import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
import { generateAuthSetupFiles, handleAuthSetup } from "../prompts/auth.ts";

export const authCommand = new Command()
  .description("Configure Auth Yes API")
  .option("--auto, --headless", "Run in headless mode")
  .option("--registry <reg:string>", "Container Registry URL")
  .option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
  .option("--domain <domain:string>", "Auth Domain Name")
  .option("--db-path <path:string>", "Database Path on the Host")
  .option("--spire-path <path:string>", "SPIRE Path on the Host")
  .action(async (options) => {
    const loadedEnv = await readEnv();
    const currentConfig: AuthSetupConfig = {
      ...DEFAULT_AUTH_CONFIG,
      ...loadedEnv,
    };

    if (options.auto) {
      if (!options.registry || !options.domain || !options.dbPath) {
        console.error(
          colors.red(
            "Error: --registry, --domain, and --db-path are required in headless mode.",
          ),
        );
        Deno.exit(1);
      }
      const dbPassword = Deno.env.get("POSTGRES_PASSWORD") ||
        currentConfig.dbPassword;
      const appSecret = Deno.env.get("APP_SECRET") || currentConfig.appSecret;
      if (!dbPassword) {
        console.error(
          colors.red(
            "Error: POSTGRES_PASSWORD environment variable is required in headless mode.",
          ),
        );
        Deno.exit(1);
      }
      if (!appSecret) {
        console.error(
          colors.red(
            "Error: APP_SECRET environment variable is required in headless mode.",
          ),
        );
        Deno.exit(1);
      }

      const newConfig: AuthSetupConfig = {
        reg: options.registry,
        ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
          "ghcr.atyg.org",
        domainName: options.domain,
        dbPassword,
        dbDataPath: options.dbPath || currentConfig.dbDataPath ||
          "/volume1/docker/auth-yes/data",
        spireDataPath: options.spirePath || currentConfig.spireDataPath ||
          "/volume1/docker/spire",
        appSecret,
      };
      await generateAuthSetupFiles(newConfig);
    } else {
      if (options.registry) currentConfig.reg = options.registry;
      if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
      if (options.domain) currentConfig.domainName = options.domain;
      if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
      if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
      await handleAuthSetup(currentConfig);
    }
  });