#!/usr/bin/env bash
# Gera o certificado X.509 de cliente OPC UA do ingestor e sobe pro Gitea
# in-cluster (repo que o pod clona no boot — nada muda no values/deployment,
# só rollout restart depois do push).
#
# Uso:
#   GITEA_PASSWORD='<senha>' ./scripts/generate-and-push-opc-cert.sh
#
# Vars (defaults pro cluster dev/gcp):
#   GITEA_URL      default https://git.sientia.ai
#   GITEA_USER     default gitea_admin
#   GITEA_PASSWORD obrigatória
#   GITEA_REPO     default gitea_admin/sientia-dataops-opc-ingestor
#   BRANCH         default main
#   APP_URI        default urn:sientia:opc-ingestor  (SAN URI do cert — TEM que
#                  ser igual ao campo `uri` do documento na collection
#                  OPC_servers: o ingestor usa esse valor como application_uri
#                  e o KEPServer rejeita com BadCertificateUriInvalid se divergir)
#   DAYS           default 3650
#   FORCE=1        sobrescreve cert já existente no repo
set -euo pipefail

GITEA_URL=${GITEA_URL:-https://git.sientia.ai}
GITEA_USER=${GITEA_USER:-gitea_admin}
GITEA_PASSWORD=${GITEA_PASSWORD:?export GITEA_PASSWORD com a senha do Gitea}
GITEA_REPO=${GITEA_REPO:-gitea_admin/sientia-dataops-opc-ingestor}
BRANCH=${BRANCH:-main}
APP_URI=${APP_URI:-urn:sientia:opc-ingestor}
CN=${CN:-sientia-opc-ingestor}
DAYS=${DAYS:-3650}

CERT_DIR_IN_REPO="certs"
CERT_NAME="opc-ingestor-cert.pem"
KEY_NAME="opc-ingestor-key.pem"
DER_NAME="opc-ingestor-cert.der"

workdir=$(mktemp -d)
trap 'rm -rf "$workdir"' EXIT

echo ">> Gerando certificado (CN=${CN}, URI=${APP_URI}, ${DAYS} dias)..."
# Extensões exigidas por OPC UA (KEPServer valida keyUsage/EKU e o SAN URI).
openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days "$DAYS" \
  -keyout "$workdir/$KEY_NAME" -out "$workdir/$CERT_NAME" \
  -subj "/CN=${CN}/O=Aignosi/OU=Sientia" \
  -addext "subjectAltName=URI:${APP_URI},DNS:${CN}" \
  -addext "keyUsage=critical,digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment" \
  -addext "extendedKeyUsage=critical,clientAuth,serverAuth" \
  -addext "basicConstraints=critical,CA:FALSE"

# Cópia DER — só referência p/ import manual no KEPServer (o trust normal é
# aceitar o cert rejeitado na 1ª conexão).
openssl x509 -in "$workdir/$CERT_NAME" -outform der -out "$workdir/$DER_NAME"

echo ">> Clonando ${GITEA_REPO}@${BRANCH} do Gitea..."
encoded_pass=$(python3 - <<EOF
import urllib.parse; print(urllib.parse.quote('''${GITEA_PASSWORD}''', safe=''))
EOF
)
clone_url="${GITEA_URL%%/}"
clone_url="${clone_url/:\/\//:\/\/${GITEA_USER}:${encoded_pass}@}/${GITEA_REPO}.git"
git clone --depth 1 --branch "$BRANCH" "$clone_url" "$workdir/repo" 2>&1 | sed "s#${encoded_pass}#***#g"

if [[ -f "$workdir/repo/$CERT_DIR_IN_REPO/$CERT_NAME" && "${FORCE:-0}" != "1" ]]; then
  echo "ERRO: $CERT_DIR_IN_REPO/$CERT_NAME já existe no repo. Re-rodar com FORCE=1 sobrescreve" >&2
  echo "      (o cert antigo deixa de valer — retrust no KEPServer necessário)." >&2
  exit 1
fi

mkdir -p "$workdir/repo/$CERT_DIR_IN_REPO"
cp "$workdir/$CERT_NAME" "$workdir/$KEY_NAME" "$workdir/$DER_NAME" "$workdir/repo/$CERT_DIR_IN_REPO/"

cd "$workdir/repo"
git add "$CERT_DIR_IN_REPO"
git -c user.name="opc-cert-script" -c user.email="platform@aignosi.com.br" \
  commit -m "Add OPC UA client certificate for KEPServer connection (URI ${APP_URI})"
git push origin "$BRANCH" 2>&1 | sed "s#${encoded_pass}#***#g"

fingerprint=$(openssl x509 -in "$CERT_DIR_IN_REPO/$CERT_NAME" -noout -fingerprint -sha1)

cat <<EOF

== PRONTO ==
Cert no Gitea: ${GITEA_REPO}@${BRANCH} -> ${CERT_DIR_IN_REPO}/{${CERT_NAME},${KEY_NAME},${DER_NAME}}
${fingerprint}

Paths dentro do pod (o entrypoint clona o repo em /app):
  cert_path:        /app/${CERT_DIR_IN_REPO}/${CERT_NAME}
  private_key_path: /app/${CERT_DIR_IN_REPO}/${KEY_NAME}

Próximos passos:
  1. Documento na collection OPC_servers com "uri": "${APP_URI}" (ver README/PR).
  2. kubectl -n sientia rollout restart deployment/opc-ingestor   # re-clona o repo
  3. Pod tenta conectar -> no KEPServer: OPC UA Configuration Manager ->
     Trusted Clients -> cert '${CN}' rejeitado -> Trust -> restart runtime.
EOF