret": CLIENT_SECRET,
        "authorizationURL": f"{AUTH}/application/o/authorize/",
        "tokenURL": f"{AUTH}/application/o/token/",
        "userInfoURL": f"{AUTH}/application/o/userinfo/",
        "issuer": f"{AUTH}/application/o/{APP_SLUG}/",
        "logoutURL": f"{AUTH}/application/o/{APP_SLUG}/end-session/",
        "emailClaim": "email", "displayNameClaim": "name",
        "groupsClaim": "groups", "mapGroups": True,
    }
    oidc_config = [{"key": k, "value": json.dumps({"v": v})} for k, v in cfg.items()]
    _set_strategies(jwt, oidc_config)
    log("OIDC-Strategy gesetzt")


def group_id(jwt: str, name: str):
    for g in gql("{groups{list{id name}}}", jwt)["groups"]["list"]:
        if g["name"] == name:
            return g["id"]
    return None


def ensure_group(jwt: str, name: str, perms: list, rules: list):
    gid = group_id(jwt, name)
    if gid is None:
        gql('mutation($n:String!){groups{create(name:$n){responseResult{succeeded message}}}}',
            jwt, {"n": name})
        gid = group_id(jwt, name)
        log(f"Gruppe '{name}' angelegt (id {gid})")
    gql(
        'mutation($id:Int!,$n:String!,$p:[String]!,$r:[PageRuleInput]!){groups{update('
        'id:$id,name:$n,redirectOnLogin:"/",permissions:$p,pageRules:$r){responseResult{succeeded message}}}}',
        jwt, {"id": gid, "n": name, "p": perms, "r": rules},
    )
    log(f"Gruppe '{name}' -> Rechte+Seitenregeln gesetzt")


def rule(rid: str, deny: bool, perms: list, path: str):
    return {"id": rid, "deny": deny, "match": "START", "roles": perms,
            "path": path, "locales": []}


def main():
    log(f"Ziel: {WIKI}")
    wait_reachable()
    if in_setup_mode():
        finalize()
    jwt = login()
    log("eingeloggt")
    ensure_oidc(jwt)
    # authentik Admins: alles lesen+schreiben. wiki-anwender: nur /anwender lesen.
    ensure_group(jwt, "authentik Admins", ADMIN_PERMS, [rule("adm", False, ["read:pages", "write:pages", "manage:pages"], "")])
    ensure_group(jwt, "wiki-anwender", READER_PERMS, [rule("anw", False, READER_PERMS, "anwender")])
    # Guests (id 2) alle Rechte entziehen — Login-Pflicht, keine öffentliche Sicht.
    gql('mutation{groups{update(id:2,name:"Guests",redirectOnLogin:"/",permissions:[],pageRules:[]){responseResult{succeeded}}}}', jwt)
    log("fertig — Wiki.js konfiguriert")


if __name__ == "__main__":
    main()