#!/bin/bash
# Description: Check if TLS termination is handled by ingress
# Expect: Find TLS configuration in ingress or other security measures

# Check for TLS configuration in ingress
rg -l 'tls:' packages/system/keycloak/templates/
# Check for any SSL/TLS related configurations
rg -l 'ssl|tls|https' packages/system/keycloak/templates/

#!/bin/bash
# Let's check the ingress configuration to verify TLS termination
cat packages/system/keycloak/templates/ingress.yaml

# Also check if there are any proxy configurations that might handle HTTPS
rg -A 5 'proxy|https' packages/system/keycloak/templates/

#!/bin/bash
# Check for other resources using the same API server access policy
rg -l 'policy\.cozystack\.io/allow-to-apiserver.*true' --type yaml

# Check for any network policies that might affect this access
fd -e yaml -e yml | xargs grep -l "kind: NetworkPolicy"

#!/bin/bash
# Check the content of network policies in the system
rg -A 10 "kind: NetworkPolicy" packages/system/keycloak --type yaml

# Check if there are any specific network policies for database access
rg "policy\.cozystack\.io/allow-to-apiserver.*true" -A 5 -B 5 packages/system/keycloak/templates/db.yaml

# Look for documentation or comments about this policy
rg "allow-to-apiserver" packages/system/keycloak --type yaml --with-filename

#!/bin/bash
# Check other database resources using this policy
rg -C 5 "policy\.cozystack\.io/allow-to-apiserver.*true" "packages/*/templates/db.yaml" "packages/*/templates/database.yaml"

# Look for any documentation about this policy in READMEs or docs
fd README.md | xargs rg "allow-to-apiserver"
fd -e md -p docs/ | xargs rg "allow-to-apiserver"

#!/bin/bash
# Check if the service name and port are correctly defined
rg -l 'name: keycloak-http' packages/system/keycloak/templates/
rg -l 'ports:.*name: http' packages/system/keycloak/templates/

#!/bin/bash
# Let's examine the service.yaml and ingress.yaml to verify the port configuration alignment
cat packages/system/keycloak/templates/service.yaml
echo "---"
cat packages/system/keycloak/templates/ingress.yaml

#!/bin/bash
# Description: Check if postgres-operator is consistently required across related configurations

# Check for postgres-operator references in other bundle configurations
echo "Checking postgres-operator configuration in other bundles..."
rg -A 5 "postgres-operator" "packages/core/platform/bundles/"

# Check if Keycloak configurations consistently depend on postgres-operator
echo "Checking Keycloak dependencies in other bundles..."
rg -A 5 "name: keycloak" "packages/core/platform/bundles/"

#!/bin/bash
# Description: Verify SSO-related security configurations
# Expected: Find secure handling of SSO credentials and proper RBAC setup

# Check for sensitive credential handling
rg -i "password|secret|key|token" --type yaml

# Check for proper RBAC configurations
rg -i "role|binding|sso|keycloak" --type yaml

# Verify proper namespace isolation
rg -i "namespace.*cozy|namespace.*sso|namespace.*keycloak" --type yaml

#!/bin/bash
# Let's check for SSO-related configurations and security measures

# Search for SSO-related files and configurations
fd -e yaml -e yml . packages/ | xargs rg -l -i "sso|auth|keycloak|oidc"

# Check for any secret management in platform setup
fd -e yaml -e yml . packages/core/platform/ | xargs cat

# Look for any auth-related configurations in the migrations
fd . scripts/migrations/ -x cat {}

# Check for any security-related make targets
fd Makefile . | xargs rg "auth|sso|security"

#!/bin/bash
# Let's specifically check Keycloak and SSO-related configurations

# Check Keycloak chart configuration
fd -e yaml -e yml . packages/system/keycloak/ | xargs cat

# Check for any SSO/auth environment variables or secrets in the installer
rg -i "sso|auth|keycloak|oidc" scripts/installer.sh

# Look for any security-related configurations in the platform chart
rg -i "security|auth|sso|keycloak" packages/core/platform/templates/

# Check for any auth-related configurations in the cozystack API
fd -e yaml -e yml . packages/system/cozystack-api/ | xargs cat

#!/bin/bash
# Description: Check if the cozy-keycloak chart has values.yaml or similar files

# Look for values files in the chart
fd -t f "values.*\.yaml$" -d 3 | grep -i "keycloak"

# Check if other bundles configure values for keycloak
rg -l "chart:\s*cozy-keycloak" | xargs rg "values(Files)?:"

#!/bin/bash
# Check the actual values configuration for keycloak in other bundles
rg -A 10 "chart:\s*cozy-keycloak" packages/core/platform/bundles/

