#!/bin/bash
# scripts/rotate-secrets.sh - Rotation interactive des secrets Docker Swarm
set -e

echo "🔐 ROTATION SECRETS DOCKER SWARM - FailDaily"
echo ""

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'

rotate_secret() {
  local SECRET_NAME=$1
  local NEW_VALUE=$2
  local SERVICE_NAME=$3

  echo -e "${YELLOW}⏳ Rotation de $SECRET_NAME...${NC}"
  local NEW_SECRET_NAME="${SECRET_NAME}_v$(date +%Y%m%d_%H%M%S)"
  echo "$NEW_VALUE" | docker secret create "$NEW_SECRET_NAME" -

  docker service update \
    --secret-rm "$SECRET_NAME" \
    --secret-add source="$NEW_SECRET_NAME",target="$SECRET_NAME" \
    "$SERVICE_NAME"

  echo "⏱️ Attente redémarrage du service..."
  sleep 10

  local REPLICAS
  REPLICAS=$(docker service ls --filter name="$SERVICE_NAME" --format "{{.Replicas}}")
  if [[ "$REPLICAS" == *"/"* ]]; then
    echo -e "${GREEN}✅ Service redémarré${NC}"
  else
    echo -e "${RED}❌ Erreur lors du redémarrage${NC}"
    return 1
  fi

  echo -e "${YELLOW}ℹ️ Ancien secret conservé 24h pour rollback (docker secret rm $SECRET_NAME)${NC}"
  echo ""
}

generate_jwt_secret() {
  node -e "console.log(require('crypto').randomBytes(64).toString('base64'))"
}

prompt_root_pass() {
  if [[ -z "$ROOT_PASS" ]]; then
    read -sp "MySQL ROOT password (pour mise à jour utilisateur DB): " ROOT_PASS
    echo ""
  fi
}

echo "Quel secret voulez-vous rotationner ?"
echo "1) JWT_SECRET"
echo "2) DB_PASSWORD"
echo "3) SMTP_PASS"
echo "4) OPENAI_API_KEY"
echo "5) TOUS les secrets"
read -p "Choix (1-5): " choice

case $choice in
  1)
    echo "🔄 Génération nouveau JWT_SECRET..."
    NEW_JWT=$(generate_jwt_secret)
    rotate_secret "jwt_secret" "$NEW_JWT" "faildaily_backend"
    echo "✅ Nouveau JWT_SECRET: $NEW_JWT"
    echo "⚠️  Sauvegardez ce secret dans Bitwarden."
    ;;

  2)
    prompt_root_pass
    read -sp "Nouveau DB_PASSWORD: " NEW_DB_PASS
    echo ""
    rotate_secret "db_password" "$NEW_DB_PASS" "faildaily_backend"
    echo "🔧 Mise à jour MySQL..."
    docker exec -i "$(docker ps -qf name=faildaily_mysql)" mysql -uroot -p"$ROOT_PASS" <<EOF
ALTER USER 'faildaily_user'@'%' IDENTIFIED BY '$NEW_DB_PASS';
FLUSH PRIVILEGES;
EOF
    echo "✅ MySQL mis à jour"
    ;;

  3)
    read -sp "Nouveau SMTP_PASS (OVH Manager): " NEW_SMTP_PASS
    echo ""
    rotate_secret "smtp_pass" "$NEW_SMTP_PASS" "faildaily_backend"
    ;;

  4)
    read -sp "Nouveau OPENAI_API_KEY: " NEW_OPENAI_KEY
    echo ""
    rotate_secret "openai_api_key" "$NEW_OPENAI_KEY" "faildaily_backend"
    ;;

  5)
    echo "🔄 ROTATION COMPLETE DE TOUS LES SECRETS"
    read -p "Êtes-vous sûr ? (yes/no): " confirm
    if [[ "$confirm" != "yes" ]]; then
      echo "❌ Annulé"
      exit 1
    fi

    prompt_root_pass

    NEW_JWT=$(generate_jwt_secret)
    rotate_secret "jwt_secret" "$NEW_JWT" "faildaily_backend"

    read -sp "Nouveau DB_PASSWORD: " NEW_DB_PASS
    echo ""
    rotate_secret "db_password" "$NEW_DB_PASS" "faildaily_backend"

    echo "🔧 Mise à jour MySQL..."
    docker exec -i "$(docker ps -qf name=faildaily_mysql)" mysql -uroot -p"$ROOT_PASS" <<EOF
ALTER USER 'faildaily_user'@'%' IDENTIFIED BY '$NEW_DB_PASS';
FLUSH PRIVILEGES;
EOF
    echo "✅ MySQL mis à jour"

    read -sp "Nouveau SMTP_PASS: " NEW_SMTP_PASS
    echo ""
    rotate_secret "smtp_pass" "$NEW_SMTP_PASS" "faildaily_backend"

    read -sp "Nouveau OPENAI_API_KEY: " NEW_OPENAI_KEY
    echo ""
    rotate_secret "openai_api_key" "$NEW_OPENAI_KEY" "faildaily_backend"

    echo "✅ ROTATION COMPLETE TERMINÉE"
    echo "⚠️  Sauvegarder les nouveaux secrets dans Bitwarden."
    echo "    JWT_SECRET: $NEW_JWT"
    ;;

  *)
    echo "❌ Choix invalide"
    exit 1
    ;;
esac

echo ""
echo "🎯 ROTATION TERMINÉE"
echo "Logs: docker service logs faildaily_backend"
echo "Statut: docker service ps faildaily_backend"