{{- define "deploykf-auth.dex.config.yaml" }}
{{- /*
The following config has Helm templates `{{ ... }}`, in addition to gomplate templates `<< ... >>`.
The gomplate templates are provided by the `entrypoint.sh` script of the dex container image,
and are seperate from deploKF's gomplate templates.
*/}}
## the base path of dex and the external name of the OpenID Connect service
{{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
issuer: "https://{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/dex"
{{- else }}
issuer: "http://{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/dex"
{{- end }}

## configs for how dex stores its state
storage:
  type: kubernetes
  config:
    inCluster: true

## configs for the web endpoints
web:
  http: 0.0.0.0:5556

## configs for the telemetry endpoints
telemetry:
  http: 0.0.0.0:5558

## configs for the UI
frontend:
  issuer: deployKF Auth
  logoURL: theme/logo.svg
  dir: "/srv/dex/web"
  theme: light

## configs for logging
logger:
  level: {{ .Values.dex.logLevel | quote }}
  format: text

## configs for token/key expiration
expiry:
  ## the duration of time for which the DeviceRequests will be valid
  deviceRequests: {{ .Values.dex.expiry.deviceRequests | quote }}

  ## the duration of time for which the IdTokens will be valid
  idTokens: {{ .Values.dex.expiry.idTokens | quote }}

  ## the duration of time after which the SigningKeys will be rotated
  signingKeys: {{ .Values.dex.expiry.signingKeys | quote }}

  ## refresh tokens expiry policy
  refreshTokens:
    ## get the same refresh token from refresh endpoint within this interval
    reuseInterval: {{ .Values.dex.expiry.refreshTokens.reuseInterval | quote }}

    ## max time since last use of a refresh token
    validIfNotUsedFor: {{ .Values.dex.expiry.refreshTokens.validIfNotUsedFor | quote }}

    ##  max total lifetime of a refresh token
    absoluteLifetime: {{ .Values.dex.expiry.refreshTokens.absoluteLifetime | quote }}

## configs for oauth2
oauth2:
  responseTypes: ["code", "token", "id_token"]
  skipApprovalScreen: true

## configs for OpenID clients of dex
staticClients:

  ## the OpenID client for "OAUTH2 Proxy"
  - name: "OAUTH2 Proxy"
    id: {{ .Values.dex.clients.oauth2Proxy.clientId | quote }}
    {{- if .Values.dex.clients.oauth2Proxy.clientSecret.existingSecret }}
    secret: << getenv "CONFIG__CLIENT_SECRET__OAUTH2_PROXY" | quote >>
    {{- else }}
    secret: {{ .Values.dex.clients.oauth2Proxy.clientSecret.value | quote }}
    {{- end }}
    redirectURIs:
      {{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
      - "https://{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/oauth2/callback"
      {{- else }}
      - "http://{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/oauth2/callback"
      {{- end }}

  {{ if .Values.dex.clients.minioConsole.enabled -}}
  ## the OpenID client for "Minio Console"
  - name: "Minio Console"
    id: {{ .Values.dex.clients.minioConsole.clientId | quote }}
    {{- if .Values.dex.clients.minioConsole.clientSecret.existingSecret }}
    secret: << getenv "CONFIG__CLIENT_SECRET__MINIO_CONSOLE" | quote >>
    {{- else }}
    secret: {{ .Values.dex.clients.minioConsole.clientSecret.value | quote }}
    {{- end }}
    redirectURIs:
    {{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
      - "https://minio-console.{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/oauth_callback"
    {{- else }}
      - "http://minio-console.{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/oauth_callback"
    {{- end }}
  {{- end }}

