#!/bin/bash

# Foxhunt Vault Development Environment Setup Script
# This script configures Vault for local development with test data

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Script configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VAULT_ADDR="${VAULT_ADDR:-https://foxhunt-vault:8200}"
DEVELOPMENT_MODE="${DEVELOPMENT_MODE:-false}"

# Development root token (should be changed in production)
DEV_ROOT_TOKEN="${VAULT_DEV_ROOT_TOKEN_ID:-foxhunt-dev-token}"

# Logging functions
log() {
    echo -e "${BLUE}[$(date +'%Y-%m-%d %H:%M:%S')]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[$(date +'%Y-%m-%d %H:%M:%S')] ✓${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[$(date +'%Y-%m-%d %H:%M:%S')] ⚠${NC} $1"
}

log_error() {
    echo -e "${RED}[$(date +'%Y-%m-%d %H:%M:%S')] ✗${NC} $1"
}

# Check if running in development mode
check_development_mode() {
    if [ "$DEVELOPMENT_MODE" != "true" ]; then
        log_error "This script should only be run in development mode"
        log_error "Set DEVELOPMENT_MODE=true to continue"
        exit 1
    fi
    
    log_warning "Running in DEVELOPMENT mode - not suitable for production!"
}

# Wait for Vault and authenticate
setup_vault_connection() {
    log "Setting up Vault connection..."
    
    export VAULT_ADDR
    export VAULT_TOKEN="$DEV_ROOT_TOKEN"
    export VAULT_SKIP_VERIFY="${VAULT_SKIP_VERIFY:-true}"
    
    # Wait for Vault
    local count=0
    while ! vault status > /dev/null 2>&1; do
        if [ $count -eq 30 ]; then
            log_error "Vault not available after waiting"
            return 1
        fi
        log "Waiting for Vault... (attempt $((count + 1))/30)"
        sleep 2
        count=$((count + 1))
    done
    
    # Verify authentication
    if ! vault token lookup > /dev/null 2>&1; then
        log_error "Failed to authenticate with Vault"
        return 1
    fi
    
    log_success "Connected to Vault successfully"
}

# Run the main initialization if needed
run_initialization() {
    log "Running Vault initialization..."
    
    # Check if we need to run the main init script
    if ! vault secrets list | grep -q "foxhunt/"; then
        log "Running main initialization script..."
        /vault/scripts/init-vault.sh
    else
        log_success "Vault already initialized"
    fi
}

# Populate development secrets
populate_dev_secrets() {
    log "Populating development secrets..."
    
    # Database credentials (development values)
    log "Setting up database secrets..."
    
    vault kv put foxhunt/databases/postgresql \
        host="localhost" \
        port="5432" \
        database="foxhunt_dev" \
        username="foxhunt_dev" \
        password="dev_password_change_me" \
        ssl_mode="prefer" \
        connection_pool_size="10" \
        max_connections="100"
    
    vault kv put foxhunt/databases/clickhouse \
        host="localhost" \
        port="8123" \
        database="foxhunt_dev" \
        username="default" \
        password="dev_clickhouse_password" \
        secure="false" \
        compression="true"
    
    vault kv put foxhunt/databases/influxdb \
        url="http://localhost:8086" \
        token="dev_influx_token_change_me" \
        org="foxhunt_dev" \
        bucket="market_data_dev" \
        timeout="30s"
    
    vault kv put foxhunt/databases/redis \
        host="localhost" \
        port="6379" \
        password="dev_redis_password" \
        database="0" \
        timeout="5s" \
        pool_size="20"
    
    log_success "Database secrets configured"
    
    # API credentials (development/mock values)
    log "Setting up API secrets..."
    
    vault kv put foxhunt/apis/databento \
        api_key="databento_dev_key_replace_with_real" \
        base_url="https://hist.databento.com" \
        rate_limit="100" \
        timeout="30s" \
        dataset="XNAS.ITCH"
    
    vault kv put foxhunt/apis/benzinga \
        api_key="benzinga_dev_key_replace_with_real" \
        base_url="https://api.benzinga.com" \
        rate_limit="1000" \
        timeout="15s"
    
    log_success "API secrets configured"
    
