#!/bin/bash
# ==============================================================================
# 03-configure-identity.sh
#
# Configure identity behavior for single-node sys-fips.
#
# Usage:
#   sudo bash 03-configure-identity.sh
# ==============================================================================
set -euo pipefail

CONFIG_FILE="/etc/fips/fips.yaml"

echo "=== FIPS Identity Configuration ==="
echo ""

if [ "$(id -u)" -ne 0 ]; then
    echo "✗ Run as root: sudo bash 03-configure-identity.sh"
    exit 1
fi

if [ ! -f "$CONFIG_FILE" ]; then
    echo "✗ $CONFIG_FILE not found"
    echo "  Run: sudo bash 02-install-fips.sh"
    exit 1
fi

if [ -f /etc/fips/fips.pub ]; then
    echo "Current identity detected:"
    echo "  npub: $(cat /etc/fips/fips.pub)"
    echo ""
fi

echo "Identity modes:"
echo "  1) persistent (recommended): key auto-generated once and reused"
echo "  2) explicit nsec: pin node identity to a specific key"
echo ""

read -r -p "Select mode [1/2] (default 1): " MODE
MODE="${MODE:-1}"

set_identity_block() {
    local identity_line="$1"
    local tmp
    tmp=$(mktemp)

    # Replace node.identity block in known config format: node: ... then tun:
    awk -v ident="$identity_line" '
        BEGIN { replaced=0; skipping=0 }
        /^node:[[:space:]]*$/ && replaced==0 {
            print "node:";
            print "  identity:";
            print "    " ident;
            replaced=1;
            skipping=1;
            next;
        }
        skipping==1 {
            if (/^tun:[[:space:]]*$/) {
                skipping=0;
                print $0;
            }
            next;
        }
        { print $0 }
    ' "$CONFIG_FILE" > "$tmp"

    mv "$tmp" "$CONFIG_FILE"
    chmod 600 "$CONFIG_FILE"
}

case "$MODE" in
    1)
        set_identity_block "persistent: true"
        echo "✓ Set node.identity.persistent=true"
        ;;
    2)
        read -r -p "Enter nsec (bech32 or 64-char hex): " NSEC
        if [ -z "$NSEC" ]; then
            echo "✗ Empty nsec is not allowed"
            exit 1
        fi
        set_identity_block "nsec: \"$NSEC\""
        echo "✓ Set node.identity.nsec"
        ;;
    *)
        echo "✗ Invalid selection"
        exit 1
        ;;
esac

echo ""
echo "Config updated: $CONFIG_FILE"
echo "Next: sudo bash 04-start-fips.sh"