#!/bin/bash
# Wave 112 Agent 28: Fix API Gateway MFA Compilation Errors
# 17 type conversion errors blocking coverage measurement

set -e

echo "=== Wave 112 Agent 28: Fixing API Gateway MFA Compilation Errors ==="

# Fix 1: totp.rs - SecretString boxing (2 fixes)
echo "Fix 1: totp.rs - SecretString boxing..."
sed -i 's/SecretString::new(String::new())/SecretString::new(String::new().into())/' \
    services/api_gateway/src/auth/mfa/totp.rs

sed -i 's/Ok(SecretString::new(secret_base32))/Ok(SecretString::new(secret_base32.into()))/' \
    services/api_gateway/src/auth/mfa/totp.rs

# Fix 2: mod.rs - String conversion
echo "Fix 2: mod.rs - String conversion..."
sed -i 's/manual_entry_key: secret\.expose_secret()\.clone()/manual_entry_key: secret.expose_secret().to_string()/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Fix 3: mod.rs - NaiveDateTime to DateTime conversions
echo "Fix 3: mod.rs - DateTime conversions..."

# Line 199: expires_at binding
sed -i '199s/expires_at$/expires_at.naive_utc()/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Line 245: expires_at comparison
sed -i '245s/if session\.expires_at < Utc::now()/if session.expires_at.and_utc() < Utc::now()/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Line 291: now binding
sed -i '291s/now$/now.naive_utc()/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Line 429: expires_at binding in INSERT
sed -i '429s/expires_at$/expires_at.naive_utc()/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Fix 4: mod.rs - IpAddr to String conversion
echo "Fix 4: mod.rs - IpAddr to String..."
sed -i '397s/\.bind(ip)/.bind(ip.map(|addr| addr.to_string()))/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Fix 5: mod.rs - earliest_expiry type conversion (line 505)
echo "Fix 5: mod.rs - earliest_expiry conversion..."
sed -i '505s/earliest_expiry: result\.earliest_expiry,/earliest_expiry: result.earliest_expiry.map(|dt| dt.and_utc()),/' \
    services/api_gateway/src/auth/mfa/mod.rs

# Fix 6: mod.rs - SQLx query result conversion (line 133)
echo "Fix 6: mod.rs - SQLx query conversion..."
# This requires manual editing - add .map() after query
cat > /tmp/mfa_mod_fix.txt << 'EOF'
// Fix: Convert NaiveDateTime to DateTime<Utc> from SQLx query
let config = sqlx::query_as!(
    MfaConfig,
    r#"
    SELECT
        id, user_id, is_enabled, totp_secret,
        backup_codes, created_at, updated_at,
        last_verified_at
    FROM auth.mfa_config
    WHERE user_id = $1
    "#,
    user_id
)
.fetch_optional(pool)
.await?
.map(|c| MfaConfig {
    last_verified_at: c.last_verified_at.map(|dt| dt.and_utc()),
    created_at: c.created_at.and_utc(),
    updated_at: c.updated_at.and_utc(),
    ..c
});
EOF

# Fix 7: backup_codes.rs - SQLx query conversion (line 188)
echo "Fix 7: backup_codes.rs - SQLx query conversion..."
cat > /tmp/backup_codes_fix.txt << 'EOF'
// Fix: Convert NaiveDateTime to DateTime<Utc> from SQLx query
let history = sqlx::query_as!(
    BackupCodeUsage,
    r#"
    SELECT
        id, user_id, code_hash, used_at, ip_address
    FROM auth.mfa_backup_code_usage
    WHERE user_id = $1
    ORDER BY used_at DESC
    "#,
    user_id
)
.fetch_all(pool)
.await?
.into_iter()
.map(|r| BackupCodeUsage {
    used_at: r.used_at.map(|dt| dt.and_utc()),
    ..r
})
.collect();
EOF

echo ""
echo "=== Simple sed fixes applied (10/17) ==="
echo "Remaining 7 fixes require manual editing:"
echo ""
echo "1. services/api_gateway/src/auth/mfa/mod.rs (line 133)"
echo "   - Apply fix from /tmp/mfa_mod_fix.txt"
echo ""
echo "2. services/api_gateway/src/auth/mfa/backup_codes.rs (line 188)"
echo "   - Apply fix from /tmp/backup_codes_fix.txt"
echo ""
echo "=== Verification ==="
echo "Run: cargo build --workspace --lib -p api_gateway"
echo "Expected: Clean compilation (0 errors)"