#!/usr/bin/env sh
set -eu

if [ ! -f .env ]; then
  echo "missing .env" >&2
  exit 1
fi

set -a
. ./.env
set +a

keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
realm="${KEYCLOAK_REALM:-keycloak-patterns}"
profile_url="$keycloak_url/admin/realms/$realm/users/profile"

admin_token="$(
  curl -fsS \
    -d client_id=admin-cli \
    -d grant_type=password \
    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
    "$keycloak_url/realms/master/protocol/openid-connect/token" |
    jq -er .access_token
)"

profile="$(curl -fsS -H "Authorization: Bearer $admin_token" "$profile_url")"
updated_profile="$(
  printf '%s' "$profile" |
    jq '
      def broker_attribute($name; $label): {
        name: $name,
        displayName: $label,
        validations: {length: {max: 2048}},
        permissions: {
          view: ["admin", "user"],
          edit: ["admin"]
        },
        multivalued: false,
        group: "user-metadata"
      };
      if any(.attributes[]; .name == "picture") then .
      else .attributes += [broker_attribute("picture"; "Profile picture URL")]
      end |
      if any(.attributes[]; .name == "hd") then .
      else .attributes += [broker_attribute("hd"; "Hosted domain")]
      end
    '
)"

printf '%s' "$updated_profile" |
  curl -fsS -X PUT \
    -H "Authorization: Bearer $admin_token" \
    -H "Content-Type: application/json" \
    --data @- \
    "$profile_url"

echo "Broker user-profile attributes configured for realm '$realm'"