#!/usr/bin/env bash
# Add Cloudflare DNS record for Sankofa Studio: studio.sankofa.nexus
# A record: studio → 76.53.10.36 (or PUBLIC_IP). Use CNAME to tunnel if you use Cloudflare Tunnel.
#
# Usage: bash scripts/cloudflare/add-studio-sankofa-dns.sh
# Requires: .env with CLOUDFLARE_API_TOKEN (or CLOUDFLARE_EMAIL + CLOUDFLARE_API_KEY)
#           CLOUDFLARE_ZONE_ID_SANKOFA_NEXUS for zone sankofa.nexus
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
cd "$PROJECT_ROOT"
source config/ip-addresses.conf 2>/dev/null || true
[ -f .env ] && set +u && source .env 2>/dev/null || true && set -u

ZONE_ID="${CLOUDFLARE_ZONE_ID_SANKOFA_NEXUS:-}"
PUBLIC_IP="${PUBLIC_IP:-76.53.10.36}"
NAME="studio"

if [ -n "${CLOUDFLARE_API_TOKEN:-}" ]; then
  AUTH_H=(-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN")
elif [ -n "${CLOUDFLARE_API_KEY:-}" ] && [ -n "${CLOUDFLARE_EMAIL:-}" ]; then
  AUTH_H=(-H "X-Auth-Email: $CLOUDFLARE_EMAIL" -H "X-Auth-Key: $CLOUDFLARE_API_KEY")
else
  echo "❌ Set CLOUDFLARE_API_TOKEN or (CLOUDFLARE_EMAIL + CLOUDFLARE_API_KEY) in .env"
  exit 1
fi

[ -z "$ZONE_ID" ] && { echo "❌ Set CLOUDFLARE_ZONE_ID_SANKOFA_NEXUS in .env"; exit 1; }

echo "Adding DNS for ${NAME}.sankofa.nexus → $PUBLIC_IP (zone: sankofa.nexus)"

DATA=$(jq -n --arg name "$NAME" --arg content "$PUBLIC_IP" \
  '{type:"A",name:$name,content:$content,ttl:1,proxied:true}')

EXISTING=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records?name=${NAME}.sankofa.nexus" \
  "${AUTH_H[@]}" -H "Content-Type: application/json")
RECORD_ID=$(echo "$EXISTING" | jq -r '.result[0].id // empty')

if [ -n "$RECORD_ID" ] && [ "$RECORD_ID" != "null" ]; then
  UPD=$(curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records/${RECORD_ID}" \
    "${AUTH_H[@]}" -H "Content-Type: application/json" -d "$DATA")
  if echo "$UPD" | jq -e '.success == true' >/dev/null 2>&1; then
    echo "✓ ${NAME}.sankofa.nexus: Updated A → $PUBLIC_IP"
  else
    echo "❌ Update failed: $(echo "$UPD" | jq -r '.errors[0].message // "unknown"' 2>/dev/null)"
    exit 1
  fi
else
  CR=$(curl -s -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records" \
    "${AUTH_H[@]}" -H "Content-Type: application/json" -d "$DATA")
  if echo "$CR" | jq -e '.success == true' >/dev/null 2>&1; then
    echo "✓ ${NAME}.sankofa.nexus: Created A → $PUBLIC_IP"
  else
    echo "❌ Create failed: $(echo "$CR" | jq -r '.errors[0].message // "unknown"' 2>/dev/null)"
    exit 1
  fi
fi
echo "Done."