#!/bin/sh
set -eu
umask 077
# shellcheck source=infra/local/sendico/network.sh
. /etc/sendico/network.sh
mkdir -p /private /run/sendico
chmod 755 /run/sendico
cd /private
bridge=''; monitor=''; delay=''
cleanup() {
 for child in "$bridge" "$monitor" "$delay"; do
  if [ -n "$child" ]; then kill "$child" 2>/dev/null || true; fi
 done
}
trap cleanup EXIT
trap 'exit 0' INT TERM
socat TCP4-LISTEN:18081,bind=127.0.0.1,reuseaddr,fork TCP4:host.docker.internal:8080 &
bridge=$!
session_pid=$$
(trap - EXIT INT TERM; watch_network "$session_pid") &
monitor=$!

session() {
 jq -n --rawfile role /etc/agent/role-id --rawfile secret /etc/agent/secret-id \
  '{role_id:($role|rtrimstr("\n")),secret_id:($secret|rtrimstr("\n"))}' > login.json
 curl -fsS --max-time 15 -H 'Content-Type: application/json' --data-binary @login.json \
  http://vault:8200/v1/auth/approle/login > vault.json 2>/dev/null || return 1
 jq -er '"X-Vault-Token: "+.auth.client_token' vault.json > vault.header || return 1
 curl -fsS --max-time 15 -H @vault.header http://vault:8200/v1/kv/data/services/bff/sendico > credentials.json 2>/dev/null || return 1
 jq -e --arg client "$SENDICO_CLIENT_ID" --arg device "$SENDICO_DEVICE_ID" \
  '.data.data | {login:{login,password},clientSecret:.client_secret,clientId:$client,deviceId:$device}' credentials.json > request.json || return 1
 curl -fsS --max-time 15 -H @vault.header -X POST http://vault:8200/v1/auth/token/revoke-self >/dev/null 2>&1 || return 1
 rm -f vault.header vault.json credentials.json login.json
 curl -fsS --max-time 20 -H 'Content-Type: application/json' --data-binary @request.json \
  http://127.0.0.1:18081/api/v1/accounts/login/api > response.json 2>/dev/null || return 1
 rm -f request.json
 jq -er '.data.accessToken.token' response.json > token 2>/dev/null || return 1
 jq -e --arg source "$SENDICO_SOURCE_ACCOUNT_REF" \
  '.data.accessToken.token | split(".")[1] | gsub("-";"+") | gsub("_";"/") | @base64d | fromjson | .id==$source and .pending!=true and .exp>(now+1500)' response.json >/dev/null 2>&1 || return 1
 cp token /run/sendico/access-token.new
 chmod 444 /run/sendico/access-token.new
 mv /run/sendico/access-token.new /run/sendico/access-token
 rm -f token response.json
 touch ready
}

while :; do
 if session; then
  echo 'Local Sendico session ready; next renewal in 20 minutes.'
  sleep 1200 & delay=$!; wait "$delay"
 else
  echo 'Local Sendico session unavailable; check stand health and integration credentials. Retrying in 5 minutes.' >&2
  rm -f request.json response.json token vault.header vault.json credentials.json login.json
  sleep 300 & delay=$!; wait "$delay"
 fi
done