#!/usr/bin/env bash
# Census and repair the OAuth2 defaults on every authentik PROXY provider.
#
# A proxy provider built by hand in `ak shell` never runs
# ProxyProvider.set_oauth_defaults() — the REST serializer calls it, the ORM does
# not — so the row looks perfectly configured (external_host, internal_host,
# application bound, embedded-outpost claim present) while three OAuth facts are
# blank. Each one kills the guarded login in a different, unrelated-looking way,
# all BEFORE any credential is asked for:
#
#   * redirect_uris empty -> authentik answers its own page:
#     "Redirect URI Error — The request fails due to a missing, invalid, or
#     mismatching redirection URI (redirect_uri)". Measured on abs-proxy
#     (abs.franksdank.cloud) 2026-11-03.
#   * grant_types empty -> the authorize endpoint refuses the outpost's
#     authorization-code request with a bodiless HTTP 400 (Chromium renders
#     "This page isn't working / HTTP ERROR 400"). Same provider, one step
#     later, after the URIs were filled in by hand.
#   * authorization_flow NULL -> the authorize view crashes building its flow
#     planner: AttributeError 'NoneType' object has no attribute 'slug', HTTP
#     500. That is what authentik-grafana-sso-fix.sh exists for.
#
# So: a guard that shows ANY of those three pages is not an Anubis problem and
# not a Caddy problem — run this script before touching the route.
#
# Repair calls the VENDOR's own set_oauth_defaults() (grant_types = authz code +
# client credentials + password, confidential client, the stock scope mappings,
# redirect_uris derived from external_host by _get_callback_url) and points the
# authorization flow at default-provider-authorization-implicit-consent, the flow
# every working provider here uses. Providers that already match are untouched,
# so a deliberate per-provider deviation is never silently flattened.
#
# This is authentik DB state. It is NOT in any deployable file: a blueprint
# re-import, or an ak-shell re-creation of a provider, reverts these facts and
# the symptom returns verbatim. Re-run after any such rebuild. Idempotent.
#
# Usage: authentik-proxy-provider-defaults.sh [--check]
#          no argument  repair what drifts, print one line per provider
#          --check       census only, exit 1 if anything drifts (gate use)
#        override host: AUTHENTIK_HOST=…
set -euo pipefail
HOST="${AUTHENTIK_HOST:-dankclaw}"
MODE="${1:-}"
case "$MODE" in
    "" | --check) : ;;
    *) echo "usage: $(basename "$0") [--check]" >&2; exit 2 ;;
esac

ssh "$HOST" 'podman exec -i authentik-server ak shell' <<PYEOF
from authentik.flows.models import Flow
from authentik.providers.proxy.models import ProxyProvider, _get_callback_url

CHECK = $( [ "$MODE" = "--check" ] && echo True || echo False )
FLOW = "default-provider-authorization-implicit-consent"
WANT_GRANTS = ["authorization_code", "client_credentials", "password"]

flow = Flow.objects.filter(slug=FLOW).first()
if not flow and not CHECK:
    raise SystemExit("flow %s is missing; nothing was changed" % FLOW)

drift = 0
for p in ProxyProvider.objects.all().order_by("pk"):
    want_uris = [u.url for u in _get_callback_url(p.external_host)]
    have_uris = [u.url for u in p.redirect_uris]
    bad = []
    if [str(g) for g in p.grant_types] != WANT_GRANTS:
        bad.append("grant_types=%s" % [str(g) for g in p.grant_types])
    if have_uris != want_uris:
        bad.append("redirect_uris=%s" % have_uris)
    if p.authorization_flow_id is None:
        bad.append("authorization_flow=None")
    if not bad:
        print("ok   %s (ext %s)" % (p.name, p.external_host))
        continue
    drift += 1
    if CHECK:
        print("DRIFT %s: %s" % (p.name, "; ".join(bad)))
        continue
    print("fix  %s: %s" % (p.name, "; ".join(bad)))
    p.set_oauth_defaults()
    if p.authorization_flow_id is None:
        p.authorization_flow = flow
    p.save()
    after = ProxyProvider.objects.get(pk=p.pk)
    print("     -> grants %s, %d redirect URIs, flow %s"
          % ([str(g) for g in after.grant_types], len(after.redirect_uris),
             after.authorization_flow and after.authorization_flow.slug))

print("providers checked, drift: %d" % drift)
raise SystemExit(1 if (CHECK and drift) else 0)
PYEOF

echo "Verify: walk the guarded vhost in a browser — Anubis solves, authentik"
echo "renders its login form (no Redirect URI Error, no HTTP 400), and the"
echo "callback lands back on the app."