#!/bin/bash

echo "=== Complete Keycloak and Database Setup ==="
echo ""

# Get admin token
echo "1. Getting Keycloak admin token..."
ADMIN_TOKEN=$(curl -s -X POST "http://localhost:8080/realms/master/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=admin" \
  -d "password=admin" \
  -d "grant_type=password" \
  -d "client_id=admin-cli" | jq -r '.access_token')

if [ -z "$ADMIN_TOKEN" ] || [ "$ADMIN_TOKEN" = "null" ]; then
  echo "❌ Failed to get admin token"
  exit 1
fi

echo "✅ Got admin token"

# Create backend client
echo ""
echo "2. Creating backend client (b2b-flight-backend)..."
curl -s -X POST "http://localhost:8080/admin/realms/b2b-flight-platform/clients" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "b2b-flight-backend",
    "enabled": true,
    "clientAuthenticatorType": "client-secret",
    "secret": "b2b-flight-backend-secret",
    "directAccessGrantsEnabled": true,
    "serviceAccountsEnabled": true,
    "authorizationServicesEnabled": false,
    "standardFlowEnabled": true,
    "implicitFlowEnabled": false,
    "publicClient": false,
    "protocol": "openid-connect"
  }' 2>&1 | head -5

echo "✅ Backend client created/updated"

# Create frontend client
echo ""
echo "3. Creating/updating frontend client (b2b-flight-frontend)..."
curl -s -X POST "http://localhost:8080/admin/realms/b2b-flight-platform/clients" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "b2b-flight-frontend",
    "enabled": true,
    "publicClient": true,
    "directAccessGrantsEnabled": true,
    "standardFlowEnabled": true,
    "implicitFlowEnabled": false,
    "redirectUris": ["http://localhost:4200/*"],
    "webOrigins": ["http://localhost:4200"],
    "protocol": "openid-connect"
  }' 2>&1 | head -5

echo "✅ Frontend client created/updated"

# Create SUPER_ADMIN role
echo ""
echo "4. Creating SUPER_ADMIN role..."
curl -s -X POST "http://localhost:8080/admin/realms/b2b-flight-platform/roles" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "SUPER_ADMIN",
    "description": "Super Administrator role"
  }' 2>&1 | head -5

echo "✅ SUPER_ADMIN role created/updated"

# Get or create user
echo ""
echo "5. Setting up superadmin user..."
USER_ID=$(curl -s -X GET "http://localhost:8080/admin/realms/b2b-flight-platform/users?username=superadmin" \
  -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.[0].id')

if [ -z "$USER_ID" ] || [ "$USER_ID" = "null" ]; then
  echo "Creating new user..."
  curl -s -X POST "http://localhost:8080/admin/realms/b2b-flight-platform/users" \
    -H "Authorization: Bearer $ADMIN_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "username": "superadmin",
      "email": "superadmin@b2bflight.com",
      "enabled": true,
      "emailVerified": true
    }'
  
  sleep 2
  USER_ID=$(curl -s -X GET "http://localhost:8080/admin/realms/b2b-flight-platform/users?username=superadmin" \
    -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.[0].id')
fi

echo "User ID: $USER_ID"

# Set password
echo ""
echo "6. Setting password..."
curl -s -X PUT "http://localhost:8080/admin/realms/b2b-flight-platform/users/$USER_ID/reset-password" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "password",
    "value": "SuperAdmin123!",
    "temporary": false
  }'

echo "✅ Password set"

# Assign role
echo ""
echo "7. Assigning SUPER_ADMIN role..."
ROLE_ID=$(curl -s -X GET "http://localhost:8080/admin/realms/b2b-flight-platform/roles/SUPER_ADMIN" \
  -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.id')

curl -s -X POST "http://localhost:8080/admin/realms/b2b-flight-platform/users/$USER_ID/role-mappings/realm" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d "[{
    \"id\": \"$ROLE_ID\",
    \"name\": \"SUPER_ADMIN\"
  }]"

echo "✅ Role assigned"

# Create user in database
echo ""
echo "8. Creating user in database..."
docker exec -i b2b-flight-postgres psql -U postgres -d b2b_flight_platform << EOF
-- Insert agency first (required for user)
INSERT INTO agency (id, name, email, phone, address, city, country, postal_code, status, created_at, updated_at)
VALUES (
  '00000000-0000-0000-0000-000000000001',
  'System Admin Agency',
  'admin@b2bflight.com',
  '+1234567890',
  '123 Admin St',
  'Admin City',
  'Admin Country',
  '12345',
  'ACTIVE',
  NOW(),
  NOW()
)
ON CONFLICT (id) DO NOTHING;

-- Insert user
INSERT INTO users (id, username, email, password_hash, role, agency_id, is_active, mfa_enabled, created_at, updated_at)
VALUES (
  '$USER_ID',
  'superadmin',
  'superadmin@b2bflight.com',
  'keycloak',
  'SUPER_ADMIN',
  '00000000-0000-0000-0000-000000000001',
  true,
  false,
  NOW(),
  NOW()
)
ON CONFLICT (id) DO UPDATE SET
  username = EXCLUDED.username,
  email = EXCLUDED.email,
  role = EXCLUDED.role,
  is_active = EXCLUDED.is_active,
  updated_at = NOW();
EOF

echo "✅ User created in database"

# Test login
echo ""
echo "9. Testing login..."
echo ""

# Test Keycloak direct login
echo "Testing Keycloak direct login..."
KC_RESPONSE=$(curl -s -X POST "http://localhost:8080/realms/b2b-flight-platform/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=superadmin" \
  -d "password=SuperAdmin123!" \
  -d "grant_type=password" \
  -d "client_id=b2b-flight-backend" \
  -d "client_secret=b2b-flight-backend-secret")

if echo "$KC_RESPONSE" | jq -e '.access_token' > /dev/null 2>&1; then
  echo "✅ Keycloak login successful!"
else
  echo "❌ Keycloak login failed:"
  echo "$KC_RESPONSE" | jq '.'
  exit 1
fi

# Test backend API login
echo ""
echo "Testing backend API login..."
API_RESPONSE=$(curl -s -X POST "http://localhost:8081/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"superadmin","password":"SuperAdmin123!"}')

if echo "$API_RESPONSE" | jq -e '.access_token' > /dev/null 2>&1; then
  echo "✅ Backend API login successful!"
  echo ""
  echo "========================================="
  echo "✅ SETUP COMPLETE!"
  echo "========================================="
  echo ""
  echo "You can now login with:"
  echo "  Username: superadmin"
  echo "  Password: SuperAdmin123!"
  echo ""
  echo "Frontend: http://localhost:4200"
  echo "Backend API: http://localhost:8081"
  echo "Keycloak: http://localhost:8080"
  echo ""
else
  echo "❌ Backend API login failed:"
  echo "$API_RESPONSE" | jq '.'
  exit 1
fi