#!/bin/bash
# ===========================================
# 支付宝密钥一致性核对脚本
# 对比本地 .env 与服务器 green/blue .env 的应用私钥，
# 并从本地私钥导出应用公钥，供与支付宝控制台比对。
# 防止 invalid-signature（密钥不同步）问题复发。
# 用法: bash scripts/verify-alipay-keys.sh [--remote-host HOST]
# ===========================================

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
ENV_FILE="$PROJECT_ROOT/.env"
REMOTE_HOST="${2:-aliyun-server}"

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
info()  { echo -e "${GREEN}[INFO]${NC} $1"; }
warn()  { echo -e "${YELLOW}[WARN]${NC} $1"; }
error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

if [ ! -f "$ENV_FILE" ] || ! grep -q '^ALIPAY_PRIVATE_KEY=' "$ENV_FILE"; then
    error "本地 ${ENV_FILE} 未找到 ALIPAY_PRIVATE_KEY"
    exit 1
fi

LOCAL_KEY=$(grep '^ALIPAY_PRIVATE_KEY=' "$ENV_FILE" | head -1 | cut -d'=' -f2- | tr -d '\r\n ')
LOCAL_MD5=$(printf '%s' "$LOCAL_KEY" | md5sum | cut -d' ' -f1)
info "本地 .env 私钥 MD5: ${LOCAL_MD5}"

ALL_MATCH=true
for ENV in green blue; do
    REMOTE_MD5=$(ssh "$REMOTE_HOST" "grep '^ALIPAY_PRIVATE_KEY=' /root/rust/rust_backend_${ENV}/.env | cut -c20- | tr -d '\n' | md5sum | cut -d' ' -f1" 2>/dev/null || echo "N/A")
    if [ "$REMOTE_MD5" = "$LOCAL_MD5" ]; then
        info "服务器 ${ENV} 私钥一致 ✅"
    else
        warn "服务器 ${ENV} 私钥不一致（本地=${LOCAL_MD5} 远端=${REMOTE_MD5}）"
        ALL_MATCH=false
    fi
done

if [ "$ALL_MATCH" = true ]; then
    info "本地与服务器密钥一致"
else
    warn "存在不一致！请检查服务器 .env 或重新部署"
fi

echo ""
echo "========== 应用公钥（与控制台比对） =========="
python3 -c "
import base64
from cryptography.hazmat.primitives import serialization
key_b64 = '$LOCAL_KEY'
try:
    priv = serialization.load_der_private_key(base64.b64decode(key_b64), password=None)
except Exception:
    priv = serialization.load_pem_private_key(key_b64.encode(), password=None)
pub_der = priv.public_key().public_bytes(
    encoding=serialization.Encoding.DER,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)
print(base64.b64encode(pub_der).decode())
"
echo ""
info "请到支付宝开放平台 → 密钥工具 → 查看应用公钥，与上方公钥比对"