#!/bin/bash
# =============================================================
# 管理员 JWT 生成工具
# 用法: ./scripts/generate-admin-token.sh <user_id> [environment]
#
# 说明:
#   生成指定 user_id 的管理员 JWT token，用于调用管理 API。
#   需要服务器上已安装 python3 和 PyJWT 库。
#   在生产服务器上运行，而非本地。
#
# 示例:
#   ./scripts/generate-admin-token.sh 1 production    # 生产管理员 token
#   ./scripts/generate-admin-token.sh 1 development   # 开发管理员 token
# =============================================================
set -euo pipefail

if [ $# -lt 1 ]; then
    echo "用法: $0 <user_id> [environment]"
    echo "  默认 environment=production"
    exit 1
fi

USER_ID="$1"
APP_ENV="${2:-production}"
JWT_SECRET=""

# 优先从 systemd 服务获取（新版部署）
if [ "$APP_ENV" = "production" ]; then
    JWT_SECRET=$(systemctl cat rust-backend-blue.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
    if [ -z "$JWT_SECRET" ]; then
        JWT_SECRET=$(systemctl cat rust-backend-green.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
    fi
elif [ "$APP_ENV" = "development" ]; then
    JWT_SECRET=$(systemctl cat rust-backend-dev.service 2>/dev/null | grep -oP '(?<=^Environment=JWT_SECRET=).*' | head -1)
fi

# 回退: 从 .env 文件获取（旧版部署）
if [ -z "$JWT_SECRET" ] && [ "$APP_ENV" = "production" ]; then
    for f in /root/rust/rust_backend_blue/.env /root/rust/rust_backend_green/.env; do
        [ -f "$f" ] && JWT_SECRET=$(grep -oP '(?<=^JWT_SECRET=).*' "$f" 2>/dev/null || true)
        [ -n "$JWT_SECRET" ] && break
    done
fi
if [ -z "$JWT_SECRET" ] && [ "$APP_ENV" = "development" ]; then
    [ -f /root/rust/rust_backend_dev/.env ] && JWT_SECRET=$(grep -oP '(?<=^JWT_SECRET=).*' /root/rust/rust_backend_dev/.env 2>/dev/null || true)
fi

if [ -z "$JWT_SECRET" ]; then
    echo "错误: 无法获取 JWT_SECRET，请在服务器上运行此脚本"
    exit 1
fi

# 验证用户 ID 是否为管理员
echo "验证用户 ${USER_ID} 的管理员权限..."
if command -v docker &>/dev/null; then
    DB_CONTAINER=$(docker ps --format "{{.Names}}" | grep -i postgres | head -1)
    if [ -n "$DB_CONTAINER" ]; then
        IS_ADMIN=$(docker exec "$DB_CONTAINER" psql -U postgres -d milkydata -t -A -c "SELECT is_admin FROM users WHERE id = ${USER_ID};" 2>/dev/null || echo "false")
        if [ "$IS_ADMIN" != "t" ]; then
            echo "警告: user_id=${USER_ID} 不是管理员！继续生成但不保证有权限。"
        else
            echo "✓ 用户 ${USER_ID} 确认为管理员"
        fi
    fi
else
    echo "警告: 未检测到 docker，跳过管理员验证"
fi

# 生成 Token（使用 Python + PyJWT）
TOKEN=$(python3 -c "
import jwt, time
secret = '''${JWT_SECRET}'''
claims = {
    'exp': int(time.time()) + 3600,
    'iat': int(time.time()),
    'user_id': ${USER_ID},
    'openid': 'admin_${USER_ID}',
    'user_type': 2
}
token = jwt.encode(claims, secret, algorithm='HS256')
print(token)
" 2>&1) || {
    echo "错误: 生成 token 失败，请安装 PyJWT: pip3 install pyjwt"
    exit 1
}

echo ""
echo "============================================"
echo " 管理员 JWT Token (user_id=${USER_ID}, ${APP_ENV})"
echo " 有效期: 1 小时"
echo "============================================"
echo "$TOKEN"
echo "============================================"
echo ""
echo "使用方式:"
echo "  curl -H 'Authorization: Bearer 你的TOKEN' \\"
echo "    https://${APP_ENV}.xmclassmate.top/api/admin/notifications \\"
echo "    -X POST -H 'Content-Type: application/json' \\"
echo "    -d '{\"scope\":\"all\",\"type_\":\"maintenance\",\"title\":\"通知标题\",\"content\":\"通知内容\",\"priority\":\"high\"}'"
echo ""