#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"

log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

require_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Required command not found: $1" >&2
    exit 1
  fi
}

require_cmd curl
require_cmd python3

ISSUER="${SKD_OIDC_ISSUER:-}"
REG_ENDPOINT_DEFAULT=""
if [[ -n "${ISSUER}" ]]; then
  REG_ENDPOINT_DEFAULT="${ISSUER%/}/connect/register"
fi

REG_ENDPOINT="${OIDC_REGISTRATION_ENDPOINT:-$REG_ENDPOINT_DEFAULT}"
INITIAL_TOKEN="${OIDC_INITIAL_ACCESS_TOKEN:-}"
CLIENT_NAME="${OIDC_CLIENT_NAME:-Safe Kiddo Daemon}"
REDIRECT_URI="${SKD_OIDC_REDIRECT_URI:-http://localhost:8000/login/oidc/callback}"

if [[ -z "${REG_ENDPOINT}" || -z "${INITIAL_TOKEN}" ]]; then
  cat >&2 <<'EOF'
Missing configuration. Set:
  SKD_OIDC_ISSUER (or OIDC_REGISTRATION_ENDPOINT)
  OIDC_INITIAL_ACCESS_TOKEN
Optional:
  OIDC_CLIENT_NAME (default: Safe Kiddo Daemon)
  SKD_OIDC_REDIRECT_URI (default: http://localhost:8000/login/oidc/callback)
EOF
  exit 1
fi

log "Registering client at ${REG_ENDPOINT} with redirect ${REDIRECT_URI}..."

TMP_RESP="$(mktemp)"
trap 'rm -f "${TMP_RESP}"' EXIT

HTTP_CODE=$(curl -sS -o "${TMP_RESP}" -w '%{http_code}' \
  -X POST "${REG_ENDPOINT}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${INITIAL_TOKEN}" \
  -d "{\"client_name\":\"${CLIENT_NAME}\",\"redirect_uris\":[\"${REDIRECT_URI}\"]}")

if [[ "${HTTP_CODE}" != "200" && "${HTTP_CODE}" != "201" ]]; then
  echo "Client registration failed (HTTP ${HTTP_CODE}):" >&2
  cat "${TMP_RESP}" >&2
  exit 1
fi

python3 - "$TMP_RESP" <<'PYCODE'
import json, sys
path = sys.argv[1]
data = json.load(open(path, "r"))
client_id = data.get("client_id")
client_secret = data.get("client_secret")
print("Client registered.")
if client_id:
    print(f"Client ID: {client_id}")
if client_secret:
    print(f"Client Secret: {client_secret}")
if not (client_id and client_secret):
    print("Warning: Response missing client_id or client_secret", file=sys.stderr)
PYCODE