#!/bin/bash
# Create a Matrix user on this Synapse homeserver.
#
# Element 1.11+ requires OIDC for self-service registration and does not
# support the traditional open-registration flow. Use this script to create
# the initial admin account and any subsequent accounts.
set -e
set -o pipefail

if [ -z "${KUBECONFIG}" ] || [ -z "${WILD_INSTANCE}" ] || [ -z "${WILD_API_DATA_DIR}" ]; then
    echo "ERROR: KUBECONFIG, WILD_INSTANCE, and WILD_API_DATA_DIR must be set"
    exit 1
fi

if [ -z "${USERNAME}" ]; then
    echo "ERROR: USERNAME is required"
    exit 1
fi

if [ -z "${ADMIN}" ]; then
    echo "ERROR: ADMIN is required (true or false)"
    exit 1
fi

SECRETS_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/secrets.yaml"
CONFIG_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/config.yaml"

REGISTRATION_SHARED_SECRET="$(yq '.apps.synapse.registrationSharedSecret' "${SECRETS_FILE}" | tr -d '"')"
if [ -z "${REGISTRATION_SHARED_SECRET}" ] || [ "${REGISTRATION_SHARED_SECRET}" = "null" ]; then
    echo "ERROR: apps.synapse.registrationSharedSecret not found in secrets.yaml"
    exit 1
fi

NAMESPACE="$(yq '.apps.synapse.namespace' "${CONFIG_FILE}" | tr -d '"')"
NAMESPACE="${NAMESPACE:-synapse}"

SERVER_NAME="$(yq '.apps.synapse.serverName' "${CONFIG_FILE}" | tr -d '"')"

POD="$(kubectl get pods -n "${NAMESPACE}" -l component=synapse --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)"
if [ -z "${POD}" ]; then
    echo "ERROR: No running Synapse pod found in namespace ${NAMESPACE}"
    exit 1
fi

if [ -z "${PASSWORD}" ]; then
    PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)"
fi

if [ "${ADMIN}" = "true" ] || [ "${ADMIN}" = "1" ]; then
    ADMIN_FLAG="-a"
else
    ADMIN_FLAG="--no-admin"
fi

echo "Creating user '@${USERNAME}:${SERVER_NAME}' (admin: ${ADMIN})..."

kubectl exec -n "${NAMESPACE}" "${POD}" -- \
    register_new_matrix_user \
    -k "${REGISTRATION_SHARED_SECRET}" \
    -u "${USERNAME}" \
    -p "${PASSWORD}" \
    ${ADMIN_FLAG} \
    http://localhost:8008

echo ""
echo "=== User created ==="
echo "Username: @${USERNAME}:${SERVER_NAME}"
echo "Password: ${PASSWORD}"
echo ""
echo "Save this password — it will not be shown again."