#!/usr/bin/env bash
set -euo pipefail

ADDON_ENV_FILE="${ADDON_ENV_FILE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/update-addon.env}"
PROFILE="${PROFILE:-dev}"
SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}"
PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}"
TOKEN_FILE="${SKD_UPDATE_TOKEN_FILE:-}"
CLIENT_ID=""
SOFTWARE_ID="safe-kiddo"
ENROLL_TOKEN=""
OUTPUT_PATH=""

usage() {
  cat <<'EOF'
Usage: enroll_update_service.sh --enroll-token TOKEN [options]

Options:
  --service-url URL     Update-Service URL (overrides env)
  --project-id ID       Project ID (overrides env)
  --client-id ID        Client ID (default: hostname)
  --software-id ID      Software ID (default: safe-kiddo)
  --output PATH         Write token to PATH (overrides env)
  --profile NAME        Environment profile: dev|stage|prod (default: dev)
  --addon-env PATH      Addon env file (default: ./update-addon.env)
  -h, --help            Show this help
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --service-url) SERVICE_URL="$2"; shift 2 ;;
    --project-id) PROJECT_ID="$2"; shift 2 ;;
    --client-id) CLIENT_ID="$2"; shift 2 ;;
    --software-id) SOFTWARE_ID="$2"; shift 2 ;;
    --enroll-token) ENROLL_TOKEN="$2"; shift 2 ;;
    --output) OUTPUT_PATH="$2"; shift 2 ;;
    --profile) PROFILE="$2"; shift 2 ;;
    --addon-env) ADDON_ENV_FILE="$2"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown option: $1" >&2; usage; exit 1 ;;
  esac
done

read_env_value() {
  local key="$1"
  python3 - <<'PY' "${ADDON_ENV_FILE}" "${key}"
from pathlib import Path
import sys

env_paths = [Path(sys.argv[1])]
key = sys.argv[2]
for path in env_paths:
    if not path.exists():
        continue
    try:
        lines = path.read_text(encoding="utf-8").splitlines()
    except OSError:
        continue
    for raw in lines:
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        if not line.startswith(f"{key}="):
            continue
        value = line.split("=", 1)[1].strip()
        if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
            value = value[1:-1]
        print(value)
        sys.exit(0)
PY
}

PROFILE_UPPER="$(printf '%s' "${PROFILE}" | tr '[:lower:]' '[:upper:]')"
SERVICE_URL="${SERVICE_URL:-$(read_env_value "${PROFILE_UPPER}_UPDATE_SERVICE_URL")}"
PROJECT_ID="${PROJECT_ID:-$(read_env_value "${PROFILE_UPPER}_UPDATE_PROJECT_ID")}"
TOKEN_FILE="${OUTPUT_PATH:-${TOKEN_FILE:-$(read_env_value "${PROFILE_UPPER}_UPDATE_TOKEN_FILE")}}"
CLIENT_ID="${CLIENT_ID:-$(hostname)}"

if [[ -z "${SERVICE_URL}" || -z "${PROJECT_ID}" ]]; then
  echo "Missing service URL or project ID." >&2
  echo "Set SKD_UPDATE_SERVICE_URL and SKD_UPDATE_PROJECT_ID or pass --service-url/--project-id." >&2
  exit 1
fi

if [[ -z "${ENROLL_TOKEN}" ]]; then
  echo "Missing --enroll-token." >&2
  exit 1
fi

payload=$(python3 - <<PY
import json
print(json.dumps({
  "project_id": "${PROJECT_ID}",
  "client_id": "${CLIENT_ID}",
  "software_id": "${SOFTWARE_ID}",
  "enroll_token": "${ENROLL_TOKEN}"
}))
PY
)

response=$(curl -fsS -H "Content-Type: application/json" \
  -d "${payload}" "${SERVICE_URL%/}/v1/enroll")

token=$(python3 - <<PY
import json, sys
data = json.loads(sys.stdin.read())
token = data.get("token", "")
if not token:
  sys.exit("Enrollment response missing token")
print(token)
PY
<<<"${response}")

if [[ -n "${TOKEN_FILE}" ]]; then
  umask 177
  mkdir -p "$(dirname "${TOKEN_FILE}")"
  printf '%s' "${token}" > "${TOKEN_FILE}"
  chmod 600 "${TOKEN_FILE}"
  echo "Token written to ${TOKEN_FILE}"
else
  echo "${token}"
fi