#!/usr/bin/env sh
set -eu

cd "$(dirname "$0")"
umask 077
mkdir -p secrets

validate_tenant() {
  : "${STANDALONE_TENANT_ID:?Set STANDALONE_TENANT_ID to the platform organization ID before setup}"
  if ! printf '%s\n' "$STANDALONE_TENANT_ID" | LC_ALL=C grep -Eq '^[0-9A-HJKMNP-TV-Z]{26}$'; then
    echo 'STANDALONE_TENANT_ID must be a 26-character ULID' >&2
    exit 1
  fi
  if [ "$STANDALONE_TENANT_ID" = '01J00000000000000000000000' ]; then
    echo 'The development placeholder cannot be used for a pilot organization' >&2
    exit 1
  fi
}

if [ ! -f .env ]; then
  validate_tenant
  migration_password="$(openssl rand -hex 32)"
  app_password="$(openssl rand -hex 32)"
  manager_token="$(openssl rand -hex 32)"
  terminal_token="$(openssl rand -hex 32)"
  pfx_passphrase="$(openssl rand -hex 32)"
  {
    printf 'POSTGRES_MIGRATION_PASSWORD=%s\n' "$migration_password"
    printf 'POSTGRES_APP_PASSWORD=%s\n' "$app_password"
    printf 'STANDALONE_MANAGER_TOKEN=%s\n' "$manager_token"
    printf 'STANDALONE_TERMINAL_TOKEN=%s\n' "$terminal_token"
    printf 'HTTPS_PFX_PASSPHRASE=%s\n' "$pfx_passphrase"
    printf 'STANDALONE_TENANT_ID=%s\n' "$STANDALONE_TENANT_ID"
    printf 'STANDALONE_ACTOR_ID=01J00000000000000000000001\n'
    printf 'STANDALONE_TERMINAL_ACTOR_ID=01J00000000000000000000002\n'
  } > .env
  printf '%s\n' "$manager_token" > secrets/manager.token
  printf '%s\n' "$terminal_token" > secrets/terminal.token
fi

. ./.env
validate_tenant

if ! grep -q '^VAPID_PUBLIC_KEY=' .env; then
  docker run --rm \
    -v "$(cd ../.. && pwd):/app:ro" \
    -w /app \
    node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 \
    node scripts/generate-vapid-keys.mjs >> .env
fi

. ./.env
validate_tenant
if [ ! -f secrets/staff.pfx ]; then
  openssl req -x509 -newkey rsa:3072 -sha256 -days 365 -nodes \
    -keyout secrets/staff.key -out secrets/staff.crt \
    -subj '/CN=192.168.1.81' \
    -addext 'subjectAltName=IP:192.168.1.81' \
    -addext 'keyUsage=digitalSignature,keyEncipherment' \
    -addext 'extendedKeyUsage=serverAuth'
  openssl pkcs12 -export -out secrets/staff.pfx \
    -inkey secrets/staff.key -in secrets/staff.crt \
    -passout "pass:${HTTPS_PFX_PASSPHRASE}"
fi

openssl x509 -in secrets/staff.crt -outform DER | sha256sum | cut -d ' ' -f 1 > secrets/certificate.sha256
chmod 600 .env secrets/*
docker compose --env-file .env config >/dev/null
docker compose --env-file .env up -d --build