param(
  [Parameter(Mandatory = $true)][string]$ServerHost,
  [Parameter(Mandatory = $true)][string]$ServerUser,
  [Parameter(Mandatory = $true)][string]$SshKey,
  [Parameter(Mandatory = $true)][string]$ProjectRoot
)

$ErrorActionPreference = "Stop"

function New-Secret {
  -join (1..64 | ForEach-Object { "{0:x}" -f (Get-Random -Minimum 0 -Maximum 16) })
}

$apiDir = Join-Path $ProjectRoot "services\api"
$envPath = Join-Path $apiDir ".env"
$remote = "${ServerUser}@${ServerHost}"

$existing = @{}
if (Test-Path -LiteralPath $envPath) {
  Get-Content -LiteralPath $envPath | ForEach-Object {
    if ($_ -and -not $_.StartsWith("#") -and $_.Contains("=")) {
      $parts = $_.Split("=", 2)
      $existing[$parts[0].TrimStart([char]0xFEFF)] = $parts[1]
    }
  }
}

$masterKey = (& ssh.exe -i $SshKey $remote "grep '^MASTER_KEY=' /root/netmaker/netmaker.env | cut -d= -f2-").Trim()
if (-not $masterKey) {
  throw "MASTER_KEY was not found on the Netmaker server."
}

$djangoSecret = New-Secret
$jwtSecret = New-Secret
$feishuAppId = $existing["FEISHU_APP_ID"]
$feishuAppSecret = $existing["FEISHU_APP_SECRET"]

$content = @"
DJANGO_SECRET_KEY=$djangoSecret
DJANGO_DEBUG=true
DJANGO_ALLOWED_HOSTS=127.0.0.1,localhost,$ServerHost
CORS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost

FEISHU_APP_ID=$feishuAppId
FEISHU_APP_SECRET=$feishuAppSecret
FEISHU_REDIRECT_URI=http://127.0.0.1:8000/auth/feishu/callback
TAURI_DEEP_LINK_SCHEME=myvpn

JWT_SECRET=$jwtSecret
JWT_EXPIRES_SECONDS=600
OAUTH_STATE_EXPIRES_SECONDS=300
LOGIN_CODE_EXPIRES_SECONDS=120

NETMAKER_BASE_URL=https://api.vpn.abyssinfo.com
NETMAKER_API_TOKEN=$masterKey
NETMAKER_NETWORK_ID=homevpn
NETMAKER_ENROLLMENT_TAGS=homevpn,desktop,vpn
NETMAKER_ENROLLMENT_TTL_SECONDS=600
"@

[System.IO.File]::WriteAllText($envPath, $content, [System.Text.UTF8Encoding]::new($false))
Write-Host "[AbyssInfo] Wrote services\api\.env"