#!/bin/bash
# Script to help set up GitHub repository secrets for TLS certificates
# This script provides the commands needed to upload the Let's Encrypt certificates as GitHub secrets

set -e

echo "🔐 GitHub Secrets Setup for TLS Certificates"
echo "============================================="
echo ""

PROJECT_ROOT=$(cd "$(dirname "$0")/.." && pwd)
CERT_FILE="$PROJECT_ROOT/certs/letsencrypt-server.crt"
KEY_FILE="$PROJECT_ROOT/certs/letsencrypt-server.key"

# Check if certificates exist
if [[ ! -f "$CERT_FILE" ]] || [[ ! -f "$KEY_FILE" ]]; then
    echo "❌ Error: Let's Encrypt certificates not found!"
    echo ""
    echo "Expected files:"
    echo "  - $CERT_FILE"
    echo "  - $KEY_FILE"
    echo ""
    echo "💡 Please generate the certificates first using:"
    echo "   cd src/demo_client/scripts"
    echo "   ./generate_cert2.sh -d quientienemail.com -e admin@quientienemail.com -p manual"
    exit 1
fi

echo "📋 Certificate Information"
echo "========================="
echo "🏢 Issuer: $(openssl x509 -in "$CERT_FILE" -noout -issuer | sed 's/issuer=//')"
echo "🌐 Subject: $(openssl x509 -in "$CERT_FILE" -noout -subject | sed 's/subject=//')"
echo "📅 Valid From: $(openssl x509 -in "$CERT_FILE" -noout -startdate | cut -d= -f2)"
echo "📅 Valid Until: $(openssl x509 -in "$CERT_FILE" -noout -enddate | cut -d= -f2)"
echo "🔐 Algorithm: $(openssl x509 -in "$CERT_FILE" -noout -text | grep "Signature Algorithm" | head -1 | sed 's/.*Signature Algorithm: //')"
echo ""

echo "🚀 GitHub Secrets Setup Instructions"
echo "===================================="
echo ""
echo "You have two options to set up the GitHub secrets:"
echo ""

echo "Option 1: Using GitHub CLI (recommended)"
echo "----------------------------------------"
echo "If you have GitHub CLI installed, run these commands:"
echo ""
echo "# Install GitHub CLI if not already installed (macOS):"
echo "# brew install gh"
echo ""
echo "# Login to GitHub:"
echo "# gh auth login"
echo ""
echo "# Set the TLS certificate secret:"
echo "gh secret set TLS_CERTIFICATE < \"$CERT_FILE\""
echo ""
echo "# Set the TLS private key secret:"
echo "gh secret set TLS_PRIVATE_KEY < \"$KEY_FILE\""
echo ""

echo "Option 2: Using GitHub Web Interface"
echo "------------------------------------"
echo "1. Go to: https://github.com/MiguelElGallo/mpzsql/settings/secrets/actions"
echo "2. Click 'New repository secret'"
echo "3. Create the first secret:"
echo "   - Name: TLS_CERTIFICATE"
echo "   - Value: Copy and paste the entire certificate content below:"
echo ""
echo "--- BEGIN TLS_CERTIFICATE CONTENT ---"
cat "$CERT_FILE"
echo "--- END TLS_CERTIFICATE CONTENT ---"
echo ""
echo "4. Create the second secret:"
echo "   - Name: TLS_PRIVATE_KEY"
echo "   - Value: Copy and paste the entire private key content below:"
echo ""
echo "--- BEGIN TLS_PRIVATE_KEY CONTENT ---"
cat "$KEY_FILE"
echo "--- END TLS_PRIVATE_KEY CONTENT ---"
echo ""

echo "✅ Verification"
echo "==============="
echo "After setting up the secrets, you can verify they work by:"
echo ""
echo "1. Pushing your changes to trigger the GitHub Actions workflow:"
echo "   git push origin feature/letsencrypt"
echo ""
echo "2. Check the workflow run at:"
echo "   https://github.com/MiguelElGallo/mpzsql/actions"
echo ""
echo "3. Look for the 'Display Certificate Information' step to see certificate details"
echo ""

echo "🔒 Security Notes"
echo "================="
echo "• GitHub secrets are encrypted and only accessible to authorized workflows"
echo "• The private key will be securely handled and automatically cleaned up in CI"
echo "• Local development continues to use the actual certificate files"
echo "• The workflow displays certificate information (but not the private key)"
echo ""

echo "📝 Next Steps"
echo "============="
echo "1. Set up the GitHub secrets using one of the methods above"
echo "2. Push your changes: git push origin feature/letsencrypt"
echo "3. Monitor the GitHub Actions workflow execution"
echo "4. Verify that the E2E tests pass in the CI environment"
echo ""
