#!/usr/bin/env bash
set -Eeuo pipefail

if [[ $# -ne 2 || ! -r $1 || ! -r $2 ]]; then
  echo "Usage: $0 <env-file> <ldap-password-file>" >&2
  exit 2
fi

config_file=$(cd -- "$(dirname -- "$1")" && pwd)/$(basename -- "$1")
script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
set -a
# shellcheck source=/dev/null
source "$config_file"
set +a

LDAP_START_TLS=${LDAP_START_TLS:-false}
LDAP_ACCOUNT_ATTRIBUTE=${LDAP_ACCOUNT_ATTRIBUTE:-uid}
LDAP_FULL_NAME_ATTRIBUTE=${LDAP_FULL_NAME_ATTRIBUTE:-cn}
LDAP_EMAIL_ATTRIBUTE=${LDAP_EMAIL_ATTRIBUTE:-mail}
LDAP_GROUP_ATTRIBUTE=${LDAP_GROUP_ATTRIBUTE:-cn}
LDAP_GROUP_MEMBER_ATTRIBUTE=${LDAP_GROUP_MEMBER_ATTRIBUTE:-uniqueMember}

for variable in LDAP_SERVER LDAP_BIND_DN LDAP_ACCOUNT_BASE LDAP_GROUP_BASE; do
  [[ -n ${!variable:-} ]] || { echo "$variable must be set" >&2; exit 2; }
done

compose=(docker compose --env-file "$config_file" -f "$script_dir/compose.yaml")
# Expanded by the shell inside the container.
# shellcheck disable=SC2016
"${compose[@]}" exec -T \
  -e LDAP_SERVER="$LDAP_SERVER" \
  -e LDAP_START_TLS="$LDAP_START_TLS" \
  -e LDAP_BIND_DN="$LDAP_BIND_DN" \
  -e LDAP_ACCOUNT_BASE="$LDAP_ACCOUNT_BASE" \
  -e LDAP_ACCOUNT_ATTRIBUTE="$LDAP_ACCOUNT_ATTRIBUTE" \
  -e LDAP_FULL_NAME_ATTRIBUTE="$LDAP_FULL_NAME_ATTRIBUTE" \
  -e LDAP_EMAIL_ATTRIBUTE="$LDAP_EMAIL_ATTRIBUTE" \
  -e LDAP_GROUP_BASE="$LDAP_GROUP_BASE" \
  -e LDAP_GROUP_ATTRIBUTE="$LDAP_GROUP_ATTRIBUTE" \
  -e LDAP_GROUP_MEMBER_ATTRIBUTE="$LDAP_GROUP_MEMBER_ATTRIBUTE" \
  gerrit sh -eu -c '
password=$(cat)
if [ -z "$password" ]; then
  echo "LDAP password must not be empty" >&2
  exit 2
fi

config=/var/gerrit/etc/gerrit.config
secure_config=/var/gerrit/etc/secure.config
account_pattern="(${LDAP_ACCOUNT_ATTRIBUTE}=\${username})"
group_pattern="(${LDAP_GROUP_ATTRIBUTE}=\${groupname})"
group_member_pattern="(${LDAP_GROUP_MEMBER_ATTRIBUTE}=\${dn})"

git config -f "$config" --replace-all auth.type LDAP
git config -f "$config" --replace-all auth.gitBasicAuthPolicy HTTP_LDAP
git config -f "$config" --replace-all ldap.server "$LDAP_SERVER"
git config -f "$config" --replace-all ldap.startTls "$LDAP_START_TLS"
git config -f "$config" --replace-all ldap.username "$LDAP_BIND_DN"
git config -f "$config" --replace-all ldap.accountBase "$LDAP_ACCOUNT_BASE"
git config -f "$config" --replace-all ldap.accountPattern "$account_pattern"
git config -f "$config" --replace-all ldap.accountFullName "$LDAP_FULL_NAME_ATTRIBUTE"
git config -f "$config" --replace-all ldap.accountEmailAddress "$LDAP_EMAIL_ATTRIBUTE"
git config -f "$config" --replace-all ldap.accountSshUserName "$LDAP_ACCOUNT_ATTRIBUTE"
git config -f "$config" --replace-all ldap.groupBase "$LDAP_GROUP_BASE"
git config -f "$config" --replace-all ldap.groupPattern "$group_pattern"
git config -f "$config" --replace-all ldap.groupMemberPattern "$group_member_pattern"

umask 077
git config -f "$secure_config" --replace-all ldap.password "$password"
chmod 600 "$secure_config"
' < "$2"

"${compose[@]}" restart gerrit