apiVersion: batch/v1
kind: Job
metadata:
  name: keycloak-client-sync
  annotations:
    argocd.argoproj.io/sync-wave: "4"
spec:
  backoffLimit: 5
  template:
    metadata:
      labels:
        app: keycloak-client-sync
    spec:
      serviceAccountName: keycloak-client-sync
      restartPolicy: OnFailure
      containers:
        - name: keycloak-client-sync
          image: quay.io/keycloak/keycloak:26.5.5
          command:
            - /bin/sh
            - -c
            - |
              set -eu

              until /opt/keycloak/bin/kcadm.sh config credentials \
                --server http://keycloak.platform.svc.cluster.local \
                --realm master \
                --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
                --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; do
                sleep 5
              done

              CLIENT_UUID=$(/opt/keycloak/bin/kcadm.sh get clients \
                -r project-auth \
                -q clientId="$KEYCLOAK_CLIENT_ID" | sed -n 's/.*"id" : "\([^"]*\)".*/\1/p' | head -n 1)

              test -n "$CLIENT_UUID"

              /opt/keycloak/bin/kcadm.sh update "clients/${CLIENT_UUID}" \
                -r project-auth \
                -s "secret=$KEYCLOAK_CLIENT_SECRET" \
                -s "baseUrl=$AUTH_SERVER_BASE_URL" \
                -s 'redirectUris=["'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-google","'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-github"]' \
                -s 'webOrigins=["'"$AUTH_SERVER_BASE_URL"'"]'
          env:
            - name: KC_BOOTSTRAP_ADMIN_USERNAME
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: keycloak-bootstrap-admin
                  key: KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD
            - name: KEYCLOAK_CLIENT_ID
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: KEYCLOAK_CLIENT_ID
            - name: KEYCLOAK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: keycloak-client-auth-server
                  key: KEYCLOAK_CLIENT_SECRET
            - name: AUTH_SERVER_BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: platform-config
                  key: AUTH_SERVER_BASE_URL