#!/usr/bin/env bash
#
# generate-env.sh — Génère un fichier .env propre pour déployer Inbox Zero sur Dokploy.
# Secrets auto-générés (openssl), valeurs métier demandées en interactif.
#
# Usage : bash generate-env.sh [fichier_de_sortie]
#         (défaut : inbox-zero.env)
#
set -euo pipefail

OUT="${1:-inbox-zero.env}"

# --- Couleurs ----------------------------------------------------------------
B=$'\033[1m'; G=$'\033[32m'; Y=$'\033[33m'; R=$'\033[31m'; N=$'\033[0m'

command -v openssl >/dev/null 2>&1 || { echo "${R}openssl introuvable. Installe-le d'abord.${N}"; exit 1; }

# --- Helpers -----------------------------------------------------------------
ask() {  # ask "Question" "défaut" -> stdout
  local prompt="$1" def="${2:-}" ans
  if [ -n "$def" ]; then read -r -p "$prompt [$def] : " ans; else read -r -p "$prompt : " ans; fi
  printf '%s' "${ans:-$def}"
}
ask_secret() {  # ask_secret "Question (peut rester vide)" -> stdout (saisie masquée)
  local prompt="$1" ans
  read -r -s -p "$prompt : " ans; echo >&2
  printf '%s' "$ans"
}
gen() { openssl rand -hex "$1"; }

echo
echo "${B}=== Génération du .env Inbox Zero (Dokploy) ===${N}"
echo "Appuie sur Entrée pour accepter la valeur par défaut entre crochets."
echo

# --- Si le fichier existe déjà -----------------------------------------------
if [ -e "$OUT" ]; then
  echo "${Y}⚠ $OUT existe déjà.${N}"
  overwrite="$(ask "L'écraser ? (oui/non)" "non")"
  case "$overwrite" in
    oui|o|y|yes) ;;
    *) echo "Annulé."; exit 0 ;;
  esac
fi

# --- Saisies métier ----------------------------------------------------------
DOMAIN="$(ask "Domaine public (sans https://)" "inbox.elevaseo.app")"
PROJECT_ID="$(ask "ID projet Google Cloud" "inbox-zero-499901")"
ADMIN_EMAIL="$(ask "Email admin de l'instance" "bastien@elevaseo.com")"
LOGIN_EMAIL="$(ask "Email Google qui se connectera (login Gmail)" "elevaseo99@gmail.com")"

echo
echo "${B}--- Google OAuth (Console GCP → Credentials → OAuth client Web) ---${N}"
echo "Tu peux laisser vide et compléter plus tard dans Dokploy."
GOOGLE_CLIENT_ID="$(ask "GOOGLE_CLIENT_ID" "")"
GOOGLE_CLIENT_SECRET="$(ask_secret "GOOGLE_CLIENT_SECRET (masqué, vide OK)")"

echo
echo "${B}--- Anthropic (Claude) ---${N}"
ANTHROPIC_API_KEY="$(ask_secret "ANTHROPIC_API_KEY sk-ant-... (masqué, vide OK)")"

echo
echo "${B}--- Resend (emails transactionnels, optionnel) ---${N}"
use_resend="$(ask "Configurer Resend ? (oui/non)" "non")"
RESEND_API_KEY=""; RESEND_FROM_EMAIL=""; RESEND_CONFIGURED="false"
case "$use_resend" in
  oui|o|y|yes)
    RESEND_API_KEY="$(ask_secret "RESEND_API_KEY (masqué)")"
    RESEND_FROM_EMAIL="$(ask "RESEND_FROM_EMAIL" "noreply@elevaseo.app")"
    RESEND_CONFIGURED="true"
  ;;
esac

# --- Secrets auto-générés (tailles renforcées) -------------------------------
echo
echo "${G}Génération des secrets…${N}"
AUTH_SECRET="$(gen 48)"
EMAIL_ENCRYPT_SECRET="$(gen 48)"
EMAIL_ENCRYPT_SALT="$(gen 24)"
INTERNAL_API_KEY="$(gen 48)"
CRON_SECRET="$(gen 48)"
UPSTASH_REDIS_TOKEN="$(gen 48)"
GOOGLE_PUBSUB_VERIFICATION_TOKEN="$(gen 48)"
POSTGRES_PASSWORD="$(gen 32)"

