#!/usr/bin/env bash
set -Eeuo pipefail

# =============================================================================
# Flowise Account Setup Script
# =============================================================================
# Erstellt den Administrator-Account für eine neue Flowise-Instanz
# über die Flowise API (/api/v1/organization/setup)
# =============================================================================

SCRIPT_VERSION="1.0.1"

# Debug mode: 0 = nur JSON, 1 = Logs auf stderr
DEBUG="${DEBUG:-0}"
export DEBUG

# Logging functions
log_ts() { date "+[%F %T]"; }
info() { [[ "$DEBUG" == "1" ]] && echo "$(log_ts) INFO: $*" >&2; return 0; }
warn() { [[ "$DEBUG" == "1" ]] && echo "$(log_ts) WARN: $*" >&2; return 0; }
die() {
  if [[ "$DEBUG" == "1" ]]; then
    echo "$(log_ts) ERROR: $*" >&2
  else
    echo "{\"error\": \"$*\"}"
  fi
  exit 1
}

# =============================================================================
# Usage
# =============================================================================
usage() {
  cat >&2 <<'EOF'
Usage:
  bash setup_flowise_account.sh [options]

Required options:
  --url <url>                 Flowise base URL (e.g., https://fw-1768829679.userman.de)
  --name <name>               Administrator display name
  --email <email>             Administrator email (used as login)
  --password <password>       Administrator password (8+ chars, upper, lower, digit, special)

Optional:
  --basic-user <user>         Basic Auth username (if Flowise has FLOWISE_USERNAME set)
  --basic-pass <pass>         Basic Auth password (if Flowise has FLOWISE_PASSWORD set)
  --debug                     Enable debug mode (show logs on stderr)
  --help                      Show this help

Password requirements:
  - At least 8 characters
  - At least one lowercase letter
  - At least one uppercase letter
  - At least one digit
  - At least one special character

Examples:
  # Setup account:
  bash setup_flowise_account.sh \
    --url https://fw-1768829679.userman.de \
    --name "Admin User" \
    --email admin@example.com \
    --password "SecurePass1!"

  # With debug output:
  bash setup_flowise_account.sh --debug \
    --url https://fw-1768829679.userman.de \
    --name "Admin User" \
    --email admin@example.com \
    --password "SecurePass1!"
EOF
}

# =============================================================================
# Default values
# =============================================================================
FLOWISE_URL=""
ADMIN_NAME=""
ADMIN_EMAIL=""
ADMIN_PASSWORD=""
BASIC_USER=""
BASIC_PASS=""

# =============================================================================
# Argument parsing
# =============================================================================
while [[ $# -gt 0 ]]; do
  case "$1" in
    --url) FLOWISE_URL="${2:-}"; shift 2 ;;
    --name) ADMIN_NAME="${2:-}"; shift 2 ;;
    --email) ADMIN_EMAIL="${2:-}"; shift 2 ;;
    --password) ADMIN_PASSWORD="${2:-}"; shift 2 ;;
    --basic-user) BASIC_USER="${2:-}"; shift 2 ;;
    --basic-pass) BASIC_PASS="${2:-}"; shift 2 ;;
    --debug) DEBUG="1"; export DEBUG; shift 1 ;;
    --help|-h) usage; exit 0 ;;
    *) die "Unknown option: $1 (use --help)" ;;
  esac
done

# =============================================================================
# Validation
# =============================================================================
[[ -n "$FLOWISE_URL" ]] || die "--url is required"
[[ -n "$ADMIN_NAME" ]] || die "--name is required"
[[ -n "$ADMIN_EMAIL" ]] || die "--email is required"
[[ -n "$ADMIN_PASSWORD" ]] || die "--password is required"

# Validate email format
[[ "$ADMIN_EMAIL" =~ ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]] || die "Invalid email format: $ADMIN_EMAIL"

# Validate password policy (Flowise requirements)
validate_password() {
  local p="$1"
  [[ ${#p} -ge 8 ]] || return 1
  [[ "$p" =~ [a-z] ]] || return 1
  [[ "$p" =~ [A-Z] ]] || return 1
  [[ "$p" =~ [0-9] ]] || return 1
  [[ "$p" =~ [^a-zA-Z0-9] ]] || return 1
  return 0
}

validate_password "$ADMIN_PASSWORD" || die "Password does not meet requirements: 8+ chars, lowercase, uppercase, digit, special character"

# Remove trailing slash from URL
FLOWISE_URL="${FLOWISE_URL%/}"

info "Script Version: ${SCRIPT_VERSION}"
info "Configuration:"
info "  URL: ${FLOWISE_URL}"
info "  Name: ${ADMIN_NAME}"
info "  Email: ${ADMIN_EMAIL}"
info "  Password: ********"
if [[ -n "$BASIC_USER" ]]; then
  info "  Basic Auth: ${BASIC_USER}:********"
fi

# Build curl auth options
CURL_AUTH=""
if [[ -n "$BASIC_USER" && -n "$BASIC_PASS" ]]; then
  CURL_AUTH="-u ${BASIC_USER}:${BASIC_PASS}"
fi

# =============================================================================
# Check if Flowise is reachable
# =============================================================================
info "Checking if Flowise is reachable..."