    # Broker credentials (development/sandbox values)
    log "Setting up broker API secrets..."
    
    vault kv put foxhunt/apis/brokers/icmarkets \
        fix_host="sandbox-fix.icmarkets.com" \
        fix_port="9876" \
        sender_comp_id="FOXHUNT_DEV" \
        target_comp_id="ICMARKETS" \
        username="dev_username" \
        password="dev_password" \
        account="DEV12345" \
        environment="sandbox"
    
    vault kv put foxhunt/apis/brokers/ib \
        tws_host="localhost" \
        tws_port="7497" \
        client_id="1" \
        account="DU12345" \
        environment="paper" \
        timeout="30s"
    
    log_success "Broker API secrets configured"
    
    # Service authentication keys
    log "Setting up service authentication..."
    
    # Generate JWT signing key
    local jwt_key=$(openssl rand -base64 32)
    vault kv put foxhunt/services/jwt_signing_key \
        key="$jwt_key" \
        algorithm="HS256" \
        expiry="24h"
    
    # Generate encryption key
    local encryption_key=$(openssl rand -base64 32)
    vault kv put foxhunt/services/encryption_key \
        key="$encryption_key" \
        algorithm="AES-256-GCM" \
        rotation_interval="30d"
    
    # Audit webhook (development)
    vault kv put foxhunt/services/audit_webhook \
        endpoint="http://localhost:9090/audit" \
        auth_header="Bearer dev_webhook_token" \
        enabled="false"
    
    log_success "Service authentication configured"
    
    # TLS certificates info
    log "Setting up certificate references..."
    
    vault kv put foxhunt/certificates/ca_bundle \
        ca_cert_path="/vault/tls/ca-cert.pem" \
        verification="optional_in_dev"
    
    vault kv put foxhunt/certificates/client_certs/trading-service \
        cert_path="/vault/tls/client-cert.pem" \
        key_path="/vault/tls/client-key.pem" \
        ca_path="/vault/tls/ca-cert.pem"
    
    vault kv put foxhunt/certificates/client_certs/backtesting-service \
        cert_path="/vault/tls/client-cert.pem" \
        key_path="/vault/tls/client-key.pem" \
        ca_path="/vault/tls/ca-cert.pem"
    
    vault kv put foxhunt/certificates/client_certs/tli-client \
        cert_path="/vault/tls/client-cert.pem" \
        key_path="/vault/tls/client-key.pem" \
        ca_path="/vault/tls/ca-cert.pem"
    
    log_success "Certificate references configured"
    
    # Configuration secrets
    log "Setting up configuration secrets..."
    
    vault kv put foxhunt/config/trading/risk \
        max_position_size="1000000" \
        max_daily_loss="50000" \
        max_leverage="10" \
        position_timeout="300s"
    
    vault kv put foxhunt/config/trading/execution \
        order_timeout="30s" \
        retry_attempts="3" \
        slippage_tolerance="0.001" \
        min_order_size="100"
    
    vault kv put foxhunt/config/ml/training \
        batch_size="256" \
        learning_rate="0.001" \
        epochs="100" \
        validation_split="0.2"
    
    vault kv put foxhunt/config/market-data/feeds \
        primary_feed="databento" \
        secondary_feed="benzinga" \
        buffer_size="10000" \
        compression="true"
    
    log_success "Configuration secrets set up"
    
    # Operational secrets
    log "Setting up operational secrets..."
    
    vault kv put foxhunt/operational/circuit-breakers \
        enabled="true" \
        loss_threshold="10000" \
        recovery_time="300s" \
        manual_override="admin_token_here"
    
    vault kv put foxhunt/operational/emergency-shutdown \
        kill_switch_token="emergency_kill_token_dev" \
        shutdown_endpoint="http://localhost:8080/emergency/shutdown" \
        notification_webhook="http://localhost:9090/emergency"
    
    log_success "Operational secrets configured"
}

# Create development access tokens
create_dev_tokens() {
    log "Creating development access tokens..."
    
    # Create a long-lived development token for manual testing
    local dev_token_info=$(vault token create \
        -policy=admin \
        -ttl=720h \
        -renewable=true \
        -display-name="development-admin" \
        -format=json)
    
    local dev_token=$(echo "$dev_token_info" | jq -r '.auth.client_token')
    
    echo -e "\n${GREEN}=== DEVELOPMENT TOKENS ===${NC}"
    echo -e "${YELLOW}Development Admin Token:${NC} $dev_token"
    echo -e "${YELLOW}Root Token:${NC} $DEV_ROOT_TOKEN"
    
