#!/bin/bash
# Generate Strong Secrets for SEEN Production Deployment
# 
# This script generates cryptographically secure random secrets
# for use in production environment configuration.

set -e

echo "==================================="
echo "SEEN - Secret Generation Tool"
echo "==================================="
echo ""

# Check if openssl is available
if ! command -v openssl &> /dev/null; then
  echo "ERROR: openssl is required but not installed."
  echo "Please install openssl and try again."
  exit 1
fi

echo "Generating secure secrets..."
echo ""

# Generate JWT secret (32 bytes = 256 bits)
JWT_SECRET=$(openssl rand -base64 32)
echo "JWT Secret (SEEN_AUTH_JWT_SECRET):"
echo "${JWT_SECRET}"
echo ""

# Generate database password (24 bytes)
DB_PASSWORD=$(openssl rand -base64 24 | tr -d "=+/" | cut -c1-32)
echo "Database Password (POSTGRES_PASSWORD):"
echo "${DB_PASSWORD}"
echo ""

# Generate cache password (optional, 24 bytes)
CACHE_PASSWORD=$(openssl rand -base64 24 | tr -d "=+/" | cut -c1-32)
echo "Cache Password (SEEN_CACHE_PASSWORD - optional):"
echo "${CACHE_PASSWORD}"
echo ""

# Generate session secret (32 bytes)
SESSION_SECRET=$(openssl rand -base64 32)
echo "Session Secret (for future use):"
echo "${SESSION_SECRET}"
echo ""

echo "==================================="
echo "IMPORTANT SECURITY NOTES:"
echo "==================================="
echo ""
echo "1. Store these secrets securely (password manager, secrets vault)"
echo "2. Never commit these secrets to version control"
echo "3. Use different secrets for each environment (dev/staging/prod)"
echo "4. Rotate secrets periodically (every 90 days recommended)"
echo "5. Update backend/.env.production with these values"
echo ""
echo "Quick setup command:"
echo "-----------------------------------"
echo "# Copy to production env file"
echo "cp backend/.env.production backend/.env.production.local"
echo ""
echo "# Then manually edit backend/.env.production.local and replace:"
echo "# - SEEN_AUTH_JWT_SECRET with the JWT Secret above"
echo "# - POSTGRES_PASSWORD with the Database Password above"
echo ""
echo "==================================="