#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
OUT_FILE="$ROOT_DIR/.env"

read -r -p "DB password (for davos_prod on 192.168.7.11): " DB_PASSWORD
read -r -p "JWT secret (>=48 chars, press Enter to auto-generate): " JWT_SECRET
read -r -p "Admin email: " ADMIN_EMAIL
read -r -p "Admin password: " ADMIN_PASSWORD
read -r -p "Seed invite code (default DAVOS2026): " SEED_INVITE_CODE

if [[ -z "$SEED_INVITE_CODE" ]]; then
  SEED_INVITE_CODE="DAVOS2026"
fi

if [[ -z "$JWT_SECRET" ]]; then
  JWT_SECRET="$(openssl rand -base64 48 | tr -d '\n')"
fi

cat > "$OUT_FILE" <<EOF
POSTGRES_DB=davos_assessment
POSTGRES_USER=davos_prod
POSTGRES_PASSWORD=$DB_PASSWORD

DATABASE_URL=jdbc:postgresql://192.168.7.11:5432/davos_assessment
DATABASE_USERNAME=davos_prod
DATABASE_PASSWORD=$DB_PASSWORD

SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE=60
SPRING_DATASOURCE_HIKARI_MINIMUM_IDLE=20
SPRING_DATASOURCE_HIKARI_CONNECTION_TIMEOUT=60000
SERVER_TOMCAT_THREADS_MAX=220
SERVER_TOMCAT_THREADS_MIN_SPARE=20
SERVER_TOMCAT_ACCEPT_COUNT=200
HIBERNATE_JDBC_BATCH_SIZE=100

JWT_SECRET=$JWT_SECRET
JWT_EXPIRATION_MINUTES=720

ADMIN_EMAIL=$ADMIN_EMAIL
ADMIN_PASSWORD=$ADMIN_PASSWORD
SEED_INVITE_CODE=$SEED_INVITE_CODE

SEED_ADMIN_ENABLED=true
SEED_INVITE_ENABLED=true
ENFORCE_PRODUCTION_SECRETS=true
ALLOWED_ACTIVE_ASSESSMENTS=SCL90-2078,SDS-2082,SAS-2083

CORS_ALLOWED_ORIGINS=https://dws.dtacloud.cn
VITE_API_BASE_URL=https://dws.dtacloud.cn/api

AUDIT_LOG_RETENTION_DAYS=365
AUDIT_LOG_RETENTION_CRON=0 20 3 * * *
ALERT_WEBHOOK_URL=
ALERT_DB_CHECK_CRON=0 */5 * * * *
USER_AGREEMENT_VERSION=V1.0
PRIVACY_POLICY_VERSION=V1.0
ASSESSMENT_AUTHORIZATION_VERSION=V1.0
EOF

echo "Generated: $OUT_FILE"
echo "Next: upload package to 185 and run docker compose up -d --build"
