#!/usr/bin/env bash
#
# Brings the API layer up locally for testing: keys, config, database user,
# first platform admin, PHP dev server. Not for production.
#
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
KEYS=${KEYS:-/tmp/caremeet-keys}
DBNAME=${DBNAME:-caremeet}

mkdir -p "$KEYS"
if [ ! -f "$KEYS/jwt_private.pem" ]; then
  openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$KEYS/jwt_private.pem" 2>/dev/null
  openssl rsa -pubout -in "$KEYS/jwt_private.pem" -out "$KEYS/jwt_public.pem" 2>/dev/null
  chmod 600 "$KEYS/jwt_private.pem"
  echo "keys generated in $KEYS"
fi

MASTER_KEY=$(php -r 'echo base64_encode(random_bytes(32));')

cat > "$ROOT/api/config/config.php" <<PHPCFG
<?php
return [
  'env' => 'development',
  'debug' => true,
  'db' => ['host'=>'127.0.0.1','port'=>3306,'name'=>'$DBNAME','user'=>'root','password'=>'','charset'=>'utf8mb4'],
  'jwt' => ['private_key_path'=>'$KEYS/jwt_private.pem','issuer'=>'caremeet-api','audience'=>'caremeet-signaling','ttl_seconds'=>900],
  'signaling' => ['public_url'=>'ws://127.0.0.1:4000','internal_url'=>'http://127.0.0.1:4001'],
  'session' => ['cookie_name'=>'cm_sess','ttl_hours'=>12,'secure'=>false],
  'app' => ['patient_base_url'=>'http://127.0.0.1:8081','console_base_url'=>'http://127.0.0.1:8081'],
  'mail' => ['from'=>'no-reply@caremeet.local','from_name'=>'CareMeet'],
  'security' => ['signature_max_skew_seconds'=>300,'max_login_attempts'=>5,'lockout_minutes'=>15,'master_key'=>'$MASTER_KEY'],
];
PHPCFG

ADMIN_EMAIL=${ADMIN_EMAIL:-admin@caresoft.local}
ADMIN_PASS=${ADMIN_PASS:-DevPassword123!}
HASH=$(php -r "echo password_hash('$ADMIN_PASS', PASSWORD_DEFAULT);")

mariadb "$DBNAME" -e "
  DELETE FROM platform_admins WHERE email='$ADMIN_EMAIL';
  INSERT INTO platform_admins (name,email,password_hash,role,status)
  VALUES ('Dev Admin','$ADMIN_EMAIL','$HASH','super_admin','active');"

echo "platform admin: $ADMIN_EMAIL / $ADMIN_PASS"
echo "starting API on http://127.0.0.1:8080"
exec php -S 127.0.0.1:8080 "$ROOT/api/public/index.php"