package auth

import (
	"context"
	"fmt"
	"os"

	"github.com/hashicorp/vault/api"
)

func init() { register(kubernetesMethod{}) }

// defaultServiceAccountTokenPath is where a projected service account token
// is normally mounted inside a pod.
const defaultServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"

type kubernetesMethod struct{}

func (kubernetesMethod) Name() string         { return "kubernetes" }
func (kubernetesMethod) DisplayName() string  { return "Kubernetes" }
func (kubernetesMethod) DefaultMount() string { return "kubernetes" }

func (kubernetesMethod) Fields() []Field {
	return []Field{
		{Name: "role", Label: "Role", Kind: FieldText, Required: true,
			EnvFallback: []string{"VAULT_AUTH_KUBERNETES_ROLE"}},
		{Name: "jwt_path", Label: "Service account token path", Kind: FieldPath,
			Default: defaultServiceAccountTokenPath},
	}
}

func (kubernetesMethod) Login(ctx context.Context, c *api.Client, req Request) (*api.Secret, error) {
	mount := mountOf(req, "kubernetes")
	jwtPath := req.Creds.Get("jwt_path")
	if jwtPath == "" {
		jwtPath = defaultServiceAccountTokenPath
	}
	jwt, err := os.ReadFile(jwtPath)
	if err != nil {
		return nil, fmt.Errorf("reading service account token from %s: %w", jwtPath, err)
	}
	return loginWrite(ctx, c, mount, "login", map[string]interface{}{
		"role": req.Creds.Get("role"),
		"jwt":  string(jwt),
	})
}