#!/usr/bin/env bash
set -Eeuo pipefail

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  exec sudo -- "$0" "$@"
fi

CRED_DIR="/etc/shire/marketing-boss-credentials"
SERVICE="shire-marketing-boss.service"
BASE="http://127.0.0.1:4173"

mkdir -p "$CRED_DIR"
chmod 0700 "$CRED_DIR"

write_secret() {
  local name="$1" value="$2" tmp
  tmp="$(mktemp "$CRED_DIR/.${name}.XXXXXX")"
  chmod 0600 "$tmp"
  printf '%s' "$value" > "$tmp"
  chown root:root "$tmp"
  mv -f "$tmp" "$CRED_DIR/$name"
  chmod 0600 "$CRED_DIR/$name"
}

current_present() {
  [[ -s "$CRED_DIR/$1" ]]
}

prompt_visible() {
  local label="$1" name="$2" value=""
  if current_present "$name"; then
    read -r -p "$label [press Enter to keep existing]: " value
    [[ -z "$value" ]] && return 0
  else
    read -r -p "$label: " value
    [[ -z "$value" ]] && { echo "No value entered; unchanged."; return 0; }
  fi
  write_secret "$name" "$value"
}

prompt_hidden() {
  local label="$1" name="$2" value=""
  if current_present "$name"; then
    read -r -s -p "$label [press Enter to keep existing]: " value; echo
    [[ -z "$value" ]] && return 0
  else
    read -r -s -p "$label: " value; echo
    [[ -z "$value" ]] && { echo "No value entered; unchanged."; return 0; }
  fi
  write_secret "$name" "$value"
}

show_callbacks() {
  cat <<TXT
Register these exact callback addresses:

Facebook:
  ${BASE}/api/oauth/callback/facebook
Instagram:
  ${BASE}/api/oauth/callback/instagram
TikTok Desktop Login Kit:
  ${BASE}/api/oauth/callback/tiktok
YouTube Shorts / Google:
  ${BASE}/api/oauth/callback/youtube_shorts

LinkedIn remains staged until Marketing Boss receives an owned HTTPS callback domain.
Do not use the localhost callback for LinkedIn's normal web-server flow.
TXT
}

configure_meta() {
  echo "=== META: FACEBOOK + INSTAGRAM ==="
  prompt_visible "Meta App ID" META_APP_ID
  prompt_hidden "Meta App Secret" META_APP_SECRET
}

configure_google() {
  echo "=== GOOGLE / YOUTUBE SHORTS ==="
  prompt_visible "Google OAuth Client ID" GOOGLE_CLIENT_ID
  prompt_hidden "Google OAuth Client Secret" GOOGLE_CLIENT_SECRET
}

configure_tiktok() {
  echo "=== TIKTOK DESKTOP LOGIN KIT ==="
  prompt_visible "TikTok Client Key" TIKTOK_CLIENT_KEY
  prompt_hidden "TikTok Client Secret" TIKTOK_CLIENT_SECRET
}

show_status() {
  curl -fsS "$BASE/api/oauth/status" | python3 -m json.tool
}

restart_and_verify() {
  systemctl restart "$SERVICE"
  sleep 2
  systemctl is-active --quiet "$SERVICE"
  echo
  echo "Marketing Boss restarted successfully."
  show_status
}

case "${1:-menu}" in
  meta)
    configure_meta
    restart_and_verify
    ;;
  google|youtube)
    configure_google
    restart_and_verify
    ;;
  tiktok)
    configure_tiktok
    restart_and_verify
    ;;
  callbacks)
    show_callbacks
    ;;
  status)
    show_status
    ;;
  menu)
    show_callbacks
    echo
    echo "Choose credentials to add:"
    echo "  1) Facebook + Instagram (Meta)"
    echo "  2) YouTube Shorts (Google)"
    echo "  3) TikTok"
    echo "  4) Show current status"
    read -r -p "Choice: " choice
    case "$choice" in
      1) configure_meta; restart_and_verify ;;
      2) configure_google; restart_and_verify ;;
      3) configure_tiktok; restart_and_verify ;;
      4) show_status ;;
      *) echo "No changes made." ;;
    esac
    ;;
  *)
    echo "Usage: sudo shire-marketing-socials [meta|youtube|tiktok|callbacks|status]" >&2
    exit 2
    ;;
esac