#compdef 7s-cert

autoload -U is-at-least

_7s-cert() {
    typeset -A opt_args
    typeset -a _arguments_options
    local ret=1

    if is-at-least 5.2; then
        _arguments_options=(-s -S -C)
    else
        _arguments_options=(-s -C)
    fi

    local context curcontext="$curcontext" state line
    _arguments "${_arguments_options[@]}" : \
'-n+[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'--name=[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'-u+[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'--user=[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'-U+[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--ssh-local-user=[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--target-dir=[Allows to override the target directory (usually \`/\`) for all operations. Must be an absolute path to an existing directory. Use only if you know what you are doing.]:TARGET_DIR:_files' \
'--vault-jwt=[]:VAULT_JWT:_default' \
'--vault-role=[]:VAULT_ROLE:_default' \
'--vault-cert-role=[]:VAULT_CERT_ROLE:_default' \
'--vault-cert-domain=[]:VAULT_CERT_DOMAIN:_default' \
'-a+[URL of the Vault cluster to use.]:VAULT_ADDRESS:_default' \
'--vault-address=[URL of the Vault cluster to use.]:VAULT_ADDRESS:_default' \
'*-v[Increase logging verbosity]' \
'*--verbose[Increase logging verbosity]' \
'(-v --verbose)*-q[Decrease logging verbosity]' \
'(-v --verbose)*--quiet[Decrease logging verbosity]' \
'-d[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'--debug[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'-h[Print help]' \
'--help[Print help]' \
'-V[Print version]' \
'--version[Print version]' \
":: :_7s-cert_commands" \
"*::: :->7s-cert" \
&& ret=0
    case $state in
    (7s-cert)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:7s-cert-command-$line[1]:"
        case $line[1] in
            (get)
_arguments "${_arguments_options[@]}" : \
'-m+[Method for retrieving the certificate.]:METHOD:((ssh\:"Get shared certificate via SSH"
gitlab\:"Authenticate to Hashicorp Vault using \`VAULT_JWT\` and issue a new cert via Vault PKI. This is only for use in CI"
vault_authorized\:"Like \`Gitlab\`, but expects that we are already logged in to the Vault"))' \
'--method=[Method for retrieving the certificate.]:METHOD:((ssh\:"Get shared certificate via SSH"
gitlab\:"Authenticate to Hashicorp Vault using \`VAULT_JWT\` and issue a new cert via Vault PKI. This is only for use in CI"
vault_authorized\:"Like \`Gitlab\`, but expects that we are already logged in to the Vault"))' \
'-n+[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'--name=[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'-u+[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'--user=[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'-U+[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--ssh-local-user=[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--target-dir=[Allows to override the target directory (usually \`/\`) for all operations. Must be an absolute path to an existing directory. Use only if you know what you are doing.]:TARGET_DIR:_files' \
'*-v[Increase logging verbosity]' \
'*--verbose[Increase logging verbosity]' \
'(-v --verbose)*-q[Decrease logging verbosity]' \
'(-v --verbose)*--quiet[Decrease logging verbosity]' \
'-d[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'--debug[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
&& ret=0
;;
(update)
_arguments "${_arguments_options[@]}" : \
'-n+[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'--name=[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'-u+[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'--user=[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'-U+[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--ssh-local-user=[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--target-dir=[Allows to override the target directory (usually \`/\`) for all operations. Must be an absolute path to an existing directory. Use only if you know what you are doing.]:TARGET_DIR:_files' \
'-f[Force download and install, even if the certs seem to be up to date according to cache.]' \
'--force[Force download and install, even if the certs seem to be up to date according to cache.]' \
'*-v[Increase logging verbosity]' \
'*--verbose[Increase logging verbosity]' \
'(-v --verbose)*-q[Decrease logging verbosity]' \
'(-v --verbose)*--quiet[Decrease logging verbosity]' \
'-d[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'--debug[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(inspect)
_arguments "${_arguments_options[@]}" : \
'-n+[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'--name=[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'-u+[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'--user=[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'-U+[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--ssh-local-user=[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--target-dir=[Allows to override the target directory (usually \`/\`) for all operations. Must be an absolute path to an existing directory. Use only if you know what you are doing.]:TARGET_DIR:_files' \
'*-v[Increase logging verbosity]' \
'*--verbose[Increase logging verbosity]' \
'(-v --verbose)*-q[Decrease logging verbosity]' \
'(-v --verbose)*--quiet[Decrease logging verbosity]' \
'-d[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'--debug[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(issue)
_arguments "${_arguments_options[@]}" : \
'-r+[Name of the role to claim.]:OIDC_ROLE:(devel intern student)' \
'--role=[Name of the role to claim.]:OIDC_ROLE:(devel intern student)' \
'-n+[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'--name=[The logical certificate name. This is going to become a prefix of the certificates common name (CN). If not provided, will try to read the name from an existing 7s certificate. Common examples\: - devel-1.devel (-> CN\: devel-1.devel.certs.7sr.ch) - student-1.students (-> CN\: student-1.students.certs.7sr.ch)]:NAME:_default' \
'-u+[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'--user=[The ssh remote user for retrieving the certificates. If not provided the default user logic of ssh/scp is used (~/.ssh/config).]:SSH_REMOTE_USER:_default' \
'-U+[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--ssh-local-user=[The local Linux user whose SSH config will be used for retrieving certificates. Defaults to \`\$SUDO_USER\`, which works nicely when calling this program via \`sudo\`.]:SSH_LOCAL_USER:_default' \
'--target-dir=[Allows to override the target directory (usually \`/\`) for all operations. Must be an absolute path to an existing directory. Use only if you know what you are doing.]:TARGET_DIR:_files' \
'*-v[Increase logging verbosity]' \
'*--verbose[Increase logging verbosity]' \
'(-v --verbose)*-q[Decrease logging verbosity]' \
'(-v --verbose)*--quiet[Decrease logging verbosity]' \
'-d[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'--debug[Debug mode, equivalent to -vvv/--verbose. DEPRECATED, use -vvv/--verbose instead.]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_7s-cert__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:7s-cert-help-command-$line[1]:"
        case $line[1] in
            (get)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(update)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(inspect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(issue)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
}

