#!/bin/bash

# Keycloak Setup Script for B2B Flight Platform
# This script configures the Keycloak realm with roles, clients, and MFA settings

set -e

KEYCLOAK_URL="http://localhost:8080"
ADMIN_USER="admin"
ADMIN_PASSWORD="admin"
REALM_NAME="b2b-flight-platform"

echo "Waiting for Keycloak to be ready..."
until curl -sf "${KEYCLOAK_URL}/health/ready" > /dev/null 2>&1; do
    echo "Keycloak is not ready yet. Waiting..."
    sleep 5
done

echo "Keycloak is ready!"

# Get admin access token
echo "Getting admin access token..."
ADMIN_TOKEN=$(curl -s -X POST "${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=${ADMIN_USER}" \
  -d "password=${ADMIN_PASSWORD}" \
  -d "grant_type=password" \
  -d "client_id=admin-cli" | jq -r '.access_token')

if [ -z "$ADMIN_TOKEN" ] || [ "$ADMIN_TOKEN" == "null" ]; then
    echo "Failed to get admin token"
    exit 1
fi

echo "Admin token obtained successfully"

# Check if realm already exists
REALM_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${KEYCLOAK_URL}/admin/realms/${REALM_NAME}" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}")

if [ "$REALM_EXISTS" == "200" ]; then
    echo "Realm ${REALM_NAME} already exists. Skipping creation."
else
    echo "Creating realm ${REALM_NAME}..."
    curl -s -X POST "${KEYCLOAK_URL}/admin/realms" \
      -H "Authorization: Bearer ${ADMIN_TOKEN}" \
      -H "Content-Type: application/json" \
      -d @realm-config.json
    
    if [ $? -eq 0 ]; then
        echo "Realm ${REALM_NAME} created successfully"
    else
        echo "Failed to create realm"
        exit 1
    fi
fi

echo ""
echo "=========================================="
echo "Keycloak Setup Complete!"
echo "=========================================="
echo "Keycloak URL: ${KEYCLOAK_URL}"
echo "Realm: ${REALM_NAME}"
echo "Admin Console: ${KEYCLOAK_URL}/admin"
echo ""
echo "Configured Roles:"
echo "  - SUPER_ADMIN"
echo "  - AGENCY_ADMIN"
echo "  - HR_USER"
echo "  - FINANCE_USER"
echo "  - AGENT"
echo ""
echo "Configured Clients:"
echo "  - b2b-flight-backend (confidential)"
echo "  - b2b-flight-frontend (public)"
echo ""
echo "Default Super Admin User:"
echo "  Username: superadmin"
echo "  Password: SuperAdmin123!"
echo "  Email: superadmin@b2bflight.com"
echo ""
echo "MFA Configuration:"
echo "  - TOTP (Time-based One-Time Password) enabled"
echo "  - Supported apps: Google Authenticator, Microsoft Authenticator"
echo "=========================================="