#!/bin/bash

# MinIO WebUI - Create Bucket with User Script
# This script creates a MinIO bucket and a user with appropriate access policies

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default values
API_URL="${API_URL:-http://localhost:7510}"
BUCKET_PREFIX="bucket"
USER_PREFIX="user"
POLICY_TYPE="readwrite"

# Function to print colored output
print_status() {
    echo -e "${GREEN}[✓]${NC} $1"
}

print_error() {
    echo -e "${RED}[✗]${NC} $1"
}

print_info() {
    echo -e "${YELLOW}[i]${NC} $1"
}

# Function to generate secure password
generate_password() {
    # Generate a 16-character password with letters, numbers, and special characters
    openssl rand -base64 16 | tr -d "=/" | cut -c1-16
}

# Function to check if jq is installed
check_dependencies() {
    if ! command -v jq &> /dev/null; then
        print_error "jq is required but not installed. Please install it first."
        exit 1
    fi
    
    if ! command -v curl &> /dev/null; then
        print_error "curl is required but not installed. Please install it first."
        exit 1
    fi
}

# Function to get auth token
get_auth_token() {
    local username=$1
    local password=$2
    
    response=$(curl -s -X POST "${API_URL}/api/auth/login" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"${username}\",\"password\":\"${password}\"}" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" != "200" ]; then
        print_error "Failed to authenticate. HTTP Code: $http_code"
        echo "$body" | jq -r '.error // .message // .' 2>/dev/null || echo "$body"
        return 1
    fi
    
    token=$(echo "$body" | jq -r '.token // .access_token // .' 2>/dev/null)
    if [ -z "$token" ] || [ "$token" == "null" ]; then
        print_error "Failed to extract token from response"
        return 1
    fi
    
    echo "$token"
}

# Function to create bucket
create_bucket() {
    local token=$1
    local bucket_name=$2
    
    response=$(curl -s -X POST "${API_URL}/api/buckets" \
        -H "Authorization: Bearer ${token}" \
        -H "Content-Type: application/json" \
        -d "{\"name\":\"${bucket_name}\"}" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" != "200" ] && [ "$http_code" != "201" ]; then
        print_error "Failed to create bucket. HTTP Code: $http_code"
        echo "$body" | jq -r '.error // .message // .' 2>/dev/null || echo "$body"
        return 1
    fi
    
    print_status "Bucket '${bucket_name}' created successfully"
}

# Function to create user
create_user() {
    local token=$1
    local username=$2
    local password=$3
    
    response=$(curl -s -X POST "${API_URL}/api/users" \
        -H "Authorization: Bearer ${token}" \
        -H "Content-Type: application/json" \
        -d "{\"accessKey\":\"${username}\",\"secretKey\":\"${password}\"}" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" != "200" ] && [ "$http_code" != "201" ]; then
        print_error "Failed to create user. HTTP Code: $http_code"
        echo "$body" | jq -r '.error // .message // .' 2>/dev/null || echo "$body"
        return 1
    fi
    
    print_status "User '${username}' created successfully"
}

# Function to create policy
create_policy() {
    local token=$1
    local policy_name=$2
    local bucket_name=$3
    local policy_type=$4
    
    # Generate policy based on type
    case "$policy_type" in
        "readonly")
            policy_json=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}",
        "arn:aws:s3:::${bucket_name}/*"
      ]
    }
  ]
}
EOF
            )
            ;;
        "writeonly")
            policy_json=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}",
        "arn:aws:s3:::${bucket_name}/*"
      ]
    }
  ]
}
EOF
            )
            ;;
        *)
            # Default to readwrite
            policy_json=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:*"],
      "Resource": [
        "arn:aws:s3:::${bucket_name}",
        "arn:aws:s3:::${bucket_name}/*"
      ]
    }
  ]
}
EOF
            )
            ;;
    esac
    
    # Escape the JSON for the curl command
    escaped_policy=$(echo "$policy_json" | jq -c .)
    
    response=$(curl -s -X POST "${API_URL}/api/policies" \
        -H "Authorization: Bearer ${token}" \
        -H "Content-Type: application/json" \
        -d "{\"name\":\"${policy_name}\",\"policy\":${escaped_policy}}" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" != "200" ] && [ "$http_code" != "201" ]; then
        print_error "Failed to create policy. HTTP Code: $http_code"
        echo "$body" | jq -r '.error // .message // .' 2>/dev/null || echo "$body"
        return 1
    fi
    
    print_status "Policy '${policy_name}' created successfully"
}

# Function to attach policy to user
attach_policy() {
    local token=$1
    local policy_name=$2
    local username=$3
    
    response=$(curl -s -X POST "${API_URL}/api/policies/attach" \
        -H "Authorization: Bearer ${token}" \
        -H "Content-Type: application/json" \
        -d "{\"policyName\":\"${policy_name}\",\"userName\":\"${username}\"}" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" != "200" ] && [ "$http_code" != "201" ]; then
        print_error "Failed to attach policy. HTTP Code: $http_code"
        echo "$body" | jq -r '.error // .message // .' 2>/dev/null || echo "$body"
        return 1
    fi
    
    print_status "Policy '${policy_name}' attached to user '${username}'"
}

# Main function
main() {
    echo "MinIO WebUI - Create Bucket with User"
    echo "====================================="
    echo
    
