#!/usr/bin/env bash
# Generate a self-signed dev PKI matching the PRODUCTION file layout: three files
# (leaf cert, CA chain, private key) so the dev and prod TLS paths are identical.
#
# It creates a 3-level chain (root -> intermediate -> leaf) so the served chain is
# leaf + intermediate, exactly like a real deployment. Output (gitignored):
#   dev-certs/tls.crt   leaf certificate            -> SSL_CERT_PATH
#   dev-certs/ca.crt    intermediate (+ root)       -> SSL_CA_PATH
#   dev-certs/tls.key   leaf private key (PKCS#8)   -> SSL_KEY_PATH
#
# Usage:   ./scripts/gen-dev-certs.sh [output-dir]
set -euo pipefail

OUT_DIR="${1:-dev-certs}"
DAYS_CA=3650
DAYS_LEAF=365
SUBJECT_CN="localhost"

command -v openssl >/dev/null 2>&1 || { echo "openssl is required" >&2; exit 1; }
mkdir -p "$OUT_DIR"
cd "$OUT_DIR"

echo "==> Root CA"
openssl genrsa -out root.key 4096 2>/dev/null
openssl req -x509 -new -nodes -key root.key -sha256 -days "$DAYS_CA" \
  -subj "/CN=Demo Dev Root CA" -out root.crt

echo "==> Intermediate CA (signed by root)"
openssl genrsa -out intermediate.key 4096 2>/dev/null
openssl req -new -key intermediate.key -subj "/CN=Demo Dev Intermediate CA" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key -CAcreateserial \
  -days "$DAYS_CA" -sha256 \
  -extfile <(printf "basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\n") \
  -out intermediate.crt

echo "==> Leaf certificate (signed by intermediate), SAN=$SUBJECT_CN,127.0.0.1"
openssl genrsa -out leaf.key 2048 2>/dev/null
openssl req -new -key leaf.key -subj "/CN=$SUBJECT_CN" -out leaf.csr
openssl x509 -req -in leaf.csr -CA intermediate.crt -CAkey intermediate.key -CAcreateserial \
  -days "$DAYS_LEAF" -sha256 \
  -extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:%s,IP:127.0.0.1\n" "$SUBJECT_CN") \
  -out leaf.crt

echo "==> Assembling the three production-shaped files"
cp leaf.key tls.key                 # SSL_KEY_PATH  (PKCS#8/PKCS#1 both accepted)
cp leaf.crt tls.crt                 # SSL_CERT_PATH (leaf only)
cat intermediate.crt root.crt > ca.crt   # SSL_CA_PATH (intermediate first; root optional)
chmod 600 tls.key

# Clean up intermediates that are not part of the runtime trio.
rm -f *.csr *.srl root.key intermediate.key leaf.key leaf.crt intermediate.crt

echo
echo "Done. Point the app at these (paths can live anywhere):"
echo "  export SSL_ENABLED=true"
echo "  export SSL_CERT_PATH=\"$(pwd)/tls.crt\""
echo "  export SSL_CA_PATH=\"$(pwd)/ca.crt\""
echo "  export SSL_KEY_PATH=\"$(pwd)/tls.key\""
echo
echo "Trust root.crt in your client to verify the chain:"
echo "  openssl verify -CAfile <(cat $(pwd)/ca.crt $(pwd)/root.crt) $(pwd)/tls.crt"