(( $+functions[_7s-cert_commands] )) ||
_7s-cert_commands() {
    local commands; commands=(
'get:Retrieve an existing shared certificate or issue a new one. Shared\: E.g. with names\: devel-1.devel, intern-1.interns or student-1.students. This requires SSH access to the 7s server with sufficient permissions! Issue new one\: Currently for CI workers only -- using VAULT_JWT' \
'update:Update an already installed certificate' \
'inspect:Help with debugging common certificate-related issues' \
'issue:Issue a new individual certificate from Vault, by using Gitlab as OIDC authentication. This requires valid Gitlab group membership' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands '7s-cert commands' commands "$@"
}
(( $+functions[_7s-cert__get_commands] )) ||
_7s-cert__get_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert get commands' commands "$@"
}
(( $+functions[_7s-cert__help_commands] )) ||
_7s-cert__help_commands() {
    local commands; commands=(
'get:Retrieve an existing shared certificate or issue a new one. Shared\: E.g. with names\: devel-1.devel, intern-1.interns or student-1.students. This requires SSH access to the 7s server with sufficient permissions! Issue new one\: Currently for CI workers only -- using VAULT_JWT' \
'update:Update an already installed certificate' \
'inspect:Help with debugging common certificate-related issues' \
'issue:Issue a new individual certificate from Vault, by using Gitlab as OIDC authentication. This requires valid Gitlab group membership' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands '7s-cert help commands' commands "$@"
}
(( $+functions[_7s-cert__help__get_commands] )) ||
_7s-cert__help__get_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert help get commands' commands "$@"
}
(( $+functions[_7s-cert__help__help_commands] )) ||
_7s-cert__help__help_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert help help commands' commands "$@"
}
(( $+functions[_7s-cert__help__inspect_commands] )) ||
_7s-cert__help__inspect_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert help inspect commands' commands "$@"
}
(( $+functions[_7s-cert__help__issue_commands] )) ||
_7s-cert__help__issue_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert help issue commands' commands "$@"
}
(( $+functions[_7s-cert__help__update_commands] )) ||
_7s-cert__help__update_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert help update commands' commands "$@"
}
(( $+functions[_7s-cert__inspect_commands] )) ||
_7s-cert__inspect_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert inspect commands' commands "$@"
}
(( $+functions[_7s-cert__issue_commands] )) ||
_7s-cert__issue_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert issue commands' commands "$@"
}
(( $+functions[_7s-cert__update_commands] )) ||
_7s-cert__update_commands() {
    local commands; commands=()
    _describe -t commands '7s-cert update commands' commands "$@"
}

if [ "$funcstack[1]" = "_7s-cert" ]; then
    _7s-cert "$@"
else
    compdef _7s-cert 7s-cert
fi
