"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.generateConfigureKeycloakSh = generateConfigureKeycloakSh;
function generateConfigureKeycloakSh({ keycloak }) {
    if (!keycloak) {
        return '';
    }
    return /*sh*/ `#!/bin/bash

set -e

${keycloak.components.includes('customScripts') ? customScripts : ''}

# Start Keycloak in the background to configure it
/opt/keycloak/bin/kc.sh start-dev &

# Wait for Keycloak to start by checking its log output
echo "Waiting for Keycloak to start..."
until /opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user $KEYCLOAK_ADMIN --password $KEYCLOAK_ADMIN_PASSWORD; do
  echo "Not ready yet, will try again in 5 seconds..."
  sleep 5
done
echo "Keycloak is ready!"

## retrieve realm
realm_info=$(/opt/keycloak/bin/kcadm.sh get realms/$KEYCLOAK_REALM --fields=id 2>/dev/null || echo "not found")

## Check if realm_info is not empty
if [[ "$realm_info" == "not found" ]]; then
  # Configure the admin user and import the realm
  /opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user $KEYCLOAK_ADMIN --password $KEYCLOAK_ADMIN_PASSWORD
  /opt/keycloak/bin/kcadm.sh create realms -s realm=$KEYCLOAK_REALM \\
    -s 'attributes.frontendUrl='$KEYCLOAK_URL \\
    -s enabled=true

  ${keycloak.components.includes('toc') ? toc : ''}

  # create a new development user
  /opt/keycloak/bin/kcadm.sh create users -r $KEYCLOAK_REALM \\
    -s username=$DEV_USERNAME \\
    -s firstName="Developer" \\
    -s lastName="Account" \\
    -s email="dev@postxl.com" \\
    -s emailVerified=true \\
    -s 'credentials=[{"type":"password","value":"'$DEV_PASSWORD'"}]' \\
    -s enabled=true

  # Create a new client
  INTERNAL_CLIENT_ID=$(/opt/keycloak/bin/kcadm.sh create clients -i -r $KEYCLOAK_REALM \\
    -s clientId=$KEYCLOAK_CLIENT_ID \\
    -s secret=$KEYCLOAK_CLIENT_SECRET \\
    -s 'rootUrl='$KEYCLOAK_URL \\
    -s 'adminUrl='$KEYCLOAK_URL \\
    -s 'redirectUris=["'$KEYCLOAK_REDIRECT_URL'"]' \\
    -s 'attributes={"post.logout.redirect.uris": "http://localhost:3000/*##http://localhost:3001/*"}' \\
    -s 'webOrigins=["*"]' \\
    -s publicClient=false \\
    -s clientAuthenticatorType="client-secret" \\
    -s enabled=true)

  ${keycloak.components.includes('userAttributes') ? userAttributes : ''}

  ${keycloak.components.includes('samlIdp') ? samlIdp : ''}

  ${keycloak.components.includes('idpMapper') ? idpMappers : ''}
else
  echo "Realm '$KEYCLOAK_REALM' already exists!"
fi

# Shutdown Keycloak gracefully
kill $(jobs -p)

# Wait for shutdown
wait

# Start Keycloak dev server in the foreground
exec /opt/keycloak/bin/kc.sh start-dev \\
  --hostname-strict=false \\
  --hostname-admin $KEYCLOAK_ADMIN_URL \\
  --http-relative-path /auth/ 
  # --proxy-headers xforwarded

# # Start Keycloak in the foreground
# exec /opt/keycloak/bin/kc.sh start --hostname-strict=false
`;
}
const customScripts = `
# We need to build the Keycloak server if we want to use custom scripts
/opt/keycloak/bin/kc.sh build \\
  --http-relative-path=/auth/
  --features="scripts"
`;
const toc = `
  # Enable terms and conditions and update localization
  /opt/keycloak/bin/kcadm.sh update realms/usp/authentication/required-actions/TERMS_AND_CONDITIONS -r $KEYCLOAK_REALM -s enabled="true" -s defaultAction="true"
  /opt/keycloak/bin/kcadm.sh create realms/$KEYCLOAK_REALM/localization/en -r $KEYCLOAK_REALM -f /opt/keycloak/config/localization.en.json
`;
const userAttributes = `
  # Update user attributes
  /opt/keycloak/bin/kcadm.sh update realms/$KEYCLOAK_REALM/users/profile -r $KEYCLOAK_REALM -f /opt/keycloak/config/user-attributes.json