# --- Écriture ----------------------------------------------------------------
umask 077
cat > "$OUT" <<EOF
# =============================================================================
# Inbox Zero — .env Dokploy (généré par generate-env.sh)
# Tout sur Dokploy (DB + Redis) · LLM : Anthropic Claude
# ⚠ Contient des secrets réels — NE JAMAIS COMMIT.
# =============================================================================

# --- Services du compose -----------------------------------------------------
COMPOSE_PROFILES=all,queue-worker

# --- URL publique ------------------------------------------------------------
NEXT_PUBLIC_BASE_URL=https://${DOMAIN}

# --- Postgres (local dans le compose) ----------------------------------------
POSTGRES_USER=postgres
POSTGRES_DB=inboxzero
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}

# --- Redis (couche HTTP compat Upstash, locale) ------------------------------
UPSTASH_REDIS_URL=http://serverless-redis-http:80
UPSTASH_REDIS_TOKEN=${UPSTASH_REDIS_TOKEN}

# --- Secrets applicatifs -----------------------------------------------------
AUTH_SECRET=${AUTH_SECRET}
EMAIL_ENCRYPT_SECRET=${EMAIL_ENCRYPT_SECRET}
EMAIL_ENCRYPT_SALT=${EMAIL_ENCRYPT_SALT}
INTERNAL_API_KEY=${INTERNAL_API_KEY}
CRON_SECRET=${CRON_SECRET}

# --- Google OAuth ------------------------------------------------------------
GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}

# --- Google Pub/Sub ----------------------------------------------------------
GOOGLE_PUBSUB_TOPIC_NAME=projects/${PROJECT_ID}/topics/inbox-zero
GOOGLE_PUBSUB_VERIFICATION_TOKEN=${GOOGLE_PUBSUB_VERIFICATION_TOKEN}

# --- LLM : Anthropic Claude --------------------------------------------------
DEFAULT_LLMS=anthropic:claude-sonnet-4-6
ECONOMY_LLMS=anthropic:claude-haiku-4-5
ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}

# --- Restriction des inscriptions (login = compte Gmail → liste d'emails) ----
AUTH_ALLOWED_EMAILS=${LOGIN_EMAIL},${ADMIN_EMAIL}
ADMINS=${ADMIN_EMAIL}

# --- Emails transactionnels (Resend) -----------------------------------------
RESEND_API_KEY=${RESEND_API_KEY}
RESEND_FROM_EMAIL=${RESEND_FROM_EMAIL}
NEXT_PUBLIC_IS_RESEND_CONFIGURED=${RESEND_CONFIGURED}

# --- Feature flags -----------------------------------------------------------
NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true
NEXT_PUBLIC_EMAIL_SEND_ENABLED=true
NEXT_PUBLIC_DIGEST_ENABLED=true
NEXT_PUBLIC_FOLLOW_UP_REMINDERS_ENABLED=true
EOF

chmod 600 "$OUT"

echo
echo "${G}✓ Écrit : ${B}${OUT}${N}${G} (permissions 600)${N}"
echo
echo "${B}Récap :${N}"
echo "  Domaine ............. https://${DOMAIN}"
echo "  Projet GCP .......... ${PROJECT_ID}"
echo "  Topic Pub/Sub ....... projects/${PROJECT_ID}/topics/inbox-zero"
echo "  Login autorisé ...... ${LOGIN_EMAIL}, ${ADMIN_EMAIL}"
echo "  OAuth client ID ..... $([ -n "$GOOGLE_CLIENT_ID" ] && echo défini || echo "${Y}à compléter${N}")"
echo "  Anthropic key ....... $([ -n "$ANTHROPIC_API_KEY" ] && echo défini || echo "${Y}à compléter${N}")"
echo "  Resend .............. ${RESEND_CONFIGURED}"
echo
echo "${Y}⚠ Ne commit pas ce fichier. Colle son contenu dans l'onglet Environment de Dokploy.${N}"
echo "Prochaine étape : ${B}bash setup-gcloud-pubsub.sh ${OUT}${N}"