#requires -Version 5.1
<#
.SYNOPSIS
    Provisions Zitadel for Musify in development (idempotent).

.DESCRIPTION
    Creates the Musify project, the API OIDC app (public, PKCE, JWT access
    token) and the web player OIDC app (confidential), then wires the resulting
    client ids into deploy/.env, Musify.Api user-secrets and web-player/.env.
    Authenticates with the service-account PAT that Zitadel writes on init
    (zitadel/.output/admin-sa.pat). Re-running reuses the existing project and
    apps and just refreshes the wired values.
#>
[CmdletBinding()]
param(
    [string]$ProjectName = "Musify",
    [string]$ApiAppName  = "Musify API (Scalar)",
    [string]$WebAppName  = "Musify Web",
    # Alternate .env to read/write (e.g. deploy/.env.share). Defaults to deploy/.env.
    [string]$EnvFile,
    # Skip writing Musify.Api user-secrets and web-player/.env: use when the apps
    # only ever run in Docker for this environment and get their config from compose.
    [switch]$SkipHostWiring,
    # Matches the zitadel volume mount for this environment (see compose.share.yml).
    [string]$OutputDir = ".output"
)

$ErrorActionPreference = "Stop"
$deployDir  = Split-Path $PSScriptRoot -Parent
$repoDir    = Split-Path $deployDir -Parent
$apiProject = Join-Path $repoDir "backend\Musify.Api"
$webEnvFile = Join-Path $repoDir "web-player\.env"
$envFile    = if ($EnvFile) { $EnvFile } else { Join-Path $deployDir ".env" }
$patFile    = Join-Path $PSScriptRoot "$OutputDir\admin-sa.pat"

. (Join-Path $deployDir "scripts\common.ps1")

$cfg     = Read-DotEnv $envFile
$issuer  = $cfg['PUBLIC_AUTH_URL']
$apiUrl  = $cfg['PUBLIC_API_URL']
$webUrl  = $cfg['PUBLIC_WEB_URL']
$viteUrl = "http://localhost:5173"   # `npm run dev` in web-player/

Write-Step "Provisioning Zitadel at $issuer"

# Zitadel writes the PAT during init; on a cold start it may take a moment.
$deadline = (Get-Date).AddMinutes(3)
while (-not (Test-Path $patFile) -and (Get-Date) -lt $deadline) { Start-Sleep -Seconds 3 }
if (-not (Test-Path $patFile)) { throw "PAT not found ($patFile). Check 'docker logs musify-zitadel'." }

$headers = @{ Authorization = "Bearer $((Get-Content $patFile -Raw).Trim())" }
$mgmt    = "$issuer/management/v1"

function Invoke-Zitadel($method, $path, $body) {
    $params = @{ Method = $method; Uri = "$mgmt$path"; Headers = $headers; ContentType = "application/json"; TimeoutSec = 20 }
    if ($body) { $params.Body = ($body | ConvertTo-Json -Depth 10) }
    Invoke-RestMethod @params
}

$deadline = (Get-Date).AddMinutes(2)
do {
    try { Invoke-RestMethod "$issuer/.well-known/openid-configuration" -TimeoutSec 5 | Out-Null; $ready = $true }
    catch { $ready = $false; Start-Sleep 3 }
} until ($ready -or (Get-Date) -gt $deadline)
if (-not $ready) { throw "Zitadel did not respond in time." }

# The images tagged `latest` require the standalone Login UI v2 container, which
# this stack does not run, so OIDC would redirect to /ui/v2/login and 404.
# Opting out keeps the built-in v1 login.
try {
    Invoke-RestMethod -Method PUT -Uri "$issuer/v2/features/instance" -Headers $headers `
        -ContentType "application/json" -Body (@{ loginV2 = @{ required = $false } } | ConvertTo-Json) -TimeoutSec 20 | Out-Null
} catch {
    Write-Host "  warning: could not disable the required Login UI v2: $($_.Exception.Message)"
}

# Project --------------------------------------------------------------------
$project = (Invoke-Zitadel POST "/projects/_search" @{
    queries = @(@{ nameQuery = @{ name = $ProjectName; method = "TEXT_QUERY_METHOD_EQUALS" } })
}).result | Where-Object { $_.name -eq $ProjectName } | Select-Object -First 1

if ($project) {
    $projectId = $project.id
    Write-Host "  project '$ProjectName' reused (id $projectId)"
} else {
    $projectId = (Invoke-Zitadel POST "/projects" @{ name = $ProjectName }).id
    Write-Host "  project '$ProjectName' created (id $projectId)"
}

function Get-ZitadelApp($name) {
    (Invoke-Zitadel POST "/projects/$projectId/apps/_search" @{
        queries = @(@{ nameQuery = @{ name = $name; method = "TEXT_QUERY_METHOD_EQUALS" } })
    }).result | Where-Object { $_.name -eq $name } | Select-Object -First 1
}