    # Check dependencies
    check_dependencies
    
    # Parse command line arguments
    while [[ $# -gt 0 ]]; do
        case $1 in
            -b|--bucket)
                BUCKET_NAME="$2"
                shift 2
                ;;
            -u|--user)
                USER_NAME="$2"
                shift 2
                ;;
            -p|--policy)
                POLICY_TYPE="$2"
                shift 2
                ;;
            -a|--api-url)
                API_URL="$2"
                shift 2
                ;;
            --admin-user)
                ADMIN_USER="$2"
                shift 2
                ;;
            --admin-pass)
                ADMIN_PASS="$2"
                shift 2
                ;;
            -h|--help)
                echo "Usage: $0 [options]"
                echo
                echo "Options:"
                echo "  -b, --bucket <name>     Bucket name (default: auto-generated)"
                echo "  -u, --user <name>       User name (default: auto-generated)"
                echo "  -p, --policy <type>     Policy type: readonly, writeonly, readwrite (default: readwrite)"
                echo "  -a, --api-url <url>     API URL (default: http://localhost:7510)"
                echo "  --admin-user <user>     Admin username for authentication"
                echo "  --admin-pass <pass>     Admin password for authentication"
                echo "  -h, --help              Show this help message"
                echo
                echo "Example:"
                echo "  $0 -b my-bucket -u my-user -p readwrite"
                echo
                exit 0
                ;;
            *)
                print_error "Unknown option: $1"
                exit 1
                ;;
        esac
    done
    
    # Generate names if not provided
    TIMESTAMP=$(date +%Y%m%d%H%M%S)
    BUCKET_NAME=${BUCKET_NAME:-"${BUCKET_PREFIX}-${TIMESTAMP}"}
    USER_NAME=${USER_NAME:-"${USER_PREFIX}-${TIMESTAMP}"}
    POLICY_NAME="policy-${BUCKET_NAME}"
    
    # Generate password for new user
    USER_PASSWORD=$(generate_password)
    
    # Get admin credentials
    if [ -z "$ADMIN_USER" ] || [ -z "$ADMIN_PASS" ]; then
        print_info "Please enter admin credentials"
        read -p "Admin username: " ADMIN_USER
        read -s -p "Admin password: " ADMIN_PASS
        echo
    fi
    
    print_info "Starting setup process..."
    echo
    
    # Authenticate
    print_info "Authenticating..."
    TOKEN=$(get_auth_token "$ADMIN_USER" "$ADMIN_PASS")
    if [ $? -ne 0 ]; then
        print_error "Authentication failed"
        exit 1
    fi
    print_status "Authentication successful"
    
    # Create bucket
    print_info "Creating bucket '${BUCKET_NAME}'..."
    create_bucket "$TOKEN" "$BUCKET_NAME"
    if [ $? -ne 0 ]; then
        print_error "Failed to create bucket"
        exit 1
    fi
    
    # Create user
    print_info "Creating user '${USER_NAME}'..."
    create_user "$TOKEN" "$USER_NAME" "$USER_PASSWORD"
    if [ $? -ne 0 ]; then
        print_error "Failed to create user"
        exit 1
    fi
    
    # Create policy
    print_info "Creating ${POLICY_TYPE} policy '${POLICY_NAME}'..."
    create_policy "$TOKEN" "$POLICY_NAME" "$BUCKET_NAME" "$POLICY_TYPE"
    if [ $? -ne 0 ]; then
        print_error "Failed to create policy"
        exit 1
    fi
    
    # Attach policy to user
    print_info "Attaching policy to user..."
    attach_policy "$TOKEN" "$POLICY_NAME" "$USER_NAME"
    if [ $? -ne 0 ]; then
        print_error "Failed to attach policy"
        exit 1
    fi
    
    echo
    echo "====================================="
    echo -e "${GREEN}Setup completed successfully!${NC}"
    echo "====================================="
    echo
    echo "Bucket Name: ${BUCKET_NAME}"
    echo "User Name: ${USER_NAME}"
    echo "Password: ${USER_PASSWORD}"
    echo "Policy: ${POLICY_NAME} (${POLICY_TYPE})"
    echo
    echo "You can now use these credentials to access the bucket."
    echo
    echo "Example MinIO CLI commands:"
    echo "  mc alias set myminio http://localhost:9000 ${USER_NAME} ${USER_PASSWORD}"
    echo "  mc ls myminio/${BUCKET_NAME}"
    echo
}

# Run main function
main "$@"