#!/bin/bash
# One-shot: offline enable wire account + fees, upload to local exchange, verify /keys.
# Run as root inside container taler-hacktivism-exchange-ansible.
set -euo pipefail

CONF=/etc/taler-exchange/taler-exchange.conf
OV=/etc/taler-exchange/exchange-overrides.conf
PAYTO='payto://x-taler-bank/bank.hacktivism.ch/exchange?receiver-name=GOA%20Exchange'
LOCAL_BASE='http://127.0.0.1:9011/'
OPS=/tmp/offline-wire-ops-$$.json
OFFLINE_USER=taler-exchange-offline

if [ "$(id -u)" -ne 0 ]; then
  echo "Run as root in exchange container" >&2
  exit 1
fi

echo "=== 1. Ensure wire account stanza in exchange-overrides ==="
if ! grep -q '\[exchange-account-1\]' "$OV" 2>/dev/null; then
  cat >>"$OV" <<'EOF'

### Regional bank (libeufin, x-taler-bank) — no IBAN
[exchange-account-1]
PAYTO_URI = payto://x-taler-bank/bank.hacktivism.ch/exchange?receiver-name=GOA%20Exchange
ENABLE_CREDIT = YES
ENABLE_DEBIT = YES
@inline-secret@ exchange-accountcredentials-1 ../secrets/exchange-accountcredentials-1.secret.conf
EOF
  echo "appended exchange-account-1"
else
  echo "exchange-account-1 already present"
fi

# credentials must be readable by wire helpers + httpd
if [ -f /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf ]; then
  chown root:taler-exchange-wire /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf 2>/dev/null \
    || chown root:root /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf
  chmod 640 /etc/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf
fi

echo "=== 2. Point BASE_URL at local httpd for offline upload ==="
# save public URL
PUBLIC_BASE=$(taler-config -c "$CONF" -s exchange -o BASE_URL 2>/dev/null || echo 'https://exchange.hacktivism.ch/')
# temporary override file (highest priority if inlined last — patch OV)
if grep -q '^BASE_URL' "$OV"; then
  sed -i "s|^BASE_URL = .*|BASE_URL = ${LOCAL_BASE}|" "$OV"
else
  echo "BASE_URL = ${LOCAL_BASE}" >>"$OV"
fi
echo "BASE_URL now: $(taler-config -c "$CONF" -s exchange -o BASE_URL)"

echo "=== 3. Sign enable-account + wire-fee + global-fee (as offline user) ==="
# global-fee: year, history, account, purse, purse_timeout, history_expiration, max_free_purses
runuser -u "$OFFLINE_USER" -- taler-exchange-offline -c "$CONF" \
  enable-account "$PAYTO" \
  wire-fee now x-taler-bank GOA:0 GOA:0 \
  global-fee now GOA:0 GOA:0 GOA:0 '1 day' '1 year' 5 \
  >"$OPS"
echo "ops bytes: $(wc -c <"$OPS")"
head -c 200 "$OPS"; echo

echo "=== 4. Upload ops to exchange ==="
runuser -u "$OFFLINE_USER" -- taler-exchange-offline -c "$CONF" upload <"$OPS"
echo "upload exit: $?"

echo "=== 5. Restore public BASE_URL ==="
sed -i "s|^BASE_URL = .*|BASE_URL = ${PUBLIC_BASE}|" "$OV"
# ensure trailing slash style
if ! grep -q "BASE_URL = https://exchange.hacktivism.ch" "$OV"; then
  sed -i "s|^BASE_URL = .*|BASE_URL = https://exchange.hacktivism.ch/|" "$OV"
fi
echo "BASE_URL restored: $(taler-config -c "$CONF" -s exchange -o BASE_URL)"

echo "=== 6. Probe /keys (may need httpd already running) ==="
for i in 1 2 3 4 5; do
  code=$(curl -sS -m 8 -o /tmp/keys-out.json -w '%{http_code}' http://127.0.0.1:9011/keys || echo fail)
  sz=$(wc -c </tmp/keys-out.json 2>/dev/null || echo 0)
  echo "try $i: http=$code size=$sz"
  if [ "$code" = "200" ] && [ "${sz:-0}" -gt 100 ]; then
    echo "KEYS_OK"
    head -c 250 /tmp/keys-out.json; echo
    # show accounts if present
    grep -oE '"payto_uri"[^,}]+|"master_public_key"[^,}]+' /tmp/keys-out.json | head -10 || true
    exit 0
  fi
  sleep 2
done

echo "KEYS_NOT_YET — check logs"
tail -30 /var/log/taler-exchange/taler-exchange-httpd-*.log 2>/dev/null | tail -30
exit 1