#!/bin/bash
set -euo pipefail

# Load IP configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


# Complete SSL Configuration Fix Script
# This script resets NPM password and configures all SSL certificates

set -e

PROXMOX_HOST="${PROXMOX_HOST_R630_01}"
CONTAINER_ID=105
NPM_URL="http://${IP_NGINX_LEGACY:-192.168.11.26}:81"
EMAIL="nsatoshi2007@hotmail.com"
# PASSWORD should come from environment variable
PASSWORD="${NPM_PASSWORD:-${1:-}}"
if [ -z "$PASSWORD" ]; then
    echo "❌ NPM_PASSWORD environment variable is required"
    echo "   Set it in ~/.env file: NPM_PASSWORD=your-password"
    exit 1
fi

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🔒 Complete SSL Configuration Fix"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# Step 1: Reset password
echo "📋 Step 1: Resetting NPM password..."
bash scripts/nginx-proxy-manager/reset-npm-password.sh "$PASSWORD" "$EMAIL" || {
    echo "⚠️  Password reset failed, continuing anyway..."
}

# Step 2: Wait a moment for password to take effect
echo ""
echo "⏳ Waiting 3 seconds for password to sync..."
sleep 3

# Step 3: Test authentication
echo ""
echo "📋 Step 2: Testing authentication..."
TOKEN_RESPONSE=$(curl -s -X POST "$NPM_URL/api/tokens" \
  -H "Content-Type: application/json" \
  -d "{\"identity\":\"$EMAIL\",\"secret\":\"$PASSWORD\"}" 2>&1)

TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.token // empty' 2>/dev/null || echo "")

if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
    ERROR_MSG=$(echo "$TOKEN_RESPONSE" | jq -r '.error.message // "Unknown error"' 2>/dev/null || echo "$TOKEN_RESPONSE")
    echo "❌ Authentication failed: $ERROR_MSG"
    echo ""
    echo "💡 Manual steps required:"
    echo "   1. Access NPM UI: $NPM_URL"
    echo "   2. Try logging in with: $EMAIL / $PASSWORD"
    echo "   3. If that fails, use 'Forgot Password' feature"
    echo "   4. Then run: node scripts/nginx-proxy-manager/configure-ssl-api.js"
    exit 1
fi

echo "✅ Authentication successful"
echo ""

# Step 4: Configure SSL using API script
echo "📋 Step 3: Configuring SSL certificates..."
cd /home/intlc/projects/proxmox
export NPM_URL="$NPM_URL"
export NPM_EMAIL="$EMAIL"
export NPM_PASSWORD="$PASSWORD"

node scripts/nginx-proxy-manager/configure-ssl-api.js

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "✅ SSL Configuration Complete"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "📋 Next steps:"
echo "   1. Wait 1-2 minutes for Let's Encrypt certificates to be issued"
echo "   2. Test HTTPS: curl -I https://sankofa.nexus"
echo "   3. Verify all domains: bash scripts/check-east-west-ssl-status.sh"
echo ""