#!/usr/bin/env bash
set -euo pipefail

WP_BIN="${WP_BIN:-/usr/local/bin/wp}"
OIDC_OPTION="${OIDC_OPTION:-ufpe_google_oidc_settings}"
BREAK_GLASS_META_KEY="${BREAK_GLASS_META_KEY:-_ufpe_google_local_admin_allowed}"

usage() {
  cat <<'EOF'
Usage:
  ru-prod-oidc-cutover --self-check
  ru-prod-oidc-cutover <wp_path> <plugin_slug> <break_glass_user> <restrict_password_login>
EOF
}

if [[ "${1:-}" == "--self-check" ]]; then
  exit 0
fi

if [[ "$#" -ne 4 ]]; then
  usage >&2
  exit 64
fi

WP_PATH="$1"
PLUGIN_SLUG="$2"
BREAK_GLASS_USER="$3"
RESTRICT_PASSWORD_LOGIN="$4"

if [[ "$RESTRICT_PASSWORD_LOGIN" != "0" && "$RESTRICT_PASSWORD_LOGIN" != "1" ]]; then
  echo "restrict_password_login must be 0 or 1" >&2
  exit 64
fi

BREAK_GLASS_ID="$(sudo -u apache -H "$WP_BIN" --path="$WP_PATH" user get "$BREAK_GLASS_USER" --field=ID)"
if [[ -z "$BREAK_GLASS_ID" ]]; then
  echo "Break-glass user not found: $BREAK_GLASS_USER" >&2
  exit 1
fi

BREAK_GLASS_ROLES="$(sudo -u apache -H "$WP_BIN" --path="$WP_PATH" user get "$BREAK_GLASS_USER" --field=roles)"
if [[ "$BREAK_GLASS_ROLES" != *administrator* ]]; then
  echo "Break-glass user must be administrator: $BREAK_GLASS_USER" >&2
  exit 1
fi

sudo -u apache -H "$WP_BIN" --path="$WP_PATH" plugin activate "$PLUGIN_SLUG"
sudo -u apache -H "$WP_BIN" --path="$WP_PATH" user meta update "$BREAK_GLASS_ID" "$BREAK_GLASS_META_KEY" 1

sudo -u apache -H "$WP_BIN" --path="$WP_PATH" eval "
\$settings = get_option('$OIDC_OPTION', []);
if (! is_array(\$settings)) {
  \$settings = [];
}
\$settings['restrict_password_login'] = '$RESTRICT_PASSWORD_LOGIN';
update_option('$OIDC_OPTION', \$settings, false);
"

sudo -u apache -H "$WP_BIN" --path="$WP_PATH" cache flush
sudo -u apache -H "$WP_BIN" --path="$WP_PATH" plugin status "$PLUGIN_SLUG"
sudo -u apache -H "$WP_BIN" --path="$WP_PATH" user meta get "$BREAK_GLASS_ID" "$BREAK_GLASS_META_KEY"
