$ErrorActionPreference = 'Stop'
Set-Location $PSScriptRoot

Write-Host ""
Write-Host "============================================================" -ForegroundColor DarkYellow
Write-Host " SHIRE Marketing Forge - Secure Social Login Setup" -ForegroundColor Yellow
Write-Host "============================================================" -ForegroundColor DarkYellow
Write-Host ""
Write-Host "This stores developer APP credentials only." -ForegroundColor White
Write-Host "It never asks for your Facebook, Instagram, LinkedIn, TikTok or Google password." -ForegroundColor Green
Write-Host "Secrets are encrypted with Windows DPAPI for your Windows user account." -ForegroundColor Green
Write-Host "Leave a platform blank to skip it for now." -ForegroundColor Gray
Write-Host ""

function Read-PlainOptional([string]$Prompt) {
  return (Read-Host $Prompt).Trim()
}

function Read-SecureOptional([string]$Prompt) {
  $secure = Read-Host $Prompt -AsSecureString
  if ($secure.Length -eq 0) { return '' }
  return ConvertFrom-SecureString $secure
}

$config = [ordered]@{
  version = 1
  createdAt = (Get-Date).ToString('o')
  metaAppId = ''
  metaAppSecret = ''
  linkedinClientId = ''
  linkedinClientSecret = ''
  tiktokClientKey = ''
  tiktokClientSecret = ''
  googleClientId = ''
  googleClientSecret = ''
}

Write-Host "META - Facebook and Instagram" -ForegroundColor Cyan
$config.metaAppId = Read-PlainOptional "Meta App ID"
if ($config.metaAppId) { $config.metaAppSecret = Read-SecureOptional "Meta App Secret" }
Write-Host ""

Write-Host "LINKEDIN" -ForegroundColor Cyan
$config.linkedinClientId = Read-PlainOptional "LinkedIn Client ID"
if ($config.linkedinClientId) { $config.linkedinClientSecret = Read-SecureOptional "LinkedIn Client Secret" }
Write-Host ""

Write-Host "TIKTOK" -ForegroundColor Cyan
$config.tiktokClientKey = Read-PlainOptional "TikTok Client Key"
if ($config.tiktokClientKey) { $config.tiktokClientSecret = Read-SecureOptional "TikTok Client Secret" }
Write-Host ""

Write-Host "GOOGLE / YOUTUBE SHORTS" -ForegroundColor Cyan
$config.googleClientId = Read-PlainOptional "Google OAuth Client ID"
if ($config.googleClientId) { $config.googleClientSecret = Read-SecureOptional "Google OAuth Client Secret" }
Write-Host ""

$configPath = Join-Path $PSScriptRoot 'social-oauth.secure.json'
$config | ConvertTo-Json -Depth 3 | Set-Content -Path $configPath -Encoding UTF8

Write-Host "Secure configuration saved:" -ForegroundColor Green
Write-Host $configPath -ForegroundColor White
Write-Host ""
Write-Host "Close the Forge if it is running, then start it again with start-windows.bat." -ForegroundColor Yellow
Write-Host "Open the Accounts screen and use the official Sign in buttons." -ForegroundColor Yellow
Write-Host ""
Read-Host "Press Enter to close"
