#!/usr/bin/env bash
# Verify the live KeyCape config carries the OpenBao CLI client and KeyCape is
# serving OIDC discovery after rollout.

set -euo pipefail

NAMESPACE="${KEYCAPE_NAMESPACE:-sso}"
SECRET="${KEYCAPE_CONFIG_SECRET:-keycape-config}"
KUBECTL="${KUBECTL:-kubectl}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

"$KUBECTL" get secret "$SECRET" -n "$NAMESPACE" -o json \
  | python3 "$SCRIPT_DIR/openbao-client-config.py" verify

KC_POD=$("$KUBECTL" get pod -n "$NAMESPACE" \
  -l app.kubernetes.io/name=keycape \
  --field-selector=status.phase=Running \
  -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)

if [[ -z "$KC_POD" ]]; then
  echo "[FAIL] no running KeyCape pod found in namespace $NAMESPACE" >&2
  exit 1
fi

"$KUBECTL" exec -n "$NAMESPACE" "$KC_POD" -- \
  wget -qO- "http://localhost:8080/.well-known/openid-configuration" >/dev/null

echo "[PASS] KeyCape discovery endpoint responds from pod $KC_POD"