#!/bin/bash
# ==============================================================================
# OVH Private Database IP-Autorisierung (automatische Endpoint-Erkennung)
# Getestet unter macOS Sequoia/Sonoma
# ==============================================================================

# ----------------------------------------------------------------------
# 1. KONFIGURATION
# ----------------------------------------------------------------------
APP_KEY="efe3cffcbf94b221"
APP_SECRET="1b68344408b2128698e515fdb9db31b2"
CONSUMER_KEY="1ee683c05e88273d1d12fc162de61ae3"
SERVICE_NAME="kh122999-001"

# API Basis
BASE_URL="https://api.ovh.com/1.0"
HTTP_METHOD="POST"

# ----------------------------------------------------------------------
# 2. ÖFFENTLICHE IP ABRUFEN
# ----------------------------------------------------------------------
CURRENT_IP=$(curl -s -4 https://ipinfo.io/ip)
if [[ -z "$CURRENT_IP" ]]; then
    echo "$(date): ❌ FEHLER: Konnte aktuelle IP nicht abrufen." >&2
    exit 1
fi
CIDR_IP="${CURRENT_IP}/32"
JSON_BODY=$(printf '{"ip":"%s"}' "$CIDR_IP")

# ----------------------------------------------------------------------
# 3. TIMESTAMP VOM OVH-SERVER HOLEN
# ----------------------------------------------------------------------
TIMESTAMP=$(curl -s https://api.ovh.com/1.0/auth/time)
if [[ -z "$TIMESTAMP" ]]; then
    echo "⚠️  Konnte keinen OVH-Timestamp abrufen, nutze lokale Zeit."
    TIMESTAMP=$(date +%s)
fi

# ----------------------------------------------------------------------
# 4. FUNKTION: SIGNATUR ERSTELLEN
# ----------------------------------------------------------------------
make_signature() {
    local signature_string="${APP_SECRET}+${CONSUMER_KEY}+${HTTP_METHOD}+${1}+${JSON_BODY}+${TIMESTAMP}"
    echo -n "$signature_string" | shasum -a 1 | awk '{print $1}'
}

# ----------------------------------------------------------------------
# 5. ENDPOINT AUTOMATISCH FINDEN
# ----------------------------------------------------------------------
CANDIDATE_PATHS=(
    "/hosting/privateDatabase/${SERVICE_NAME}/allowedIP"
    "/hosting/privateDatabase/${SERVICE_NAME}/authorizedIP"
    "/privateDatabase/${SERVICE_NAME}/authorizedIP"
)

WORKING_URL=""

echo "🔍 Prüfe gültigen OVH-Endpunkt für ${SERVICE_NAME} ..."

for path in "${CANDIDATE_PATHS[@]}"; do
    TEST_URL="${BASE_URL}${path}"
    SIGNATURE=$(make_signature "$TEST_URL")

    # Sende einen HEAD-Request (GET mit limitierter Antwort)
    RESPONSE=$(curl -s -X GET \
      -H "X-Ovh-Application: ${APP_KEY}" \
      -H "X-Ovh-Timestamp: ${TIMESTAMP}" \
      -H "X-Ovh-Signature: \$1\$${SIGNATURE}" \
      -H "X-Ovh-Consumer: ${CONSUMER_KEY}" \
      "${TEST_URL}")

    if echo "$RESPONSE" | grep -q "${SERVICE_NAME}"; then
        WORKING_URL="$TEST_URL"
        echo "✅ Gefunden: $TEST_URL"
        break
    fi
done

if [[ -z "$WORKING_URL" ]]; then
    echo "❌ Kein gültiger OVH-Endpunkt gefunden. Bitte API-URL manuell prüfen!" >&2
    exit 1
fi

# ----------------------------------------------------------------------
# 6. SIGNATUR FÜR DEN POST-REQUEST ERSTELLEN
# ----------------------------------------------------------------------
SIGNATURE=$(make_signature "$WORKING_URL")

# ----------------------------------------------------------------------
# 7. IP AUTORISIEREN
# ----------------------------------------------------------------------
echo "🌐 Aktuelle IP: ${CIDR_IP}"
echo "➡️  Sende POST-Request an:"
echo "   ${WORKING_URL}"

API_RESPONSE=$(curl -s -X "$HTTP_METHOD" \
  -H "X-Ovh-Application: ${APP_KEY}" \
  -H "X-Ovh-Timestamp: ${TIMESTAMP}" \
  -H "X-Ovh-Signature: \$1\$${SIGNATURE}" \
  -H "X-Ovh-Consumer: ${CONSUMER_KEY}" \
  -H "Content-Type: application/json" \
  --data "${JSON_BODY}" \
  "${WORKING_URL}")

# ----------------------------------------------------------------------
# 8. ANTWORT AUSWERTEN
# ----------------------------------------------------------------------
if echo "$API_RESPONSE" | grep -q "is already authorized"; then
    echo "✅ IP ${CIDR_IP} ist bereits autorisiert."
elif echo "$API_RESPONSE" | grep -q "\"ip\""; then
    echo "✅ IP ${CIDR_IP} erfolgreich hinzugefügt."
    echo "Antwort: $API_RESPONSE"
else
    echo "❌ FEHLER beim Hinzufügen der IP." >&2
    echo "Antwort von OVH:" >&2
    echo "$API_RESPONSE" >&2
    echo "--- DEBUG ---" >&2
    echo "Verwendeter Endpoint: $WORKING_URL" >&2
    echo "Signaturkette:" >&2
    echo "${APP_SECRET}+${CONSUMER_KEY}+${HTTP_METHOD}+${WORKING_URL}+${JSON_BODY}+${TIMESTAMP}" >&2
    exit 1
fi