#!/bin/bash
# Bootstrap Infisical from zero.
# Run after: docker compose up -d postgres
# Produces: .env with all OIKOS_INFISICAL_* values, admin creds in .infisical-credentials
set -euo pipefail

INFISICAL_URL="${INFISICAL_URL:-http://localhost:8080}"
ADMIN_EMAIL="${ADMIN_EMAIL:-oikos@hubris.network}"
ADMIN_PASS="${ADMIN_PASS:-oikos-admin-$(openssl rand -hex 4)}"
PROJECT_NAME="${PROJECT_NAME:-oikos}"
ORG_NAME="${ORG_NAME:-Oikos}"

# ── 1. Generate keys ───────────────────────────────────────────────
echo "=== [1/6] Generating keys ==="
ENCRYPTION_KEY=$(python3 -c "import secrets, string; print(''.join(secrets.choice(string.ascii_letters+string.digits) for _ in range(32)))")
JWT_SIGNUP=$(openssl rand -hex 32)
JWT_REFRESH=$(openssl rand -hex 32)
JWT_AUTH=$(openssl rand -hex 32)
JWT_SERVICE=$(openssl rand -hex 32)
JWT_MFA=$(openssl rand -hex 32)
JWT_PROVIDER=$(openssl rand -hex 32)

# ── 2. Write .env ──────────────────────────────────────────────────
cat > .env <<EOF
INFISICAL_ENCRYPTION_KEY=$ENCRYPTION_KEY
INFISICAL_JWT_SIGNUP_SECRET=$JWT_SIGNUP
INFISICAL_JWT_REFRESH_SECRET=$JWT_REFRESH
INFISICAL_JWT_AUTH_SECRET=$JWT_AUTH
INFISICAL_JWT_SERVICE_SECRET=$JWT_SERVICE
INFISICAL_JWT_MFA_SECRET=$JWT_MFA
INFISICAL_JWT_PROVIDER_SECRET=$JWT_PROVIDER
INFISICAL_SITE_URL=$INFISICAL_URL
EOF

# ── 3. Create DB + start services ──────────────────────────────────
echo "=== [2/6] Creating infisical database ==="
docker compose exec -T postgres psql -U oikos -d postgres -v ON_ERROR_STOP=1 <<SQL 2>/dev/null || true
DROP DATABASE IF EXISTS infisical;
CREATE DATABASE infisical;
SQL

echo "=== [3/6] Starting Infisical + Redis ==="
docker compose --profile infisical up infisical redis -d --wait 2>&1 | tail -2

# Wait for healthy
for i in $(seq 1 30); do
    if curl -sf "$INFISICAL_URL/api/status" > /dev/null 2>&1; then break; fi
    sleep 2
done
echo "Infisical ready"

# ── 4. Create admin ────────────────────────────────────────────────
echo "=== [4/6] Creating admin account ==="
SIGNUP=$(curl -s -X POST "$INFISICAL_URL/api/v1/admin/signup" \
    -H "Content-Type: application/json" \
    -d "{\"email\":\"$ADMIN_EMAIL\",\"password\":\"$ADMIN_PASS\",\"firstName\":\"Oikos\",\"lastName\":\"Admin\",\"organizationName\":\"$ORG_NAME\"}")
ORG_ID=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['organization']['id'])")
USER_TOKEN=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
echo "Admin created, org=$ORG_ID"

# ── 5. Get org-scoped token ────────────────────────────────────────
ORG_TOKEN=$(curl -s -X POST "$INFISICAL_URL/api/v3/auth/select-organization" \
    -H "Authorization: Bearer $USER_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"organizationId\":\"$ORG_ID\"}" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

# ── 6. Create project + identity ───────────────────────────────────
echo "=== [5/6] Creating project + machine identity ==="
PROJECT=$(curl -s -X POST "$INFISICAL_URL/api/v1/projects" \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"projectName\":\"$PROJECT_NAME\",\"slug\":\"$PROJECT_NAME\"}")
PROJECT_ID=$(echo "$PROJECT" | python3 -c "import sys,json; print(json.load(sys.stdin)['project']['id'])")
echo "Project: $PROJECT_NAME ($PROJECT_ID)"

# Create machine identity
IDENTITY=$(curl -s -X POST "$INFISICAL_URL/api/v1/identities" \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"name\":\"$PROJECT_NAME-api\",\"role\":\"admin\",\"organizationId\":\"$ORG_ID\",\"projectIds\":[\"$PROJECT_ID\"]}")
IDENTITY_ID=$(echo "$IDENTITY" | python3 -c "import sys,json; print(json.load(sys.stdin)['identity']['id'])")
echo "Identity: $PROJECT_NAME-api ($IDENTITY_ID)"

# Attach Universal Auth
UA=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID" \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"clientIdTtl":0,"clientSecretTtl":0,"accessTokenTtl":2592000,"accessTokenMaxTtl":2592000,"accessTokenNumUsesLimit":0}')
CLIENT_ID=$(echo "$UA" | python3 -c "import sys,json; print(json.load(sys.stdin)['identityUniversalAuth']['clientId'])")
echo "UA attached, clientId=$CLIENT_ID"

# Create client secret
SECRET=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID/client-secrets" \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"description":"default","clientSecretTtl":0,"clientSecretNumUsesLimit":0}')
CLIENT_SECRET=$(echo "$SECRET" | python3 -c "import sys,json; print(json.load(sys.stdin)['clientSecret'])")
echo "Client secret created"

# Add identity to project
curl -s -X POST "$INFISICAL_URL/api/v1/projects/$PROJECT_ID/memberships/identities/$IDENTITY_ID" \
    -H "Authorization: Bearer $ORG_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"roles":[{"role":"admin","isTemporary":false}]}' > /dev/null
echo "Identity added to project"

# ── 7. Write credentials ──────────────────────────────────────────
echo "=== [6/6] Writing credentials ==="
cat >> .env <<EOF
OIKOS_INFISICAL_SITE_URL=http://infisical:8080
OIKOS_INFISICAL_CLIENT_ID=$CLIENT_ID
OIKOS_INFISICAL_CLIENT_SECRET=$CLIENT_SECRET
OIKOS_INFISICAL_PROJECT_ID=$PROJECT_ID
OIKOS_INFISICAL_ENV=dev
OIKOS_SECRET_BACKEND=infisical
EOF

cat > .infisical-credentials <<EOF
# Infisical admin credentials (generated $(date -Iseconds))
URL: $INFISICAL_URL
Admin: $ADMIN_EMAIL / $ADMIN_PASS
Organization: $ORG_ID
Project: $PROJECT_NAME ($PROJECT_ID)
Identity: $PROJECT_NAME-api ($IDENTITY_ID)
Client ID: $CLIENT_ID
Client Secret: $CLIENT_SECRET
EOF

echo ""
echo "============================================"
echo "Infisical bootstrapped."
echo "Admin:   $ADMIN_EMAIL / $ADMIN_PASS"
echo "Project: $PROJECT_NAME ($PROJECT_ID)"
echo "UA:      $CLIENT_ID"
echo ""
echo ".env and .infisical-credentials written."
echo "Next: oikos secret migrate  (if SOPS secrets exist)"
echo "============================================"