  # Creating protocol mappers
  CLIENT_SCOPE_ID=$(/opt/keycloak/bin/kcadm.sh get client-scopes -r $KEYCLOAK_REALM --fields=id,name | grep -B 1 '"name" : "profile"' | grep '"id" :' | sed 's/.*"id" : "\\(.*\\)".*/\\1/')
  /opt/keycloak/bin/kcadm.sh create client-scopes/$CLIENT_SCOPE_ID/protocol-mappers/add-models -r $KEYCLOAK_REALM -f /opt/keycloak/config/protocol-mappers.json
`;
const samlIdp = `
  # Adding identity provider
  /opt/keycloak/bin/kcadm.sh create identity-provider/instances -r $KEYCLOAK_REALM \\
    -s alias=saml \\
    -s displayName=Saml \\
    -s providerId=saml \\
    -s enabled=true \\
    -s updateProfileFirstLoginMode=on \\
    -s config.signingCertificate="$SAML_CERTIFICATE" \\
    -s config.postBindingLogout=true \\
    -s config.nameIDPolicyFormat=$SAML_NAME_POLICY_FORMAT \\
    -s config.postBindingResponse=true \\
    -s config.singleLogoutServiceUrl=$SAML_SINGLE_LOGOUT_URL \\
    -s config.entityId=$SAML_ENTITY_ID \\
    -s config.idpEntityId=$SAML_IDP_ENTITY_ID \\
    -s config.allowCreate=true \\
    -s config.wantAssertionsSigned=true \\
    -s config.postBindingAuthnRequest=true \\
    -s config.syncMode=LEGACY \\
    -s config.singleSignOnServiceUrl=$SAML_SINGLE_SIGN_ON_URL \\
    -s config.wantAuthnRequestsSigned=true
`;
const idpMappers = `
  # Adding identity provider mappers
  /opt/keycloak/bin/kcadm.sh create identity-provider/instances/saml/mappers -r $KEYCLOAK_REALM \\
    -s name=groupmembership \\
    -s identityProviderAlias=saml \\
    -s identityProviderMapper=saml-user-attribute-idp-mapper \\
    -s config.\\"user.attribute\\"=groups \\
    -s config.\\"attribute.name\\"=groupmembership

  /opt/keycloak/bin/kcadm.sh create identity-provider/instances/saml/mappers -r $KEYCLOAK_REALM \\
    -s name=lastName \\
    -s identityProviderAlias=saml \\
    -s identityProviderMapper=saml-user-attribute-idp-mapper \\
    -s config.\\"user.attribute\\"=lastName \\
    -s config.\\"attribute.name\\"=lastName

  /opt/keycloak/bin/kcadm.sh create identity-provider/instances/saml/mappers -r $KEYCLOAK_REALM \\
    -s name=uuid \\
    -s identityProviderAlias=saml \\
    -s identityProviderMapper=saml-user-attribute-idp-mapper \\
    -s config.\\"user.attribute\\"=uuid \\
    -s config.\\"attribute.name\\"=uuid

  /opt/keycloak/bin/kcadm.sh create identity-provider/instances/saml/mappers -r $KEYCLOAK_REALM \\
    -s name=firstName \\
    -s identityProviderAlias=saml \\
    -s identityProviderMapper=saml-user-attribute-idp-mapper \\
    -s config.\\"user.attribute\\"=firstName \\
    -s config.\\"attribute.name\\"=firstName
`;
//# sourceMappingURL=configure-keycloak-sh.generator.js.map