  {{ if .Values.dex.clients.argoServer.enabled -}}
  ## the OpenID client for "Argo Server"
  - name: "Argo Server"
    id: {{ .Values.dex.clients.argoServer.clientId | quote }}
    {{- if .Values.dex.clients.argoServer.clientSecret.existingSecret }}
    secret: << getenv "CONFIG__CLIENT_SECRET__ARGO_SERVER" | quote >>
    {{- else }}
    secret: {{ .Values.dex.clients.argoServer.clientSecret.value | quote }}
    {{- end }}
    redirectURIs:
    {{- if .Values.deployKF.gateway.tls.clientsUseHttps }}
      - "https://argo-server.{{ .Values.deployKF_helpers.deploykf_gateway.https_endpoint }}/oauth2/callback"
    {{- else }}
      - "http://argo-server.{{ .Values.deployKF_helpers.deploykf_gateway.http_endpoint }}/oauth2/callback"
    {{- end }}
  {{- end }}

  {{ if .Values.dex.clients.kubeflowPipelinesSDK.enabled -}}
  ## the OpenID client for "Kubeflow Pipelines SDK"
  - name: "Kubeflow Pipelines SDK"
    id: {{ .Values.dex.clients.kubeflowPipelinesSDK.clientId | quote }}
    ## NOTE: this client is used on end-user machines, so it does not have a client secret
    public: true
    redirectURIs:
      - "urn:ietf:wg:oauth:2.0:oob"
  {{- end }}

## configs for upstream identity providers for authenticating users
{{- if .Values.dex.connectors }}
connectors:
  {{- range $connector := .Values.dex.connectors }}
  {{- $connector_env := "" }}
  {{- if and $connector.configExistingSecret $connector.configExistingSecretKey }}
  {{- $connector_env = include "deploykf-auth.dex.connector_env" (dict "name" $connector.configExistingSecret "key" $connector.configExistingSecretKey) }}
  {{- end }}
  - type: {{ $connector.type | quote }}
    id: {{ $connector.id | quote }}
    name: {{ $connector.name | quote }}
    {{- if $connector_env }}
    config: << getenv {{ $connector_env | quote }} | yaml | toJSON >>
    {{- else }}
    config: {{ $connector.config | toJson }}
    {{- end }}
  {{- end }}
{{- else }}
connectors: []
{{- end }}

## must be `true` if any `staticPasswords` are provided
{{- if .Values.dex.staticPasswords }}
enablePasswordDB: true
{{- else }}
enablePasswordDB: false
{{- end }}

## a list of static credentials
{{- if .Values.dex.staticPasswords }}
staticPasswords:
  {{- range $user := .Values.dex.staticPasswords }}
  {{- $password_type := $user.password.type | default "plain" }}
  {{- $password_env := "" }}
  {{- if and $user.password.existingSecret $user.password.existingSecretKey }}
  {{- $password_env = include "deploykf-auth.dex.password_env" (dict "name" $user.password.existingSecret "key" $user.password.existingSecretKey) }}
  {{- end }}
  - email: {{ $user.email | quote }}
    username: {{ $user.email | quote }}
    userID: {{ $user.email | quote }}
    {{- if eq $password_type "plain" }}
    {{- if $password_env }}
    hash: << getenv {{ $password_env | quote }} | crypto.Bcrypt | quote >>
    {{- else }}
    hash: << {{ $user.password.value | quote }} | crypto.Bcrypt | quote >>
    {{- end }}
    {{- else if eq $password_type "hash" }}
    {{- if $password_env }}
    hash: << getenv {{ $password_env | quote }} | quote >>
    {{- else }}
    hash: {{ $user.password.value | quote }}
    {{- end }}
    {{- else }}
    {{- fail (printf "user '%s' has invalid `password.type`, must be 'plain' or 'hash', but got: %s" $user.email $password_type) }}
    {{- end }}
  {{- end }}
{{- else }}
staticPasswords: []
{{- end }}
{{- end }}

apiVersion: v1
kind: Secret
metadata:
  name: dex-config
  labels:
    helm.sh/chart: {{ include "deploykf-auth.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: dex
data:
  config.yaml: {{ include "deploykf-auth.dex.config.yaml" . | b64enc | quote }}