#!/bin/bash
# Look for chart documentation and values
fd -t f "README\.md|values\.yaml" | grep -i "keycloak"

# Also check for any values.yaml content mentioning required fields
rg -l "keycloak" | xargs rg -l "required:|mandatory"

#!/bin/bash
# Check the content of keycloak values file
cat packages/system/keycloak/values.yaml

#!/bin/bash
# Description: Check for potential namespace isolation concerns

# Look for other RoleBindings that might grant cross-namespace access
rg -l "kind:\s+RoleBinding" | xargs rg "namespace:\s+{{ include \"tenant.name\""

# Check for ClusterRoles/ClusterRoleBindings that might affect namespace isolation
rg "kind:\s+(ClusterRole|ClusterRoleBinding)"

#!/bin/bash
# Check for namespace-related configurations in tenant.yaml and related files

# Search for namespace-related configurations in tenant.yaml
rg -A 5 -B 5 "namespace:\s+{{" "packages/apps/tenant/templates/tenant.yaml"

# Look for any potential cross-namespace references
rg "namespace:\s+\$|namespace:\s+{{" "packages/apps/tenant/templates/"

#!/bin/bash
# Check for namespace-related configurations and potential cross-namespace access

# Search for namespace configurations in tenant.yaml
rg "namespace:" "packages/apps/tenant/templates/tenant.yaml"

# Look for any cluster-wide permissions or cross-namespace access
rg -B 3 -A 3 "resources.*[\"\'].*\*.*[\"\']" "packages/apps/tenant/templates/tenant.yaml"

#!/bin/bash
# Check for wildcard resources and permissions in the role

# Look for resources and verbs in the role definition
rg -B 2 -A 2 "resources:|verbs:" "packages/apps/tenant/templates/tenant.yaml"

# Look for any apiGroups definitions
rg -B 2 -A 2 "apiGroups:" "packages/apps/tenant/templates/tenant.yaml"

#!/bin/bash
# Description: Verify that the corresponding RBAC roles exist in tenant.yaml
# and that the naming convention matches these Keycloak groups

# Search for role definitions in tenant.yaml that match our group names
rg "kind:\s+Role.*?name:.*?(view|use|admin|super-admin)" -A 5 packages/apps/tenant/templates/tenant.yaml

#!/bin/bash
# Let's try a broader search to find any role definitions in tenant.yaml
rg "kind:\s+Role" -A 5 packages/apps/tenant/templates/tenant.yaml

# Also search for any files that might contain role definitions
fd "tenant.ya?ml" --type f

# Let's also check if there are any other YAML files in the tenant templates
fd ".ya?ml$" packages/apps/tenant/templates/

#!/bin/bash
# Description: Verify the existence and configuration of the referenced ClusterKeycloakRealm

# Search for ClusterKeycloakRealm definition
rg -l --type yaml "kind:\s*ClusterKeycloakRealm" 

# Search for specific realm configuration
rg -A 5 "name:\s*keycloakrealm-cozy"

#!/bin/bash
# Description: Verify API version and CRD existence

# Search for CRD definition
fd -t f "keycloak" -x rg -l "v1\.edp\.epam\.com/v1.*KeycloakRealmGroup"

# Check for version references in operator deployment
rg "v1\.edp\.epam\.com/v1" --type yaml

#!/bin/bash
# Description: Verify tenant name templating implementation

# Search for tenant.name template definition
fd -t f "_helpers.tpl" -x rg -l "tenant\.name"

# Check usage patterns
rg "include \"tenant.name\"" --type yaml

#!/bin/bash
# Get the tenant.name helper implementation
cat ./packages/apps/tenant/templates/_helpers.tpl

#!/bin/bash
# Description: Check for corresponding RBAC roles

# Search for related RBAC role definitions
rg -A 5 "kind:\s*(Role|ClusterRole).*{{ include \"tenant.name\" . }}-(view|use|admin|super-admin)"

#!/bin/bash
# Search for role definitions with escaped template syntax
rg -A 5 'kind:\s*(Role|ClusterRole).*\{\{ include "tenant\.name" \. \}}-(view|use|admin|super-admin)'

# Also search for any role bindings or cluster role bindings
rg -A 5 'kind:\s*(RoleBinding|ClusterRoleBinding).*\{\{ include "tenant\.name" \. \}}-(view|use|admin|super-admin)'

# Look for any RBAC-related files
fd 'role|rbac' --type f

# Check for any documentation about roles and groups
rg -i '(group|role|permission|access)' README.md docs/ 2>/dev/null

#!/bin/bash
# Let's check the keycloak templates directory for any role or permission definitions
rg -A 10 'kind:' packages/apps/tenant/templates/

