#!/usr/bin/env bash
set -euo pipefail

log(){ echo "[nats-registration][entrypoint] $*"; }
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }

# ---- Tool sanity (only what we use)
for bin in curl python; do
  if ! command -v "$bin" >/dev/null 2>&1; then
    err "Missing $bin"
    exit 2
  fi
done

# ---- Paths
APP_DIR="${APP_DIR:-/opt/containers/nats-registration-listener}"
DATA_DIR="${DATA_DIR:-$APP_DIR/data}"
mkdir -p "$DATA_DIR"

# ---- Required env
: "${NATS_SERVERS:?NATS_SERVERS required (e.g. 'nats://host:4222' or 'tls://host:4222')}"
: "${NATS_SUBJECT:=v1.registration}"   # default to common registration subject

# ---- Optional env
NATS_NAME="${NATS_NAME:-registration-listener}"
PRINT_RAW="${PRINT_RAW:-}"
NATS_QUEUE="${NATS_QUEUE:-}"

# TLS inputs (all optional)
TLS_CA="${TLS_CA:-}"
TLS_CA_PEM="${TLS_CA_PEM:-}"
TLS_CA_PEM_B64="${TLS_CA_PEM_B64:-}"
TLS_CA_URL="${TLS_CA_URL:-}"
TLS_INSECURE="${TLS_INSECURE:-}"

# Auth (all optional)
NATS_USER="${NATS_USER:-}"
NATS_PASS="${NATS_PASS:-}"
NATS_TOKEN="${NATS_TOKEN:-}"
NATS_CREDS="${NATS_CREDS:-}"
NATS_CREDS_B64="${NATS_CREDS_B64:-}"

CA_TARGET="${DATA_DIR}/tls-ca.pem"
CREDS_TARGET="${DATA_DIR}/user.creds"

# ---- Materialize TLS CA (if a path not already provided)
materialized_ca=0
if [ -z "$TLS_CA" ]; then
  if [ -n "$TLS_CA_PEM" ]; then
    log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
    printf '%s\n' "$TLS_CA_PEM" > "$CA_TARGET"
    chmod 0644 "$CA_TARGET"
    TLS_CA="$CA_TARGET"
    materialized_ca=1
  elif [ -n "$TLS_CA_PEM_B64" ]; then
    log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
    echo "$TLS_CA_PEM_B64" | base64 -d > "$CA_TARGET"
    chmod 0644 "$CA_TARGET"
    TLS_CA="$CA_TARGET"
    materialized_ca=1
  elif [ -n "$TLS_CA_URL" ]; then
    log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
    curl -fsSL "$TLS_CA_URL" -o "$CA_TARGET"
    chmod 0644 "$CA_TARGET"
    TLS_CA="$CA_TARGET"
    materialized_ca=1
  fi
fi

# ---- Validate CA if present
if [ -n "$TLS_CA" ]; then
  if [ ! -s "$TLS_CA" ]; then
    err "TLS_CA='$TLS_CA' not found or empty"
    exit 3
  fi
  if ! grep -q "BEGIN CERTIFICATE" "$TLS_CA"; then
    err "TLS_CA does not look like a PEM certificate: $TLS_CA"
    exit 3
  fi
  log "Using TLS CA at $TLS_CA (materialized=${materialized_ca})"
fi

# ---- Materialize .creds if provided as base64
if [ -z "$NATS_CREDS" ] && [ -n "$NATS_CREDS_B64" ]; then
  log "Materializing NATS .creds from NATS_CREDS_B64 -> ${CREDS_TARGET}"
  echo "$NATS_CREDS_B64" | base64 -d > "$CREDS_TARGET"
  chmod 0600 "$CREDS_TARGET"
  NATS_CREDS="$CREDS_TARGET"
fi

log "servers='${NATS_SERVERS}' subject='${NATS_SUBJECT}' queue='${NATS_QUEUE:- -}' name='${NATS_NAME}' tls_ca='${TLS_CA:-}'"

# Export variables for the runner script
export TLS_CA NATS_CREDS NATS_SERVERS NATS_SUBJECT NATS_NAME PRINT_RAW NATS_QUEUE \
       NATS_USER NATS_PASS NATS_TOKEN TLS_INSECURE

# Hand off to main script
exec /opt/containers/nats-registration-listener/app/bin/nats-registration-listener.sh