#!/usr/bin/env bash
set -euo pipefail

GITLAB_URL="https://gitlab.com"     # oder eigene GitLab-Instanz, ohne abschließenden /
PROJECT_ID="12345678"               # Projekt-ID aus GitLab (Einstellungen → Allgemein)

SUB_ID=$(az account show --query id -o tsv)
TENANT_ID=$(az account show --query tenantId -o tsv)
SA=$(awk -F'"' '/storage_account_name/ {print $2}' "$(dirname "$0")/../backend.hcl")
SA_ID=$(az storage account show -n "$SA" -g rg-iac-tfstate --query id -o tsv)

create_app() {
  local app_id
  app_id=$(az ad app create --display-name "$1" --query appId -o tsv)
  az ad sp create --id "$app_id" -o none
  echo "$app_id"
}

PLAN_APP=$(create_app sp-iaclab-plan)
APPLY_APP=$(create_app sp-iaclab-apply)

echo "Warte auf Propagierung der Service Principals ..."
sleep 30

# --- Rollen ---------------------------------------------------------------
az role assignment create --assignee "$PLAN_APP"  --role "Reader" \
  --scope "/subscriptions/$SUB_ID" -o none
az role assignment create --assignee "$PLAN_APP"  --role "Storage Blob Data Reader" \
  --scope "$SA_ID" -o none

az role assignment create --assignee "$APPLY_APP" --role "Contributor" \
  --scope "/subscriptions/$SUB_ID" -o none
az role assignment create --assignee "$APPLY_APP" --role "Storage Blob Data Contributor" \
  --scope "$SA_ID" -o none

# --- Apply: normaler Federated Credential, nur Branch main -----------------
az ad app federated-credential create --id "$APPLY_APP" --parameters "{
  \"name\": \"gitlab-main\",
  \"issuer\": \"$GITLAB_URL\",
  \"subject\": \"project_id:$PROJECT_ID:ref_type:branch:ref:main\",
  \"audiences\": [\"api://AzureADTokenExchange\"]
}"

# --- Plan: Flexible Federated Credential (Preview), alle Branches ----------
# Ausdruck vor dem Einsatz mit der aktuellen Microsoft-Doku zu
# "Flexible federated identity credentials" abgleichen.
PLAN_OBJ=$(az ad app show --id "$PLAN_APP" --query id -o tsv)
az rest --method POST \
  --uri "https://graph.microsoft.com/beta/applications/$PLAN_OBJ/federatedIdentityCredentials" \
  --headers "Content-Type=application/json" \
  --body "{
    \"name\": \"gitlab-all-branches\",
    \"issuer\": \"$GITLAB_URL\",
    \"audiences\": [\"api://AzureADTokenExchange\"],
    \"claimsMatchingExpression\": {
      \"value\": \"claims['sub'] matches 'project_id:$PROJECT_ID:ref_type:branch:ref:*' and claims['project_id'] eq '$PROJECT_ID'\",
      \"languageVersion\": 1
    }
  }"

cat <<EOF

In GitLab unter Einstellungen → CI/CD → Variablen eintragen:
  ARM_TENANT_ID          = $TENANT_ID
  ARM_SUBSCRIPTION_ID    = $SUB_ID
  AZURE_CLIENT_ID_PLAN   = $PLAN_APP
  AZURE_CLIENT_ID_APPLY  = $APPLY_APP
  SSH_PUBLIC_KEY         = (Typ "Datei", Inhalt des öffentlichen Notfall-Schlüssels)
EOF