#!/usr/bin/env bash
# scripts/connect/connect-vagaro.sh — S7: Vagaro connect helper
#
# Connects Vagaro via REST API + webhooks.
# No public MCP exists for Vagaro — our services handle the integration.
#
# Allows: appointments, clients, services, staff.
# Denies: no scrape, no unofficial access.
#
# Platform-first: credentials via OpenShell provider store.
#
# Usage:
#   ./scripts/connect/connect-vagaro.sh [--dry-run|--apply]
#   ./scripts/connect/connect-vagaro.sh --help

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Source shared helpers
# shellcheck source=../lib/common.sh
source "$SCRIPT_DIR/../lib/common.sh"
# shellcheck source=../lib/env.sh
source "$SCRIPT_DIR/../lib/env.sh"
# shellcheck source=../lib/connect_state.sh
source "$SCRIPT_DIR/../lib/connect_state.sh"

# ── Defaults ───────────────────────────────────────────────────────────────
DRY_RUN=1
APPLY=0

# Vagaro API configuration
VAGARO_API_BASE="https://api.vagaro.com"
VAGARO_WEBHOOK_PORT="${LUMINA_VAGARO_WEBHOOK_PORT:-9876}"

# ── Parse args ─────────────────────────────────────────────────────────────
while [[ $# -gt 0 ]]; do
  case "$1" in
    --help|-h)
      cat <<EOF
Usage: $(basename "$0") [OPTIONS]

Connect Vagaro via REST API + webhooks.

Vagaro integration:
  API Base: $VAGARO_API_BASE
  Type: REST + webhooks (no public MCP)
  Webhook port: $VAGARO_WEBHOOK_PORT

Allowed operations:
  appointments, clients, services, staff

Denied:
  No scrape, no unofficial access

Options:
  --dry-run   Preview only (default)
  --apply     Execute mutations (prompts for Vagaro credentials)
  --help      Show this help

Safety:
  --dry-run is the default. Use --apply to perform mutations.
  Vagaro credentials are stored via OpenShell provider store — never in .env.
  No unofficial scraping — only documented REST API.

Examples:
  $(basename "$0") --dry-run
  $(basename "$0") --apply
EOF
      exit 0
      ;;
    --dry-run)
      DRY_RUN=1
      APPLY=0
      shift
      ;;
    --apply)
      DRY_RUN=0
      APPLY=1
      shift
      ;;
    *)
      log_error "Unknown argument: $1"
      exit 1
      ;;
  esac
done

# ── Load .env ──────────────────────────────────────────────────────────────
load_env

SANDBOX_NAME="$(get_sandbox_name)"

log_section "Vagaro Connect"

# ── Current state ──────────────────────────────────────────────────────────
current_status="$(get_status "vagaro")"
if [[ -n "$current_status" ]]; then
  log_info "Current status: $current_status"
fi

# ── Check prerequisites ────────────────────────────────────────────────────
require_cmd nemohermes "Install nemohermes CLI (part of NemoClaw platform)"

if ! nemohermes "$SANDBOX_NAME" status &>/dev/null 2>&1; then
  log_error "Sandbox '$SANDBOX_NAME' not found. Run S4 first."
  exit 1
fi

# ── Dry-run mode ───────────────────────────────────────────────────────────
if [[ $DRY_RUN -eq 1 ]]; then
  log_info "[DRY-RUN] Vagaro connect preview:"
  log_info ""
  log_info "  API Base:    $VAGARO_API_BASE"
  log_info "  Webhook:     port $VAGARO_WEBHOOK_PORT"
  log_info "  Sandbox:     $SANDBOX_NAME"
  log_info ""
  log_info "  Steps to connect:"
  log_info "    1. Owner creates Vagaro developer account at developer.vagaro.com"
  log_info "    2. Owner registers an application to get API credentials"
  log_info "    3. Owner configures webhook URL in Vagaro dashboard"
  log_info "    4. Operator stores credentials: openshell provider set vagaro-* <VALUES>"
  log_info "    5. Operator verifies API connectivity"
  log_info "    6. Webhook service started (compose or container)"
  log_info ""
  log_info "  To execute: $(basename "$0") --apply"
  exit 0
fi

