#!/usr/bin/env bash
set -euo pipefail

log(){ echo "[nats-registration][entrypoint] $*"; }
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }

# Sanity: tools
for bin in curl jq python; do
  command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
done

# Paths (match Dockerfile ENV)
: "${APP_DIR:=/opt/containers/nats-registration-listener}"
: "${DATA_DIR:=${APP_DIR}/data}"
mkdir -p "${DATA_DIR}"

# Required (fed from .env via compose)
: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}"
: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}"

# Optional with defaults
: "${NATS_NAME:=registration-listener}"
: "${PRINT_RAW:=}"
: "${NATS_QUEUE:=}"

# TLS input options (dynamic)
# Priority:
#  1) TLS_CA      -> use as a path (pre-mounted file)
#  2) TLS_CA_PEM  -> write PEM content to ${DATA_DIR}/tls-ca.pem
#  3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem
#  4) TLS_CA_URL  -> curl to ${DATA_DIR}/tls-ca.pem
: "${TLS_CA:=}"
: "${TLS_CA_PEM:=}"
: "${TLS_CA_PEM_B64:=}"
: "${TLS_CA_URL:=}"
: "${TLS_INSECURE:=}"

# Auth (optional)
: "${NATS_USER:=}"
: "${NATS_PASS:=}"
: "${NATS_TOKEN:=}"
: "${NATS_CREDS:=}"           # path to a .creds file if you have one
: "${NATS_CREDS_B64:=}"       # optional: base64-encoded creds; will be written to DATA_DIR

# ---- Dynamic materialization of CA (and optional .creds) ----
CA_TARGET="${DATA_DIR}/tls-ca.pem"
CREDS_TARGET="${DATA_DIR}/user.creds"

materialized_ca=""

if [[ -z "${TLS_CA}" ]]; then
  if [[ -n "${TLS_CA_PEM}" ]]; then
    log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
    printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}"
    chmod 0644 "${CA_TARGET}"
    TLS_CA="${CA_TARGET}"
    materialized_ca="1"
  elif [[ -n "${TLS_CA_PEM_B64}" ]]; then
    log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
    echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}"
    chmod 0644 "${CA_TARGET}"
    TLS_CA="${CA_TARGET}"
    materialized_ca="1"
  elif [[ -n "${TLS_CA_URL}" ]]; then
    log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
    curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}"
    chmod 0644 "${CA_TARGET}"
    TLS_CA="${CA_TARGET}"
    materialized_ca="1"
  fi
fi

# Validate CA if present
if [[ -n "${TLS_CA}" ]]; then
  if [[ ! -s "${TLS_CA}" ]_]()]()