#!/usr/bin/env bash
# Activate full SWIFT stack for Central Bank + Office 24 + Z Online Bank (production).
set -euo pipefail

REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
LISTENER_URL="${SWIFT_LISTENER_URL:-http://127.0.0.1:8788}"
SETTLEMENT_BASE="${SETTLEMENT_HEALTH_URL:-https://secure.omdnl.org/settlement}"

log() { echo "[$(date -Iseconds)] swift-activate $*"; }
fail() { log "FAIL: $*"; exit 1; }

[[ -f "$ENV_FILE" ]] || fail "Missing $ENV_FILE — load zardasht handoff first (chmod 600)"

set -a
# shellcheck disable=SC1090
source "$ENV_FILE"
set +a

: "${OMNL_FINERACT_BASE_URL:?Set OMNL_FINERACT_BASE_URL}"
: "${OMNL_FINERACT_PASSWORD:?Set OMNL_FINERACT_PASSWORD}"
: "${OMNL_SUPER_ADMIN_OFFICE24_KEY:?Set OMNL_SUPER_ADMIN_OFFICE24_KEY}"

export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
export SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-$LISTENER_URL}"
export SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-1}"
export OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}"

log "1/5 Start SWIFT listener..."
bash "$REPO_DIR/scripts/deployment/start-swift-listener-production.sh"

log "2/5 Settlement health + Office 24..."
health="$(curl -sS "${SETTLEMENT_BASE}/health")"
echo "$health" | grep -q '"officeId":24' || fail "Office 24 not bound on settlement health"
echo "$health" | grep -q '"status":"ok"' || fail "Settlement health not ok"

log "3/5 Public money supply (Fineract live)..."
ms="$(curl -sS "${SETTLEMENT_BASE}/public/money-supply")"
echo "$ms" | grep -q 'fineractLive' || log "WARN: fineractLive not in money-supply response"

log "4/5 SWIFT auth probe (empty external-transfer — expect validation error)..."
code="$(curl -sS -o /tmp/swift-probe.json -w '%{http_code}' \
  -X POST "${SETTLEMENT_BASE}/external-transfer" \
  -H "Authorization: Bearer ${OMNL_SUPER_ADMIN_OFFICE24_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}')"
[[ "$code" == "400" || "$code" == "500" ]] || fail "external-transfer auth probe HTTP $code (expected 400/500)"
grep -qi idempotencyKey /tmp/swift-probe.json || fail "Auth probe missing validation message"

log "5/5 Inbound SWIFT stub (MT103 → listener)..."
MT103='{1:F01OMNLUS33XXXX}{2:I103BANKUS33XXXXN}{4:
:20:SWIFT-ACTIVATE-TEST
:32A:260703USD1,00
:59:/IQ98ZARD00000000000000000001
Test Beneficiary
:70:OMNL SWIFT activate probe chain138 cWUSDC
-}'
curl -sS -o /dev/null -w "listener=%{http_code}\n" \
  -X POST "${SWIFT_LISTENER_URL}/inbound" \
  -H "Content-Type: text/plain" \
  ${SWIFT_LISTENER_WEBHOOK_TOKEN:+-H "Authorization: Bearer ${SWIFT_LISTENER_WEBHOOK_TOKEN}"} \
  --data-binary "$MT103"

log "SWIFT production stack active"
log "  Listener:  ${SWIFT_LISTENER_URL}/health"
log "  Settlement: ${SETTLEMENT_BASE}/health"
log "  Portal:     /central-bank#z-settlement-protocols (MT102/MT103/SBLC/BG)"
log "  Catalog:    config/swift-mt-catalog.v1.json"
log ""
log "MT types: MT103 MT102 MT202 MT910 MT940 MT942 MT950 + ISO20022 pacs/camt"
log "Redeploy banking LXCs: bash scripts/deployment/deploy-omnl-bank-production.sh"