#!/usr/bin/env bash
# Patch INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json with SHA-256 of counsel memo and audit PDFs
# (after they are placed in SUBREG or any local path). Then rebuild: scripts/omnl/build-transaction-package-zip.sh
#
# Usage:
#   COUNSEL_PDF=/path/to/counsel-memo.pdf AUDIT_PDF=/path/to/audit-report.pdf \
#     bash scripts/omnl/patch-attestation-subreg-pdf-hashes.sh
#
# Optional:
#   ATTESTATION_JSON=docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json
#   NOW_UTC=$(date -u +%Y-%m-%dT%H:%M:%SZ)  — defaults to date -u

set -euo pipefail
REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
ATTESTATION_JSON="${ATTESTATION_JSON:-${REPO_ROOT}/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json}"

: "${COUNSEL_PDF:?Set COUNSEL_PDF to counsel memo PDF path}"
: "${AUDIT_PDF:?Set AUDIT_PDF to independent audit report PDF path}"

[ -f "$COUNSEL_PDF" ] || { echo "Not a file: $COUNSEL_PDF" >&2; exit 1; }
[ -f "$AUDIT_PDF" ] || { echo "Not a file: $AUDIT_PDF" >&2; exit 1; }
[ -f "$ATTESTATION_JSON" ] || { echo "Not a file: $ATTESTATION_JSON" >&2; exit 1; }

command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }

C_HASH=$(sha256sum "$COUNSEL_PDF" | awk '{print $1}')
A_HASH=$(sha256sum "$AUDIT_PDF" | awk '{print $1}')
NOW_UTC="${NOW_UTC:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}"

TMP=$(mktemp)
jq --arg c "$C_HASH" --arg a "$A_HASH" --arg t "$NOW_UTC" \
  '.legalFinality.counselMemoPdfSha256 = $c
   | .legalFinality.counselMemoDateUtc = $t
   | .legalFinality.counselMemoBindingNote = ("SHA-256 of SUBREG counsel memo PDF: " + $c)
   | .independentAudit.reportPdfSha256 = $a
   | .independentAudit.reportDateUtc = $t
   | .independentAudit.reportBindingNote = ("SHA-256 of SUBREG independent audit report PDF: " + $a)
  ' "$ATTESTATION_JSON" > "$TMP"
mv "$TMP" "$ATTESTATION_JSON"

echo "Updated $ATTESTATION_JSON" >&2
echo "  counselMemoPdfSha256=$C_HASH" >&2
echo "  reportPdfSha256=$A_HASH" >&2
echo "Rebuild: bash scripts/omnl/build-transaction-package-zip.sh" >&2