# Try to reach the organization-setup page
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -k ${CURL_AUTH} "${FLOWISE_URL}/organization-setup" 2>/dev/null || echo "000")

if [[ "$HTTP_CODE" == "000" ]]; then
  die "Cannot connect to Flowise at ${FLOWISE_URL}"
elif [[ "$HTTP_CODE" == "404" ]]; then
  warn "Organization setup page not found (404). Account may already exist."
fi

info "Flowise is reachable (HTTP ${HTTP_CODE})"

# =============================================================================
# Create Account via API
# =============================================================================
info "Creating administrator account..."

# Prepare JSON payload
# Note: Flowise expects specific field names
JSON_PAYLOAD=$(cat <<EOF
{
  "name": "${ADMIN_NAME}",
  "email": "${ADMIN_EMAIL}",
  "password": "${ADMIN_PASSWORD}"
}
EOF
)

info "Sending request to ${FLOWISE_URL}/api/v1/organization/setup"

# Make API request
RESPONSE=$(curl -s -k ${CURL_AUTH} -X POST \
  -H "Content-Type: application/json" \
  -d "${JSON_PAYLOAD}" \
  -w "\n%{http_code}" \
  "${FLOWISE_URL}/api/v1/organization/setup" 2>&1)

# Extract HTTP code from last line
HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
RESPONSE_BODY=$(echo "$RESPONSE" | sed '$d')

info "HTTP Response Code: ${HTTP_CODE}"
info "Response Body: ${RESPONSE_BODY}"

# =============================================================================
# Handle Response
# =============================================================================
if [[ "$HTTP_CODE" == "200" || "$HTTP_CODE" == "201" ]]; then
  info "Account created successfully!"
  
  # Output result as JSON
  if [[ "$DEBUG" == "1" ]]; then
    cat <<EOF
{
  "success": true,
  "url": "${FLOWISE_URL}",
  "email": "${ADMIN_EMAIL}",
  "name": "${ADMIN_NAME}",
  "message": "Account created successfully"
}
EOF
  else
    echo "{\"success\":true,\"url\":\"${FLOWISE_URL}\",\"email\":\"${ADMIN_EMAIL}\",\"name\":\"${ADMIN_NAME}\",\"message\":\"Account created successfully\"}"
  fi
  
elif [[ "$HTTP_CODE" == "400" ]]; then
  # Check if account already exists
  if echo "$RESPONSE_BODY" | grep -qi "already exists\|already setup\|already registered"; then
    warn "Account may already exist"
    if [[ "$DEBUG" == "1" ]]; then
      cat <<EOF
{
  "success": false,
  "url": "${FLOWISE_URL}",
  "email": "${ADMIN_EMAIL}",
  "error": "Account already exists",
  "response": ${RESPONSE_BODY}
}
EOF
    else
      echo "{\"success\":false,\"url\":\"${FLOWISE_URL}\",\"email\":\"${ADMIN_EMAIL}\",\"error\":\"Account already exists\"}"
    fi
    exit 1
  else
    die "Bad request (400): ${RESPONSE_BODY}"
  fi
  
elif [[ "$HTTP_CODE" == "404" ]]; then
  # Try alternative endpoints
  info "Trying alternative endpoint /api/v1/signup..."
  
  RESPONSE=$(curl -s -k ${CURL_AUTH} -X POST \
    -H "Content-Type: application/json" \
    -d "${JSON_PAYLOAD}" \
    -w "\n%{http_code}" \
    "${FLOWISE_URL}/api/v1/signup" 2>&1)
  
  HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
  RESPONSE_BODY=$(echo "$RESPONSE" | sed '$d')
  
  if [[ "$HTTP_CODE" == "200" || "$HTTP_CODE" == "201" ]]; then
    info "Account created successfully via /api/v1/signup!"
    if [[ "$DEBUG" == "1" ]]; then
      cat <<EOF
{
  "success": true,
  "url": "${FLOWISE_URL}",
  "email": "${ADMIN_EMAIL}",
  "name": "${ADMIN_NAME}",
  "message": "Account created successfully"
}
EOF
    else
      echo "{\"success\":true,\"url\":\"${FLOWISE_URL}\",\"email\":\"${ADMIN_EMAIL}\",\"name\":\"${ADMIN_NAME}\",\"message\":\"Account created successfully\"}"
    fi
  else
    die "API endpoint not found. Tried /api/v1/organization/setup and /api/v1/signup. Response: ${RESPONSE_BODY}"
  fi
  
else
  die "Unexpected response (HTTP ${HTTP_CODE}): ${RESPONSE_BODY}"
fi