# API app: public client used by the Scalar UI to obtain a token -------------
$apiApp = Get-ZitadelApp $ApiAppName
if ($apiApp) {
    $apiClientId = (Invoke-Zitadel GET "/projects/$projectId/apps/$($apiApp.id)" $null).app.oidcConfig.clientId
    Write-Host "  app '$ApiAppName' reused (clientId $apiClientId)"
} else {
    $apiClientId = (Invoke-Zitadel POST "/projects/$projectId/apps/oidc" @{
        name                     = $ApiAppName
        redirectUris             = @("$apiUrl/scalar/", "$apiUrl/scalar/oauth2-redirect.html")
        postLogoutRedirectUris   = @("$apiUrl/scalar/")
        responseTypes            = @("OIDC_RESPONSE_TYPE_CODE")
        grantTypes               = @("OIDC_GRANT_TYPE_AUTHORIZATION_CODE")
        appType                  = "OIDC_APP_TYPE_USER_AGENT"
        authMethodType           = "OIDC_AUTH_METHOD_TYPE_NONE"
        version                  = "OIDC_VERSION_1_0"
        devMode                  = $true                  # allow http redirect URIs
        accessTokenType          = "OIDC_TOKEN_TYPE_JWT"  # required so JwtBearer can validate it
        accessTokenRoleAssertion = $true
        idTokenRoleAssertion     = $true
        idTokenUserinfoAssertion = $true
    }).clientId
    Write-Host "  app '$ApiAppName' created (clientId $apiClientId)"
}

# Web app: confidential client used by the SvelteKit server ------------------
$webApp = Get-ZitadelApp $WebAppName
$webSecret = $cfg['WEB_CLIENT_SECRET']
if ($webApp) {
    $webClientId = (Invoke-Zitadel GET "/projects/$projectId/apps/$($webApp.id)" $null).app.oidcConfig.clientId
    # The secret is only returned once, so regenerate it if we no longer have it.
    if (-not $webSecret) {
        $webSecret = (Invoke-Zitadel POST "/projects/$projectId/apps/$($webApp.id)/oidc_config/_generate_client_secret" @{}).clientSecret
        Write-Host "  app '$WebAppName' reused (clientId $webClientId, secret regenerated)"
    } else {
        Write-Host "  app '$WebAppName' reused (clientId $webClientId)"
    }
} else {
    $created = Invoke-Zitadel POST "/projects/$projectId/apps/oidc" @{
        name                     = $WebAppName
        redirectUris             = @("$webUrl/auth/callback", "$viteUrl/auth/callback")
        postLogoutRedirectUris   = @("$webUrl/", "$viteUrl/")
        responseTypes            = @("OIDC_RESPONSE_TYPE_CODE")
        grantTypes               = @("OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN")
        appType                  = "OIDC_APP_TYPE_WEB"
        authMethodType           = "OIDC_AUTH_METHOD_TYPE_BASIC"
        version                  = "OIDC_VERSION_1_0"
        devMode                  = $true
        accessTokenType          = "OIDC_TOKEN_TYPE_JWT"
        accessTokenRoleAssertion = $true
        idTokenRoleAssertion     = $true
        idTokenUserinfoAssertion = $true
    }
    $webClientId = $created.clientId
    $webSecret   = $created.clientSecret
    Write-Host "  app '$WebAppName' created (clientId $webClientId)"
}

# Wire the values ------------------------------------------------------------
Set-DotEnvValue $envFile "AUTH_CLIENT_ID"     $apiClientId
Set-DotEnvValue $envFile "WEB_CLIENT_ID"      $webClientId
Set-DotEnvValue $envFile "WEB_CLIENT_SECRET"  $webSecret

if ($SkipHostWiring) {
    Write-Host "  wired into $envFile only (-SkipHostWiring: apps run in Docker)"
} else {
    # Musify.Api reads these from user-secrets when it runs outside Docker.
    @{
        "Authentication:ClientId"              = $apiClientId
        "Authentication:AudienceAddress"       = $apiClientId
        "Authentication:IssuerAddress"         = $issuer
        "Authentication:MetadataAddress"       = "$issuer/.well-known/openid-configuration"
        "Authentication:AuthorizationEndpoint" = "$issuer/oauth/v2/authorize?prompt=login"
        "Authentication:TokenEndpoint"         = "$issuer/oauth/v2/token"
        "Authentication:ScalarRedirectUri"     = "$apiUrl/scalar/"
        "Authentication:RequireHttpsMetadata"  = "false"
    }.GetEnumerator() | ForEach-Object {
        dotnet user-secrets set $_.Key $_.Value --project $apiProject | Out-Null
    }

    # web-player/.env is what `npm run dev` reads (the container gets its config
    # from compose instead).
    if (-not (Test-Path $webEnvFile)) {
        Copy-Item (Join-Path $repoDir "web-player\.env.example") $webEnvFile
    }
    @{
        ZITADEL_ISSUER        = $issuer
        ZITADEL_CLIENT_ID     = $webClientId
        ZITADEL_CLIENT_SECRET = $webSecret
        AUTH_REDIRECT_URI     = "$viteUrl/auth/callback"
        AUTH_POST_LOGOUT_URI  = "$viteUrl/"
        SESSION_SECRET        = $cfg['SESSION_SECRET']
        API_BASE_URL          = $apiUrl
    }.GetEnumerator() | ForEach-Object {
        Set-DotEnvValue $webEnvFile $_.Key $_.Value
    }

    Write-Host "  wired into deploy/.env, Musify.Api user-secrets and web-player/.env"
}