#!/usr/bin/env bash
set -Eeuo pipefail

if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
  exec sudo -- "$0" "$@"
fi

CRED_DIR="/etc/shire/marketing-boss-credentials"
SERVICE="shire-marketing-boss.service"
BASE="http://127.0.0.1:4173"
PUBLIC_BASE="https://marketing-auth.shire3d.com"

mkdir -p "$CRED_DIR"
chmod 0700 "$CRED_DIR"

write_secret() {
  local name="$1" value="$2" tmp
  tmp="$(mktemp "$CRED_DIR/.${name}.XXXXXX")"
  chmod 0600 "$tmp"
  printf '%s' "$value" > "$tmp"
  chown root:root "$tmp"
  mv -f "$tmp" "$CRED_DIR/$name"
  chmod 0600 "$CRED_DIR/$name"
}

current_present() { [[ -s "$CRED_DIR/$1" ]]; }

prompt_visible() {
  local label="$1" name="$2" value=""
  if current_present "$name"; then
    read -r -p "$label [press Enter to keep existing]: " value
    [[ -z "$value" ]] && return 0
  else
    read -r -p "$label: " value
    [[ -z "$value" ]] && { echo "No value entered; unchanged."; return 0; }
  fi
  write_secret "$name" "$value"
}

prompt_hidden() {
  local label="$1" name="$2" value=""
  if current_present "$name"; then
    read -r -s -p "$label [press Enter to keep existing]: " value; echo
    [[ -z "$value" ]] && return 0
  else
    read -r -s -p "$label: " value; echo
    [[ -z "$value" ]] && { echo "No value entered; unchanged."; return 0; }
  fi
  write_secret "$name" "$value"
}

show_callbacks() {
  cat <<TXT
Register these exact HTTPS callback addresses:

Facebook:
  ${PUBLIC_BASE}/api/oauth/callback/facebook
Instagram:
  ${PUBLIC_BASE}/api/oauth/callback/instagram
TikTok Web Login Kit:
  ${PUBLIC_BASE}/api/oauth/callback/tiktok
YouTube Shorts / Google:
  ${PUBLIC_BASE}/api/oauth/callback/youtube_shorts
LinkedIn:
  ${PUBLIC_BASE}/api/oauth/callback/linkedin

The Marketing Boss dashboard remains private on Tailscale.
Only the callback gate is intended to be public.
TXT
}

configure_meta() {
  echo "=== META: FACEBOOK + INSTAGRAM ==="
  prompt_visible "Meta App ID" META_APP_ID
  prompt_hidden "Meta App Secret" META_APP_SECRET
}

configure_google() {
  echo "=== GOOGLE / YOUTUBE SHORTS ==="
  prompt_visible "Google OAuth Client ID" GOOGLE_CLIENT_ID
  prompt_hidden "Google OAuth Client Secret" GOOGLE_CLIENT_SECRET
}

configure_tiktok() {
  echo "=== TIKTOK WEB LOGIN KIT ==="
  prompt_visible "TikTok Client Key" TIKTOK_CLIENT_KEY
  prompt_hidden "TikTok Client Secret" TIKTOK_CLIENT_SECRET
}

configure_linkedin() {
  echo "=== LINKEDIN ==="
  prompt_visible "LinkedIn Client ID" LINKEDIN_CLIENT_ID
  prompt_hidden "LinkedIn Client Secret" LINKEDIN_CLIENT_SECRET
}

show_status() { curl -fsS "$BASE/api/oauth/status" | python3 -m json.tool; }

restart_and_verify() {
  systemctl restart "$SERVICE"
  sleep 2
  systemctl is-active --quiet "$SERVICE"
  echo
  echo "Marketing Boss restarted successfully."
  show_status
}

case "${1:-menu}" in
  meta) configure_meta; restart_and_verify ;;
  google|youtube) configure_google; restart_and_verify ;;
  tiktok) configure_tiktok; restart_and_verify ;;
  linkedin) configure_linkedin; restart_and_verify ;;
  callbacks) show_callbacks ;;
  status) show_status ;;
  menu)
    show_callbacks
    echo
    echo "Choose credentials to add:"
    echo "  1) Facebook + Instagram (Meta)"
    echo "  2) YouTube Shorts (Google)"
    echo "  3) TikTok"
    echo "  4) LinkedIn"
    echo "  5) Show current status"
    read -r -p "Choice: " choice
    case "$choice" in
      1) configure_meta; restart_and_verify ;;
      2) configure_google; restart_and_verify ;;
      3) configure_tiktok; restart_and_verify ;;
      4) configure_linkedin; restart_and_verify ;;
      5) show_status ;;
      *) echo "No changes made." ;;
    esac
    ;;
  *)
    echo "Usage: sudo shire-marketing-socials [meta|youtube|tiktok|linkedin|callbacks|status]" >&2
    exit 2
    ;;
esac