#!/usr/bin/env bash
# One-time helper: populate SSM Parameter Store with production secrets.
# Run this AFTER Terraform apply creates the parameter paths.
# This script updates the placeholder values with real secrets.
#
# Usage: ./populate-ssm.sh
# Requires: AWS CLI configured with appropriate credentials
set -euo pipefail

PROJECT="${PROJECT:-helix}"
ENVIRONMENT="${ENVIRONMENT:-prod}"
REGION="${AWS_REGION:-ap-southeast-1}"

put_secret() {
  local name="$1" prompt="$2"
  read -rsp "${prompt}: " value
  echo
  if [[ -z "$value" ]]; then
    echo "  Skipped (empty)"
    return
  fi
  aws ssm put-parameter \
    --name "/${PROJECT}/${ENVIRONMENT}/${name}" \
    --value "$value" \
    --type SecureString \
    --overwrite \
    --region "$REGION" >/dev/null
  echo "  Set /${PROJECT}/${ENVIRONMENT}/${name}"
}

put_string() {
  local name="$1" prompt="$2" default="$3"
  read -rp "${prompt} [${default}]: " value
  value="${value:-$default}"
  aws ssm put-parameter \
    --name "/${PROJECT}/${ENVIRONMENT}/${name}" \
    --value "$value" \
    --type String \
    --overwrite \
    --region "$REGION" >/dev/null
  echo "  Set /${PROJECT}/${ENVIRONMENT}/${name}"
}

echo "=== Helix Production Secret Setup ==="
echo "Target: /${PROJECT}/${ENVIRONMENT}/* in ${REGION}"
echo

echo "── Database ──"
put_secret "DATABASE_URL" "DATABASE_URL (async, e.g. mysql+aiomysql://...)"
put_secret "DATABASE_URL_SYNC" "DATABASE_URL_SYNC (sync, e.g. mysql+pymysql://...)"
echo

echo "── Auth ──"
put_secret "JWT_SECRET_KEY" "JWT_SECRET_KEY (use: openssl rand -hex 32)"
put_secret "GOOGLE_CLIENT_ID" "GOOGLE_CLIENT_ID"
echo

echo "── Feishu ──"
put_secret "FEISHU_APP_ID" "FEISHU_APP_ID"
put_secret "FEISHU_APP_SECRET" "FEISHU_APP_SECRET"
put_string "FEISHU_APPROVAL_DATA_ACCESS_GROUP_GRANT_CODE" \
  "FEISHU_APPROVAL_DATA_ACCESS_GROUP_GRANT_CODE" ""
put_string "FEISHU_APPROVAL_DATA_ACCESS_SERVICE_ACCOUNT_GRANT_CODE" \
  "FEISHU_APPROVAL_DATA_ACCESS_SERVICE_ACCOUNT_GRANT_CODE" ""
put_string "FEISHU_APPROVAL_DATA_ACCESS_PERSONAL_GRANT_CODE" \
  "FEISHU_APPROVAL_DATA_ACCESS_PERSONAL_GRANT_CODE" ""
echo

echo "── SuccessFactors ──"
put_string "SUCCESSFACTORS_BASE_URL" "SUCCESSFACTORS_BASE_URL" "https://api15.sapsf.cn/odata/v2"
put_secret "SUCCESSFACTORS_USERNAME" "SUCCESSFACTORS_USERNAME"
put_secret "SUCCESSFACTORS_PASSWORD" "SUCCESSFACTORS_PASSWORD"
echo

echo "=== Done. Verify with: aws ssm get-parameters-by-path --path /${PROJECT}/${ENVIRONMENT}/ --region ${REGION} ==="