#!/bin/bash
# Generate JWT token and update .env.local
# Usage: ./commands/generate-token.sh [payload.json]

set -e

# Detect script directory (bash/zsh compatible)
if [ -n "$BASH_SOURCE" ]; then
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
elif [ -n "$ZSH_VERSION" ]; then
    SCRIPT_DIR="$(cd "$(dirname "${(%):-%x}")" && pwd)"
else
    SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
fi

PROJECT_DIR="$SCRIPT_DIR/.."
ENV_FILE="$PROJECT_DIR/.env.local"

# Helper for Base64Url encoding
base64url_encode() {
    openssl base64 -e | tr -d '\n' | tr -d '=' | tr '+/' '-_'
}

############################################
# 1. Validation & Payload Preparation
############################################

# If payload file provided, use it
if [ -n "$1" ] && [ -f "$1" ]; then
    echo "📂 Using provided payload file: $1"
    PAYLOAD_CONTENT=$(cat "$1")

else
    echo "🤖 Generating token..."
    echo ""

    # Always prompt for CLIENT_ID
    read -rp "Enter CLIENT_ID: " CLIENT_ID
    if [ -z "$CLIENT_ID" ]; then
        echo "❌ CLIENT_ID cannot be empty."
        exit 1
    fi

    # Always prompt for PROJECT_ID
    read -rp "Enter PROJECT_ID: " PROJECT_ID
    if [ -z "$PROJECT_ID" ]; then
        echo "❌ PROJECT_ID cannot be empty."
        exit 1
    fi

    NOW=$(date +%s)
    ONE_YEAR_LATER=$((NOW + 31536000))
    PAYLOAD_CONTENT="{\"clientId\":\"$CLIENT_ID\",\"projectId\":\"$PROJECT_ID\",\"iat\":$NOW,\"exp\":$ONE_YEAR_LATER}"
fi

# Always prompt for JWT_SECRET
echo ""
echo "🔐 JWT Signing Secret required"
read -sp "Enter JWT_SECRET: " SECRET_INPUT
echo ""
read -sp "Confirm JWT_SECRET: " SECRET_CONFIRM
echo ""

if [ "$SECRET_INPUT" != "$SECRET_CONFIRM" ]; then
    echo "❌ Secrets do not match. Exiting."
    exit 1
fi

if [ ${#SECRET_INPUT} -lt 8 ]; then
    echo "❌ Secret must be at least 8 characters. Exiting."
    exit 1
fi

JWT_SECRET="$SECRET_INPUT"

############################################
# 2. Header
############################################

HEADER='{"alg":"HS256","typ":"JWT"}'
B64_HEADER=$(echo -n "$HEADER" | base64url_encode)

############################################
# 3. Payload
############################################

B64_PAYLOAD=$(echo -n "$PAYLOAD_CONTENT" | base64url_encode)

############################################
# 4. Signature
############################################

SIGNING_INPUT="${B64_HEADER}.${B64_PAYLOAD}"

B64_SIGNATURE=$(echo -n "$SIGNING_INPUT" \
    | openssl dgst -sha256 -hmac "$JWT_SECRET" -binary \
    | base64url_encode)

############################################
# 5. Token
############################################

JWT="${SIGNING_INPUT}.${B64_SIGNATURE}"

echo ""
echo "✅ Generated JWT Token:"
echo "$JWT"
echo ""

############################################
# 6. Update .env.local
############################################

touch "$ENV_FILE"

if grep -q "MIXIO_TOKEN=" "$ENV_FILE"; then

    if [[ "$OSTYPE" == "darwin"* ]]; then
        sed -i '' "s|^MIXIO_TOKEN=.*|MIXIO_TOKEN=$JWT|" "$ENV_FILE"
    else
        sed -i "s|^MIXIO_TOKEN=.*|MIXIO_TOKEN=$JWT|" "$ENV_FILE"
    fi

    echo "📝 Updated MIXIO_TOKEN in .env.local"

else

    echo "" >> "$ENV_FILE"
    echo "MIXIO_TOKEN=$JWT" >> "$ENV_FILE"

    echo "➕ Appended MIXIO_TOKEN to .env.local"
fi

echo ""
echo "🎉 Done!"