#!/bin/bash
set -e

# Charybdis Development Certificate Generation Script
# This script generates self-signed certificates for local development and testing

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CERT_DIR="${SCRIPT_DIR}/../certs"
DAYS_VALID=365

echo "🔐 Charybdis Certificate Generation"
echo "===================================="
echo ""

# Create certs directory
mkdir -p "${CERT_DIR}"
cd "${CERT_DIR}"

# Function to generate certificate
generate_cert() {
    local name=$1
    local cn=$2
    local ou=$3
    local cert_type=$4  # "server" or "client"

    echo "📝 Generating ${name}..."

    # Generate private key
    openssl genrsa -out "${name}-key.pem" 2048 2>/dev/null

    # Generate CSR
    openssl req -new \
        -key "${name}-key.pem" \
        -out "${name}.csr" \
        -subj "/CN=${cn}/OU=${ou}/O=Charybdis-Dev/C=US" \
        2>/dev/null

    # Generate certificate
    if [ "${cert_type}" = "server" ]; then
        openssl x509 -req \
            -days ${DAYS_VALID} \
            -in "${name}.csr" \
            -CA ca.pem \
            -CAkey ca-key.pem \
            -CAcreateserial \
            -out "${name}-cert.pem" \
            -extfile <(echo "extendedKeyUsage=serverAuth
subjectAltName=DNS:localhost,DNS:charybdis,DNS:charybdis.local,IP:127.0.0.1") \
            2>/dev/null
    else
        openssl x509 -req \
            -days ${DAYS_VALID} \
            -in "${name}.csr" \
            -CA ca.pem \
            -CAkey ca-key.pem \
            -CAcreateserial \
            -out "${name}-cert.pem" \
            -extfile <(echo "extendedKeyUsage=clientAuth") \
            2>/dev/null
    fi

    # Clean up CSR
    rm "${name}.csr"

    echo "   ✅ Generated ${name}-cert.pem and ${name}-key.pem"
}

# 1. Generate Root CA
echo "🏛️  Generating Root CA..."
if [ ! -f ca.pem ]; then
    openssl genrsa -out ca-key.pem 4096 2>/dev/null
    openssl req -new -x509 \
        -days 3650 \
        -key ca-key.pem \
        -out ca.pem \
        -subj "/CN=Charybdis Dev Root CA/O=Charybdis-Dev/C=US" \
        2>/dev/null
    echo "   ✅ Generated ca.pem (Root CA)"
else
    echo "   ℹ️  Root CA already exists, skipping"
fi
echo ""

# 2. Generate Server Certificate
echo "🖥️  Generating Server Certificate..."
generate_cert "server" "localhost" "platform" "server"
echo ""

# 3. Generate Client Certificates
echo "👥 Generating Client Certificates..."
echo ""

# Admin client
generate_cert "admin" "admin-user" "platform-team" "client"

# CI/CD Pipeline client
generate_cert "ci-pipeline" "ci-pipeline" "automation" "client"

# Backstage client
generate_cert "backstage" "backstage" "platform" "client"

# DefectDojo plugin client
generate_cert "defectdojo-plugin" "defectdojo-plugin" "plugins" "client"

# DependencyTrack plugin client
generate_cert "dependencytrack-plugin" "dependencytrack-plugin" "plugins" "client"

echo ""
echo "✅ Certificate Generation Complete!"
echo ""
echo "📂 Certificates generated in: ${CERT_DIR}"
echo ""
echo "📋 Summary:"
echo "   - Root CA: ca.pem, ca-key.pem"
echo "   - Server: server-cert.pem, server-key.pem"
echo "   - Clients:"
echo "     • admin-cert.pem, admin-key.pem (role: admin)"
echo "     • ci-pipeline-cert.pem, ci-pipeline-key.pem (role: service-writer)"
echo "     • backstage-cert.pem, backstage-key.pem (role: catalog-reader)"
echo "     • defectdojo-plugin-cert.pem, defectdojo-plugin-key.pem (role: plugin)"
echo "     • dependencytrack-plugin-cert.pem, dependencytrack-plugin-key.pem (role: plugin)"
echo ""
echo "🔍 Verify certificates:"
echo "   openssl x509 -in ${CERT_DIR}/server-cert.pem -text -noout"
echo ""
echo "🚀 Use with Charybdis:"
echo "   export SECURITY_MTLS_ENABLED=true"
echo "   export SECURITY_MTLS_SERVER_CERT=${CERT_DIR}/server-cert.pem"
echo "   export SECURITY_MTLS_SERVER_KEY=${CERT_DIR}/server-key.pem"
echo "   export SECURITY_MTLS_CLIENT_CA=${CERT_DIR}/ca.pem"
echo ""
echo "⚠️  These are DEVELOPMENT certificates only!"
echo "   Do NOT use in production. Generate proper certificates from a trusted CA."
echo ""