#!/usr/bin/env bash
# delicurl — curl through service auth for deliberi endpoints.
#
# Authenticates against a PDS with an app password, obtains a service
# auth JWT, and proxies the request to the target URL.
#
# Usage:
#   export DELICURL_USER=alice.tngl.sh
#   export DELICURL_PASSWORD="xxxx-xxxx-xxxx-xxxx"
#
#   # GET (no --data, no -X)
#   ./cmd/delicurl.sh \
#     http://localhost:6565/xrpc/org.tangled.temp.notification.getUnreadCount
#
#   # POST with body
#   ./cmd/delicurl.sh --data '{"read":true}' \
#     http://localhost:6565/xrpc/org.tangled.temp.notification.updateSeen
#
#   # POST without body (e.g. markAllRead)
#   ./cmd/delicurl.sh -X POST \
#     http://localhost:6565/xrpc/org.tangled.temp.notification.markAllRead

set -euo pipefail

PDS="${DELICURL_PDS:-https://pds.tngl.boltless.dev}"
USER="${DELICURL_USER:-}"
PASSWORD="${DELICURL_PASSWORD:-}"
AUD="${DELICURL_AUD:-did:web:deliberi.tngl.boltless.dev}"
LXM=""
DATA=""
HTTP_METHOD=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --method|-m) LXM="$2";     shift 2 ;;
    --data|-d)   DATA="$2";    shift 2 ;;
    -X)          HTTP_METHOD="$2"; shift 2 ;;
    --pds)       PDS="$2";     shift 2 ;;
    --aud)       AUD="$2";     shift 2 ;;
    *)           break ;;
  esac
done

URL="${1:-}"
if [[ -z "$URL" ]]; then
  echo "Usage: $0 [-X METHOD] [--method lxm] [--data '{}'] [--pds url] [--aud did:web:...] <url>"
  echo ""
  echo "Environment: DELICURL_USER, DELICURL_PASSWORD (required)"
  exit 1
fi

# Auto-derive lexicon method from URL when not explicitly set.
# Strip query/fragment, then take the last path segment.
URL_CLEAN="${URL%%\?*}"
URL_CLEAN="${URL_CLEAN%%\#*}"
URL_CLEAN="${URL_CLEAN%%/}"
if [[ -z "$LXM" ]]; then
  LXM="${URL_CLEAN##*/}"
fi

# Derive HTTP method if not explicitly set.
if [[ -z "$HTTP_METHOD" ]]; then
  if [[ -n "$DATA" ]]; then
    HTTP_METHOD="POST"
  else
    HTTP_METHOD="GET"
  fi
fi

if [[ -z "$USER" || -z "$PASSWORD" ]]; then
  echo "error: DELICURL_USER and DELICURL_PASSWORD must be set" >&2
  exit 1
fi

# Step 1: create session → access JWT (POST, JSON body)
SESSION=$(curl -sS -X POST "$PDS/xrpc/com.atproto.server.createSession" \
  -H "Content-Type: application/json" \
  -d '{"identifier":"'"$USER"'","password":"'"$PASSWORD"'"}')
ACCESS_JWT=$(echo "$SESSION" | python3 -c "import sys,json; print(json.load(sys.stdin)['accessJwt'])")

# Step 2: get service auth token (GET query — aud, exp, lxm are URL params)
EXP=$(( $(date +%s) + 300 ))  # 5 min
SA_TOKEN=$(curl -sS -G "$PDS/xrpc/com.atproto.server.getServiceAuth" \
  -H "Authorization: Bearer $ACCESS_JWT" \
  --data-urlencode "aud=$AUD" \
  --data-urlencode "exp=$EXP" \
  --data-urlencode "lxm=$LXM" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

# Step 3: make the request
CURL_ARGS=(-sS -w "\n--- status: %{http_code} ---" -X "$HTTP_METHOD" -H "Authorization: Bearer $SA_TOKEN")
if [[ -n "$DATA" ]]; then
  CURL_ARGS+=(-H "Content-Type: application/json" -d "$DATA")
fi
curl "${CURL_ARGS[@]}" "$URL"