#!/bin/sh
# HOB Cattaro Self-Migration Script
# Zweck: Cattaro-Infisical-Credentials aus aktuellem Env in hob-cattaro Project schreiben
# Aufruf: sh ~/.openclaw/workspace/hob-cattaro-migrate.sh

set -e
CREDS_FILE="$HOME/.openclaw/workspace/.hob-cattaro-creds"

if [ ! -f "$CREDS_FILE" ]; then
  echo "ERROR: $CREDS_FILE nicht gefunden"
  exit 1
fi

# Load HOB Cattaro credentials
. "$CREDS_FILE"

echo "=== HOB Cattaro Self-Migration ==="
echo "Bot: kube-bot"
echo "Project: $HOB_CATTARO_PROJECT_ID"
echo "Path: $HOB_CATTARO_PATH"

# Get access token for hob-cattaro
TOKEN=$(curl -sf -X POST "$HOB_CATTARO_INFISICAL_URL/api/v1/auth/universal-auth/login" \
  -H "Content-Type: application/json" \
  -d "{\"clientId\":\"$HOB_CATTARO_CLIENT_ID\",\"clientSecret\":\"$HOB_CATTARO_CLIENT_SECRET\"}" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['accessToken'])")

if [ -z "$TOKEN" ]; then
  echo "ERROR: Token konnte nicht geholt werden"
  exit 1
fi
echo "Token: OK"

# Helper function to write a secret
write_secret() {
  KEY="$1"
  VALUE="$2"
  if [ -z "$VALUE" ]; then
    echo "SKIP: $KEY (leer)"
    return
  fi
  RESULT=$(curl -sf -X POST "$HOB_CATTARO_INFISICAL_URL/api/v3/secrets/raw/$KEY" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"workspaceId\":\"$HOB_CATTARO_PROJECT_ID\",\"environment\":\"prod\",\"secretPath\":\"$HOB_CATTARO_PATH\",\"secretValue\":\"$VALUE\",\"type\":\"shared\"}" 2>&1)
  echo "WRITE: $KEY → OK"
}

# Write Cattaro-Infisical bridge credentials (from current environment)
echo ""
echo "Schreibe Cattaro-Infisical Bridge Secrets..."

write_secret "CATTARO_INFISICAL_URL"            "${CATTARO_INFISICAL_URL:-}"
write_secret "CATTARO_INFISICAL_CLIENT_ID"      "${CATTARO_INFISICAL_CLIENT_ID:-}"
write_secret "CATTARO_INFISICAL_CLIENT_SECRET"  "${CATTARO_INFISICAL_CLIENT_SECRET:-}"
write_secret "CATTARO_INFISICAL_PROJECT_ID"     "${CATTARO_INFISICAL_PROJECT_ID:-}"

echo ""
echo "Migration abgeschlossen. Bitte Infisical UI prüfen:"
echo "  $HOB_CATTARO_INFISICAL_URL — Project hob-cattaro — $HOB_CATTARO_PATH"