<?php

declare(strict_types=1);

require_once __DIR__ . '/../../../../src/Core/Db.php';
require_once __DIR__ . '/../../../../src/Core/TokenManager.php';

use Deploymentcenter\Core\Db;
use Deploymentcenter\Core\TokenManager;

header('Content-Type: application/json; charset=utf-8');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['status' => 'error', 'message' => 'Method Not Allowed']);
    exit;
}

// Extract Master Token from Headers
$headers = getallheaders();
$masterToken = $headers['X-Master-Token'] ?? $headers['x-master-token'] ?? null;

if (!$masterToken && !empty($headers['Authorization'])) {
    if (preg_match('/Bearer\s+(.+)/i', $headers['Authorization'], $matches)) {
        $masterToken = trim($matches[1]);
    }
}

$rawInput = file_get_contents('php://input');
$data = json_decode($rawInput, true) ?: $_POST;

if (!$masterToken && !empty($data['master_token'])) {
    $masterToken = trim($data['master_token']);
}

if (!$masterToken) {
    http_response_code(401);
    echo json_encode(['status' => 'error', 'message' => 'Missing Master Token in X-Master-Token header or Authorization Bearer header']);
    exit;
}

try {
    $config = require __DIR__ . '/../../../../config/config.php';
    $db = Db::connect($config['db']);
    $tokenMgr = new TokenManager($db);

    $name = !empty($data['client_name']) ? trim($data['client_name']) : (!empty($data['name']) ? trim($data['name']) : 'Auto-Provisioned Agent Sub-Token');
    $instanceIdentity = !empty($data['instance_id']) ? trim($data['instance_id']) : (!empty($data['hostname']) ? trim($data['hostname']) : null);
    $requestedScopes = isset($data['scopes']) && is_array($data['scopes']) ? $data['scopes'] : [];
    $environment = !empty($data['environment']) ? trim($data['environment']) : 'all';

    $subTokenData = $tokenMgr->provisionSubToken(
        $masterToken,
        $name,
        $instanceIdentity,
        $requestedScopes,
        $environment
    );

    echo json_encode([
        'status'       => 'success',
        'sub_token'    => $subTokenData['raw_token'],
        'token_id'     => $subTokenData['token_id'],
        'name'         => $subTokenData['name'],
        'scopes'       => $subTokenData['scopes'],
        'environment'  => $subTokenData['environment'],
        'type'         => 'sub',
        'created_at'   => date('Y-m-d H:i:s'),
    ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);

} catch (InvalidArgumentException $e) {
    http_response_code(400);
    echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
} catch (Throwable $t) {
    http_response_code(500);
    echo json_encode(['status' => 'error', 'message' => 'Internal server error: ' . $t->getMessage()]);
}