import paramiko
import json
import time

def configure_spaceport_technitium():
    print("=== Configuring Spaceport Technitium SSO ===")
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect('140.44.4.41', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

    # Login to get token
    stdin, stdout, stderr = ssh.exec_command('k3s kubectl exec -n dns deployment/technitium-dns -- curl -s "http://localhost:5380/api/user/login?user=admin&pass=snarfnetadmin"')
    data = json.loads(stdout.read().decode())
    token = data['token']
    print("Spaceport Technitium Token:", token)

    url = (
        f'"http://localhost:5380/api/admin/sso/set?token={token}'
        '&ssoEnabled=true'
        '&ssoAuthority=https://authentik.snarfnet.net/application/o/dns2/'
        '&ssoClientId=technitium2-dns-oidc'
        '&ssoClientSecret=SnarfNetTechnitiumOIDC2026!'
        '&ssoMetadataAddress=https://authentik.snarfnet.net/application/o/dns2/.well-known/openid-configuration'
        '&ssoScopes=openid,profile,email'
        '&ssoAllowSignup=true'
        '&ssoAllowSignupOnlyForMappedUsers=false'
        '&ssoGroupMap=authentik%20Admins|Administrators"'
    )
    stdin, stdout, stderr = ssh.exec_command(f'k3s kubectl exec -n dns deployment/technitium-dns -- curl -s {url}')
    print("SSO set response:", stdout.read().decode())

    print("Restarting deployment/technitium-dns on Spaceport...")
    ssh.exec_command('k3s kubectl rollout restart deployment/technitium-dns -n dns')
    time.sleep(12)

    stdin, stdout, stderr = ssh.exec_command('k3s kubectl wait --for=condition=Ready pod -l app=technitium-dns -n dns --timeout=30s')
    print("Pod wait:", stdout.read().decode())

    # Check api/status
    stdin, stdout, stderr = ssh.exec_command('k3s kubectl exec -n dns deployment/technitium-dns -- curl -s "http://localhost:5380/api/status"')
    print("api/status:", stdout.read().decode())

    # Check SSO login redirect
    stdin, stdout, stderr = ssh.exec_command('k3s kubectl exec -n dns deployment/technitium-dns -- curl -s -v -H "Host: dns2.snarfnet.net" -H "X-Forwarded-Proto: https" "http://localhost:5380/sso/login"')
    print("SSO redirect test:")
    print(stderr.read().decode('utf-8', errors='ignore')[:1000])

    ssh.close()

configure_spaceport_technitium()