target_endpoint() {
  case "$1" in
    garage) printf 'http://garage:3900\n' ;;
    versitygw) printf 'http://versitygw:10000\n' ;;
    *) return 1 ;;
  esac
}

target_loopback_endpoint() {
  case "$1" in
    garage) printf 'http://127.0.0.1:3900\n' ;;
    versitygw) printf 'http://127.0.0.1:10000\n' ;;
    *) return 1 ;;
  esac
}

ensure_target_scope_canary() {
  local provider="$1"
  local endpoint
  endpoint="$(target_loopback_endpoint "$provider")" || return
  if ! kube --namespace "$FIXTURE_NAMESPACE" exec "deployment/$provider" --container s3-readiness -- \
    aws --endpoint-url "$endpoint" s3api create-bucket --bucket nuthatch-fixture >&2; then
    kube --namespace "$FIXTURE_NAMESPACE" exec "deployment/$provider" --container s3-readiness -- \
      aws --endpoint-url "$endpoint" s3api head-bucket --bucket nuthatch-fixture >/dev/null || return
  fi
  kube --namespace "$FIXTURE_NAMESPACE" exec "deployment/$provider" --container s3-readiness -- \
    sh -ec 'printf scope-canary >/tmp/scope-canary && aws --endpoint-url "$1" s3api put-object --bucket nuthatch-fixture --key scope-canary --body /tmp/scope-canary >/dev/null' \
    sh "$endpoint"
}

provision_lane_target_principal() {
  local provider="$1"
  local lane="$2"
  local bucket="$3"
  local access_key_var="$4"
  local secret_key_var="$5"
  local endpoint
  local access_key
  local secret_key
  endpoint="$(target_loopback_endpoint "$provider")" || return
  case "$provider" in
    garage)
      printf -v access_key 'GKNUTHATCH%024d' "$((10#$lane))"
      printf -v secret_key '%064d' "$((10#$lane))"
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/garage --container garage -- \
        /garage bucket create "$bucket" >/dev/null || return
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/garage --container garage -- \
        /garage bucket allow \
        --read \
        --write \
        --owner \
        "$bucket" \
        --key GK00000000000000000000000000000000 >/dev/null || return
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/garage --container garage -- \
        /garage key import --yes -n "nuthatch-$lane" "$access_key" "$secret_key" >/dev/null || return
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/garage --container garage -- \
        /garage bucket allow --read --write "$bucket" --key "$access_key" >/dev/null || return
      ;;
    versitygw)
      access_key="nuthatch-lane-$lane"
      printf -v secret_key 'synthetic-lane-%049d' "$((10#$lane))"
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/versitygw --container versitygw -- \
        /usr/local/bin/versitygw admin \
        --endpoint-url http://127.0.0.1:10001 \
        create-user \
        --access "$access_key" \
        --secret "$secret_key" \
        --role user \
        --user-id "$((10#$lane))" \
        --group-id "$((10#$lane))" >/dev/null || return
      kube --namespace "$FIXTURE_NAMESPACE" exec deployment/versitygw --container versitygw -- \
        /usr/local/bin/versitygw admin \
        --endpoint-url http://127.0.0.1:10001 \
        create-bucket \
        --bucket "$bucket" \
        --owner "$access_key" >/dev/null || return
      ;;
    *) return 1 ;;
  esac
  printf -v "$access_key_var" '%s' "$access_key"
  printf -v "$secret_key_var" '%s' "$secret_key"
}

cleanup_lane_target_store() {
  local provider="$1"
  local bucket="$2"
  local endpoint
  endpoint="$(target_loopback_endpoint "$provider")" || return
  kube --namespace "$FIXTURE_NAMESPACE" exec "deployment/$provider" --container s3-readiness -- \
    aws --endpoint-url "$endpoint" s3 rb "s3://$bucket" --force >/dev/null
}