# Check for any documentation in the tenant package
fd README.md -p packages/apps/tenant/

# Look for any keycloak-related configuration files that might define permissions
fd -e yaml -p packages/apps/tenant/ | xargs rg -l 'keycloak|role|permission|group' 2>/dev/null

#!/bin/bash
# Check if the Keycloak operator CRDs support the new API version
kubectl get crd -o json | jq -r '.items[] | select(.spec.group == "v1.edp.epam.com") | .spec.versions[].name'

#!/bin/bash
# Let's search for any operator-related configuration or CRD definitions in the repository
fd -e yaml -e yml | xargs grep -l "v1.edp.epam.com" || true

# Also search for any documentation or references about the API version
rg -l "v1.edp.epam.com" || true

# Look for any operator version or compatibility information
fd "Chart.yaml" | xargs grep -A5 -B5 "keycloak" || true

#!/bin/bash
# Check if KeycloakClientScope CRD supports referencing ClusterKeycloakRealm
kubectl get crd -o json | jq -r '.items[] | select(.spec.names.kind == "KeycloakClientScope") | .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.realmRef'

#!/bin/bash
# Let's search for KeycloakClientScope CRD definition in the codebase
fd ".*\.yaml$" | xargs rg -l "kind:\s*KeycloakClientScope" -A 10

# Also search for any references to ClusterKeycloakRealm in relation to KeycloakClientScope
rg "KeycloakClientScope.*ClusterKeycloakRealm|ClusterKeycloakRealm.*KeycloakClientScope" -A 5

#!/bin/bash
# Let's examine the CRD definition and example to understand the realmRef structure
cat packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakclientscopes.yaml | rg -A 10 "realmRef:"

# Also check the example usage
cat packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml

#!/bin/bash
# Check if KeycloakClient CRD supports the new realm reference
kubectl get crd -o json | jq -r '.items[] | select(.spec.names.kind == "KeycloakClient") | .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.realmRef'

# Verify no other clients are using potentially conflicting redirect URIs
kubectl get keycloakclients -o json | jq -r '.items[] | select(.spec.redirectUris != null) | {name: .metadata.name, uris: .spec.redirectUris}'

#!/bin/bash
# Let's analyze the repository content to find CRD definitions and client configurations
# Search for CRD definitions related to KeycloakClient
fd "keycloakclient.*\.yaml" --type f --exec cat {}

# Search for any realm reference configurations
rg -A 5 -B 5 "realmRef|ClusterKeycloakRealm" --type yaml

# Search for OAuth callback/redirect URI configurations
rg -A 5 -B 5 "redirectUris|callbackURL" --type yaml

#!/bin/bash
# Verify the ClusterKeycloakRealm CRD definition includes the new reference field
kubectl get crd -o json | jq -r '.items[] | select(.spec.names.kind == "ClusterKeycloakRealm") | .spec.versions[].schema.openAPIV3Schema.properties.spec.properties'

#!/bin/bash
# Search for ClusterKeycloakRealm CRD definition files
fd -e yaml -e yml | xargs rg -l "kind:\s*ClusterKeycloakRealm"

# Search for any other realm resources to compare the structure
fd -e yaml -e yml | xargs rg -l "kind:\s*(Cluster)?KeycloakRealm"

# Look for any documentation or examples
fd README.md | xargs rg -l "KeycloakRealm|ClusterKeycloakRealm"

#!/bin/bash
# Check the CRD definition for ClusterKeycloakRealm
cat packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml

# Check example usage
cat packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml

# Compare with old KeycloakRealm CRD
cat packages/system/keycloak-operator/charts/keycloak-operator/crds/v1.edp.epam.com_keycloakrealms.yaml

#!/bin/bash
# Check the dependency chain in other similar configurations
rg -A 5 "name: keycloak-configure" packages/core/platform/bundles/

#!/bin/bash
# Check the dependency chain for keycloak-operator and postgres-operator
rg "name: (keycloak-operator|postgres-operator)" -A 5 packages/core/platform/bundles/distro-hosted.yaml

#!/bin/bash
# Description: Check for potential circular dependencies and verify the dependency chain

# Search for any references to these components that might indicate circular dependencies
rg -l 'keycloak-configure|keycloak-operator|keycloak' | while read -r file; do
  echo "=== $file ==="
  rg 'dependsOn.*\[(.*keycloak.*)\]' "$file" || true
done

#!/bin/bash
# Let's verify the complete dependency chain by checking the dependencies of keycloak and postgres-operator

# Check all bundle files for the complete dependency chain
echo "=== Checking bundle files for complete dependency chain ==="
for file in packages/core/platform/bundles/*.yaml; do
  echo "=== $file ==="
  rg "name: (keycloak|postgres-operator|keycloak-operator|keycloak-configure)" "$file" -A 5 || true
done