#!/usr/bin/env bash
# TW-301 — Mint a dedicated AdCenter level-1 Lucos API key.
#
# Requires an admin (level-10) key capable of PUT /api/key.
# Never commit keys. Do not paste keys into Jira/Confluence/chat.
#
# Usage:
#   export ADCENTER_ADMIN_API_KEY='<admin-level-10-key>'
#   export ADCENTER_ADV_ID=19880
#   # optional:
#   export ADCENTER_KEY_MINT_BASE_URL=https://apiad.admedia.com
#   export ADCENTER_MINT_PRINT_KEY=1   # print raw key once (secure workstation only)
#   ./scripts/mint-adcenter-level1-key.sh
#
# After minting, inject into Lucos staging host env only:
#   ADCENTER_LEVEL1_KEYS_STAGING={"19880":"<level-1-key>"}
set -euo pipefail

MINT_BASE="${ADCENTER_KEY_MINT_BASE_URL:-https://apiad.admedia.com}"
MINT_BASE="${MINT_BASE%/}"
ADV_ID="${ADCENTER_ADV_ID:-19880}"
LEVEL="${ADCENTER_KEY_LEVEL:-1}"

if [[ -z "${ADCENTER_ADMIN_API_KEY:-}" ]]; then
  echo "FAIL: set ADCENTER_ADMIN_API_KEY (admin level-10 mint capability)."
  echo "      Or hand the AdOps request package in docs/ADCENTER-LEVEL1-OPS.md."
  exit 1
fi

if [[ "${LEVEL}" != "1" ]]; then
  echo "FAIL: Lucos keys must be level 1 (got LEVEL=${LEVEL})."
  exit 1
fi

URL="${MINT_BASE}/api/key"
BODY="$(printf '{"adv_id":%s,"level":%s}' "${ADV_ID}" "${LEVEL}")"

echo "==> PUT ${URL} adv_id=${ADV_ID} level=${LEVEL}"
RESP="$(curl -sS -w '\n%{http_code}' -X PUT "${URL}" \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: ${ADCENTER_ADMIN_API_KEY}" \
  -d "${BODY}")"
BODY_OUT="$(echo "${RESP}" | sed '$d')"
CODE="$(echo "${RESP}" | tail -n1)"

if [[ "${CODE}" != "201" && "${CODE}" != "200" ]]; then
  echo "FAIL: HTTP ${CODE}"
  # Avoid dumping bodies that might echo secrets; show status-shaped fields only.
  echo "${BODY_OUT}" | node -e "
let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
  try {
    const j=JSON.parse(d);
    console.log(JSON.stringify({status:j.status,message:j.message||j.error||null},null,2));
  } catch { console.log('(non-JSON error body omitted)'); }
});"
  exit 1
fi

KEY="$(echo "${BODY_OUT}" | node -e "
let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
  try { const j=JSON.parse(d); process.stdout.write(j.key||''); }
  catch { process.stdout.write(''); }
});")"

if [[ -z "${KEY}" ]]; then
  echo "FAIL: response missing key field"
  exit 1
fi

FP="$(printf '%s' "${KEY}" | node -e "
let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
  const c=require('crypto').createHash('sha256').update(d).digest('hex').slice(0,12);
  console.log(c);
});")"

echo "OK: minted level-1 key for adv_id=${ADV_ID}"
echo "    fingerprint(sha256-12)=${FP}"
echo "    Inject into staging host (not git):"
echo "    ADCENTER_LEVEL1_KEYS_STAGING={\"${ADV_ID}\":\"<key>\"}"

if [[ "${ADCENTER_MINT_PRINT_KEY:-0}" == "1" ]]; then
  echo "    RAW_KEY=${KEY}"
  echo "    (ADCENTER_MINT_PRINT_KEY=1 — clear your shell history if needed)"
fi

echo "PASS: mint complete"