#!/usr/bin/env bash
# Запрос токена привязки co-signer.
# Использование: ./pair_device_token.sh --api-key KEY --workspace UUID [--key private.pem]
set -euo pipefail

API_BASE=https://auth.pert.paranoid.security/api/v2
KEY=private.pem
while [[ $# -gt 0 ]]; do case "$1" in
  --api-key)   API_KEY=$2; shift 2 ;;
  --workspace) WORKSPACE_UUID=$2; shift 2 ;;
  --key)       KEY=$2; shift 2 ;;
  --api-base)  API_BASE=$2; shift 2 ;;
  *) shift ;;
esac; done
: "${API_KEY:?укажите --api-key}" "${WORKSPACE_UUID:?укажите --workspace}"

# payload + подпись над сырыми байтами JSON.
DATA_FILE=$(mktemp); trap 'rm -f "$DATA_FILE"' EXIT
printf '{"client_id":"%s","client_type":"user","nonce":"%s","timestamp":%d}' \
    "$API_KEY" "$(openssl rand -hex 16)" "$(date +%s)" > "$DATA_FILE"
DATA_B64=$(base64 < "$DATA_FILE" | tr -d '\n')
SIG_B64=$(openssl pkeyutl -sign -rawin -inkey "$KEY" -in "$DATA_FILE" | base64 | tr -d '\n')

# POST к API; при HTTP-ошибке печатает тело ответа и прерывает скрипт
api() {
  local out code body
  out=$(curl -sS -w '\n%{http_code}' "$@")
  code=${out##*$'\n'}; body=${out%$'\n'*}
  [[ $code == 2* ]] || { echo "ошибка API ($code): $body" >&2; exit 1; }
  printf '%s' "$body"
}

# 1. access-токен
ACCESS_TOKEN=$(api -X POST "$API_BASE/auth/access-token" \
    -H 'Content-Type: application/json' \
    -d "{\"data\":\"$DATA_B64\",\"signature\":\"$SIG_B64\"}" | jq -r .access_token)

# 2. инициируем привязку и получаем токен
PAIRING_TOKEN=$(api -X POST "$API_BASE/auth/devices/pairing/initiate" \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H 'Content-Type: application/json' \
    -d "{\"tenant_uuid\":\"$WORKSPACE_UUID\"}" | jq -r .pairing_token)

echo "$PAIRING_TOKEN"