#!/usr/bin/env bash

set -euo pipefail

command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }
command -v yc >/dev/null || { echo "yc required" >&2; exit 1; }

req=$(cat)
image=$(printf '%s' "$req" | jq -r '.image // empty')

if [[ -z "$image" ]]; then
  echo "no image in request" >&2
  exit 1
fi

registry=${image%%/*}
if [[ -z "$registry" ]]; then
  registry="$image"
fi

creds_json=$(printf '%s' "$image" | yc container docker-credential get 2>/dev/null) || {
  echo "yc docker-credential failed" >&2
  exit 1
}

username=$(printf '%s' "$creds_json" | jq -r '.Username // empty')
secret=$(printf '%s' "$creds_json" | jq -r '.Secret // empty')

if [[ -z "$username" || -z "$secret" ]]; then
  echo "failed to parse yc output" >&2
  exit 1
fi

jq -n \
  --arg api "credentialprovider.kubelet.k8s.io/v1" \
  --arg kind "CredentialProviderResponse" \
  --arg reg "$registry" \
  --arg user "$username" \
  --arg pass "$secret" \
  --arg cache "6h" \
  --arg keyType "Registry" \
'{
  apiVersion: $api,
  kind: $kind,
  auth: { ($reg): { username: $user, password: $pass } },
  cacheDuration: $cache,
  cacheKeyType: $keyType
}'