    # Save tokens to file for easy access
    echo "$dev_token" > /vault-init/dev_admin_token
    echo "$DEV_ROOT_TOKEN" > /vault-init/dev_root_token
    
    chmod 600 /vault-init/dev_*_token
    
    log_success "Development tokens created and saved"
}

# Display service AppRole credentials
display_service_credentials() {
    log "Retrieving service credentials for development..."
    
    echo -e "\n${GREEN}=== DEVELOPMENT SERVICE CREDENTIALS ===${NC}"
    echo -e "${YELLOW}Use these credentials to configure Foxhunt services${NC}"
    
    # Trading Service
    echo -e "\n${BLUE}Trading Service AppRole:${NC}"
    echo -n "Role ID: "
    vault read -field=role_id auth/approle/role/trading-service/role-id
    echo -n "Secret ID: "
    vault write -field=secret_id -f auth/approle/role/trading-service/secret-id
    
    # Backtesting Service
    echo -e "\n${BLUE}Backtesting Service AppRole:${NC}"
    echo -n "Role ID: "
    vault read -field=role_id auth/approle/role/backtesting-service/role-id
    echo -n "Secret ID: "
    vault write -field=secret_id -f auth/approle/role/backtesting-service/secret-id
    
    # TLI Client
    echo -e "\n${BLUE}TLI Client AppRole:${NC}"
    echo -n "Role ID: "
    vault read -field=role_id auth/approle/role/tli-client/role-id
    echo -n "Secret ID: "
    vault write -field=secret_id -f auth/approle/role/tli-client/secret-id
}

# Verify development setup
verify_dev_setup() {
    log "Verifying development setup..."
    
    # Check secrets are accessible
    if vault kv get foxhunt/databases/postgresql > /dev/null 2>&1; then
        log_success "Database secrets accessible"
    else
        log_error "Database secrets not accessible"
        return 1
    fi
    
    if vault kv get foxhunt/apis/databento > /dev/null 2>&1; then
        log_success "API secrets accessible"
    else
        log_error "API secrets not accessible"
        return 1
    fi
    
    # Check policies are loaded
    if vault policy list | grep -q "trading-service"; then
        log_success "Service policies loaded"
    else
        log_error "Service policies not found"
        return 1
    fi
    
    # Check AppRoles are created
    if vault list auth/approle/role | grep -q "trading-service"; then
        log_success "Service AppRoles created"
    else
        log_error "Service AppRoles not found"
        return 1
    fi
    
    log_success "Development setup verification completed"
}

# Main execution
main() {
    echo -e "${GREEN}=== Foxhunt Vault Development Setup ===${NC}"
    
    # Safety check
    check_development_mode
    
    # Setup Vault connection
    setup_vault_connection || exit 1
    
    # Run initialization if needed
    run_initialization || exit 1
    
    # Populate development secrets
    populate_dev_secrets || exit 1
    
    # Create development tokens
    create_dev_tokens
    
    # Display service credentials
    display_service_credentials
    
    # Verify setup
    verify_dev_setup || exit 1
    
    echo -e "\n${GREEN}=== DEVELOPMENT SETUP COMPLETE ===${NC}"
    echo -e "${YELLOW}Important Notes:${NC}"
    echo "1. This is a DEVELOPMENT configuration with test data"
    echo "2. Replace all 'dev_' passwords and keys before production use"
    echo "3. TLS verification is disabled - enable for production"
    echo "4. Root token and admin tokens are saved in /vault-init/"
    echo "5. Use 'docker-compose logs vault' to monitor Vault logs"
    echo
    echo -e "${BLUE}Access Vault UI:${NC} $VAULT_ADDR"
    echo -e "${BLUE}Admin Token:${NC} $(cat /vault-init/dev_admin_token 2>/dev/null || echo 'See /vault-init/dev_admin_token')"
    
    log_success "Development environment ready!"
}

# Handle signals
trap 'log_error "Development setup interrupted"; exit 1' INT TERM

# Run main function
main "$@"