# ── Apply mode ─────────────────────────────────────────────────────────────
log_info "Vagaro connect (apply mode):"
log_info ""
log_info "The owner must first:"
log_info "  1. Create a Vagaro developer account at developer.vagaro.com"
log_info "  2. Register an application to obtain API credentials"
log_info "  3. Configure webhook URL in the Vagaro dashboard"
log_info "  4. Provide credentials to the operator"
log_info ""

# Store credentials via OpenShell provider store
if ! openshell_available; then
  log_error "openshell not available. Cannot store credentials in provider store."
  log_error "Install openshell CLI, then re-run with --apply."
  set_status "vagaro" "error" "openshell not available — cannot store credentials"
  exit 1
fi

log_info "Storing Vagaro credentials in OpenShell provider store…"

local_api_key=""
local_api_secret=""
local_webhook_secret=""

# SECURITY: API key silenced to prevent shoulder-surfing and terminal-log leakage.
# NOTE: Credentials passed as CLI args to openshell are briefly visible in
# /proc/*/cmdline and ps output. This is a platform limitation of openshell
# which does not yet support --from-stdin for provider values.
read -rsp "Vagaro API Key: " local_api_key
echo ""
read -rsp "Vagaro API Secret: " local_api_secret
echo ""
read -rsp "Vagaro Webhook Secret (optional): " local_webhook_secret
echo ""

if [[ -z "$local_api_key" || -z "$local_api_secret" ]]; then
  log_warn "Incomplete Vagaro credentials. Skipping."
  set_status "vagaro" "skipped" "Operator skipped — incomplete credentials"
  exit 0
fi

# Store credentials (never echo them). Track failures.
store_fail=0
if openshell provider set vagaro-api-key "$local_api_key" 2>&1; then
  log_info "  vagaro-api-key stored."
else
  log_warn "  vagaro-api-key store failed — check openshell provider store."
  store_fail=1
fi
if openshell provider set vagaro-api-secret "$local_api_secret" 2>&1; then
  log_info "  vagaro-api-secret stored."
else
  log_warn "  vagaro-api-secret store failed — check openshell provider store."
  store_fail=1
fi
if [[ -n "$local_webhook_secret" ]]; then
  if openshell provider set vagaro-webhook-secret "$local_webhook_secret" 2>&1; then
    log_info "  vagaro-webhook-secret stored."
  else
    log_warn "  vagaro-webhook-secret store failed — check openshell provider store."
    store_fail=1
  fi
fi

if [[ $store_fail -eq 1 ]]; then
  log_warn "Some credentials failed to store. Verify with: openshell provider list"
fi

# Verify API connectivity (best-effort)
log_info "Verifying Vagaro API connectivity…"
if curl -sf --max-time 10 \
    -H "X-Vagaro-API-Key: $local_api_key" \
    "${VAGARO_API_BASE}/v1/me" &>/dev/null; then
  log_info "Vagaro API connectivity verified."
  set_status "vagaro" "connected" "Vagaro REST API connected"
else
  log_warn "Vagaro API verification failed (credentials may be incorrect or API unavailable)."
  log_warn "This may be non-fatal if the API requires specific scopes."
  set_status "vagaro" "error" "Vagaro API verification failed — check credentials"
fi

# Webhook guidance
log_info ""
log_info "Webhook service:"
log_info "  The Vagaro webhook receiver runs on port $VAGARO_WEBHOOK_PORT."
log_info "  Configure the webhook URL in the Vagaro dashboard:"
log_info "    https://<your-host>:$VAGARO_WEBHOOK_PORT/vagaro/webhook"
log_info "  Or add to deploy/compose/docker-compose.yml for managed lifecycle."

log_info "Vagaro connect complete."