#!/bin/bash
# Quick Keycloak Setup Script
# This script creates the realm, client, roles, and a test super admin user

set -e

KEYCLOAK_URL="http://localhost:8080"
ADMIN_USER="admin"
ADMIN_PASSWORD="admin"
REALM="b2b-flight-platform"
CLIENT_ID="b2b-flight-backend"
CLIENT_SECRET="b2b-flight-backend-secret"

echo "🔧 Configuring Keycloak..."
echo ""

# Wait for Keycloak to be ready
echo "⏳ Waiting for Keycloak to be ready..."
until curl -sf "${KEYCLOAK_URL}" > /dev/null; do
    echo "   Waiting for Keycloak..."
    sleep 2
done
echo "✅ Keycloak is ready!"
echo ""

# Get admin access token
echo "🔑 Getting admin access token..."
ADMIN_TOKEN=$(curl -s -X POST "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=${ADMIN_USER}" \
  -d "password=${ADMIN_PASSWORD}" \
  -d "grant_type=password" \
  -d "client_id=admin-cli" | jq -r '.access_token')

if [ "$ADMIN_TOKEN" == "null" ] || [ -z "$ADMIN_TOKEN" ]; then
    echo "❌ Failed to get admin token"
    exit 1
fi
echo "✅ Got admin token"
echo ""

# Create realm
echo "🌍 Creating realm: ${REALM}..."
REALM_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${KEYCLOAK_URL}/admin/realms/${REALM}" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}")

if [ "$REALM_EXISTS" == "404" ]; then
    curl -s -X POST "${KEYCLOAK_URL}/admin/realms" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
      -H "Content-Type: application/json" \
      -d '{
        "realm": "'${REALM}'",
        "enabled": true,
        "sslRequired": "none",
        "registrationAllowed": false,
        "loginWithEmailAllowed": true,
        "duplicateEmailsAllowed": false,
        "resetPasswordAllowed": true,
        "editUsernameAllowed": false
      }'
    echo "✅ Realm created"
else
    echo "ℹ️  Realm already exists"
fi
echo ""

# Create roles
echo "👥 Creating roles..."
for role in "SUPER_ADMIN" "AGENCY_ADMIN" "HR_USER" "FINANCE_USER" "AGENT"; do
    ROLE_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
      "${KEYCLOAK_URL}/admin/realms/${REALM}/roles/${role}" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}")
    
    if [ "$ROLE_EXISTS" == "404" ]; then
        curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${REALM}/roles" \
          -H "Authorization: Bearer ${ADMIN_TOKEN}" \
          -H "Content-Type: application/json" \
          -d '{"name": "'${role}'"}'
        echo "   ✅ Created role: ${role}"
    else
        echo "   ℹ️  Role already exists: ${role}"
    fi
done
echo ""

# Create client
echo "🔐 Creating client: ${CLIENT_ID}..."
CLIENT_EXISTS=$(curl -s "${KEYCLOAK_URL}/admin/realms/${REALM}/clients" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" | jq -r '.[] | select(.clientId=="'${CLIENT_ID}'") | .id')

if [ -z "$CLIENT_EXISTS" ]; then
    curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${REALM}/clients" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
      -H "Content-Type: application/json" \
      -d '{
        "clientId": "'${CLIENT_ID}'",
        "enabled": true,
        "clientAuthenticatorType": "client-secret",
        "secret": "'${CLIENT_SECRET}'",
        "publicClient": false,
        "standardFlowEnabled": true,
        "directAccessGrantsEnabled": true,
        "serviceAccountsEnabled": true,
        "redirectUris": ["http://localhost:8081/*", "http://localhost:3000/*"],
        "webOrigins": ["*"],
        "protocol": "openid-connect"
      }'
    echo "✅ Client created"
else
    echo "ℹ️  Client already exists"
fi
echo ""

# Create test super admin user
echo "👤 Creating test super admin user..."
TEST_USER="superadmin"
TEST_PASSWORD="admin123"
TEST_EMAIL="superadmin@example.com"

USER_EXISTS=$(curl -s "${KEYCLOAK_URL}/admin/realms/${REALM}/users?username=${TEST_USER}" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" | jq -r '.[0].id')

if [ "$USER_EXISTS" == "null" ] || [ -z "$USER_EXISTS" ]; then
    # Create user
    curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${REALM}/users" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
      -H "Content-Type: application/json" \
      -d '{
        "username": "'${TEST_USER}'",
        "email": "'${TEST_EMAIL}'",
        "enabled": true,
        "emailVerified": true,
        "credentials": [{
          "type": "password",
          "value": "'${TEST_PASSWORD}'",
          "temporary": false
        }]
      }'
    
    # Get user ID
    USER_ID=$(curl -s "${KEYCLOAK_URL}/admin/realms/${REALM}/users?username=${TEST_USER}" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" | jq -r '.[0].id')
    
    # Assign SUPER_ADMIN role
    ROLE_ID=$(curl -s "${KEYCLOAK_URL}/admin/realms/${REALM}/roles/SUPER_ADMIN" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" | jq -r '.id')
    
    curl -s -X POST "${KEYCLOAK_URL}/admin/realms/${REALM}/users/${USER_ID}/role-mappings/realm" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
      -H "Content-Type: application/json" \
      -d '[{"id": "'${ROLE_ID}'", "name": "SUPER_ADMIN"}]'
    
    echo "✅ User created: ${TEST_USER}"
else
    echo "ℹ️  User already exists: ${TEST_USER}"
fi
echo ""

echo "✅ Keycloak configuration complete!"
echo ""
echo "📋 Configuration Details:"
echo "   Realm: ${REALM}"
echo "   Client ID: ${CLIENT_ID}"
echo "   Client Secret: ${CLIENT_SECRET}"
echo "   Test User: ${TEST_USER}"
echo "   Test Password: ${TEST_PASSWORD}"
echo ""
echo "🔑 To get an access token, run:"
echo ""
echo "curl -X POST '${KEYCLOAK_URL}/realms/${REALM}/protocol/openid-connect/token' \\"
echo "  -H 'Content-Type: application/x-www-form-urlencoded' \\"
echo "  -d 'client_id=${CLIENT_ID}' \\"
echo "  -d 'client_secret=${CLIENT_SECRET}' \\"
echo "  -d 'username=${TEST_USER}' \\"
echo "  -d 'password=${TEST_PASSWORD}' \\"
echo "  -d 'grant_type=password'"
echo ""