#!/usr/bin/env bash
# Generate a self-signed TLS cert for local HTTPS (Vite on :4308).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
CERT_DIR="${CERT_DIR:-$ROOT/certs}"
DAYS="${CERT_DAYS:-825}"
KEY="$CERT_DIR/key.pem"
CERT="$CERT_DIR/cert.pem"
CNF="$CERT_DIR/openssl.cnf"

mkdir -p "$CERT_DIR"

# Extra hostnames / IPs: ./scripts/generate-cert.sh 192.168.188.22 myhost.local
EXTRA=("$@")

SAN="DNS:localhost,IP:127.0.0.1"
for entry in "${EXTRA[@]}"; do
  if [[ "$entry" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    SAN+=",IP:$entry"
  else
    SAN+=",DNS:$entry"
  fi
done

# Include non-loopback IPv4 addresses so LAN / WebView origins work.
while read -r ip; do
  [[ -n "$ip" ]] || continue
  [[ "$SAN" == *",$ip"* || "$SAN" == *"IP:$ip"* ]] && continue
  SAN+=",IP:$ip"
done < <(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' || true)

cat >"$CNF" <<EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
x509_extensions = v3_req

[dn]
CN = localhost

[v3_req]
subjectAltName = $SAN
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
EOF

openssl req -x509 -newkey rsa:2048 -sha256 -days "$DAYS" -nodes \
  -keyout "$KEY" \
  -out "$CERT" \
  -config "$CNF"

chmod 600 "$KEY"
rm -f "$CNF"

# Base64(DER) — preferred QR payload (plain text, no JSON/URL/PEM wrappers).
DER_B64="$(openssl x509 -in "$CERT" -outform DER | base64 -w0)"
printf '%s\n' "$DER_B64" >"$CERT_DIR/cert.der.b64"

echo "Wrote $CERT"
echo "Wrote $KEY"
echo "Wrote $CERT_DIR/cert.der.b64"
echo "SAN: $SAN"
echo "Valid for $DAYS days."
echo
echo "=== certificate ==="
openssl x509 -in "$CERT" -noout -subject -issuer -dates -fingerprint -sha256 -ext subjectAltName
echo
echo "=== QR (base64 DER, raw payload) ==="
printf '%s' "$DER_B64" | node "$ROOT/scripts/qr-cert.mjs"
echo
echo "Start HTTPS: npm run dev:https"
echo "URL: https://localhost:4308/"