from pathlib import Path

from authentik.core.models import Application, Group, Token, TokenIntents, User
from authentik.policies.models import PolicyBinding

ADMIN_USERNAME = "liooil"
FAMILY_GROUP = "liuhome"
TOKEN_IDENTIFIER = "xiteng-portal-admin"
TOKEN_PATH = Path("/run/secrets/portal_api_token")
MANAGED_APPLICATIONS = [
    "xiteng-portal-admin",
    "xiteng-portal",
    "xiteng-chat",
    "code-server",
    "comfyui",
    "invokeai",
    "gitea",
    "hedgedoc",
    "hedgedoc2",
    "minio",
    "seaweedfs",
    "remark42",
]

liooil = User.objects.get(username=ADMIN_USERNAME)
admin_group = Group.objects.get(name="authentik Admins")
admin_group.users.add(liooil)

User.objects.filter(username="akadmin").delete()

liuhome, _ = Group.objects.get_or_create(
    name=FAMILY_GROUP,
    defaults={"is_superuser": False},
)
if liuhome.is_superuser:
    liuhome.is_superuser = False
    liuhome.save(update_fields=["is_superuser"])
for username in ["liooil", "ziyue"]:
    liuhome.users.add(User.objects.get(username=username))

for application in Application.objects.filter(slug__in=MANAGED_APPLICATIONS):
    PolicyBinding.objects.filter(target=application).delete()
    PolicyBinding.objects.create(
        target=application,
        group=liuhome,
        order=0,
        enabled=True,
        negate=False,
        failure_result=False,
    )

Token.objects.filter(identifier=TOKEN_IDENTIFIER).delete()
token = Token.objects.create(
    identifier=TOKEN_IDENTIFIER,
    intent=TokenIntents.INTENT_API,
    user=liooil,
    description="Xiteng Portal Authentik administration",
    expiring=False,
)
TOKEN_PATH.write_text(token.key, encoding="utf-8")
TOKEN_PATH.chmod(0o600)

print(
    f"Identity bootstrap complete: administrator={ADMIN_USERNAME}, "
    f"group={FAMILY_GROUP}, applications={len(MANAGED_APPLICATIONS)}"
)