#!/usr/bin/env python3
"""
provision-agent.py — Playwright automation for AI agent identity provisioning.

Enrolls AI agent identities in Cloudron, logs into Gitea/Discourse/Redmine via
SSO, generates API keys, and stores all credentials in Bitwarden.

Usage:
    python3 provision-agent.py                       # provision all agents in manifest
    python3 provision-agent.py --agent vp-techops    # provision one agent
    python3 provision-agent.py --phase1-only         # Cloudron enrollment only
    python3 provision-agent.py --dry-run             # validate manifest without browser

Manifest: agents.yaml (see agents.yaml.example)

See: ~/Q3/agent-identity-bootstrap.md for the full architecture.
"""

import argparse
import json
import logging
import os
import re
import sys
import time
from pathlib import Path

import yaml
from playwright.sync_api import BrowserContext, Page, sync_playwright

from bw_helper import BitwardenHelper

# ---------------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------------

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    datefmt="%H:%M:%S",
)
log = logging.getLogger("provision")

# ---------------------------------------------------------------------------
# Constants
# ---------------------------------------------------------------------------

CLOUDRON_BASE = os.environ.get("CLOUDRON_BASE", "https://my.knownelement.com")
GITEA_URL = os.environ.get("GITEA_URL", "https://git.knownelement.com")
DISCOURSE_URL = os.environ.get("DISCOURSE_URL", "https://community.turnsys.com")
REDMINE_URL = os.environ.get("REDMINE_URL", "https://projects.knownelement.com")

STATE_DIR = Path("/app/state")


def _debug_dump(page: Page, label: str) -> None:
    """Save screenshot + DOM dump for debugging selector issues."""
    STATE_DIR.mkdir(parents=True, exist_ok=True)
    ts = time.strftime("%H%M%S")
    screenshot_path = STATE_DIR / f"debug-{label}-{ts}.png"
    dom_path = STATE_DIR / f"debug-{label}-{ts}.txt"
    try:
        page.screenshot(path=str(screenshot_path), full_page=True)
    except Exception:
        pass
    try:
        elements = page.evaluate("""() => {
            const results = [];
            document.querySelectorAll('input, button, select, textarea, label, h2, h3, h4, h5, code, .ui.header, .ui.message, [data-tab], .tw-font-semibold').forEach(el => {
                const tag = el.tagName.toLowerCase();
                const text = el.textContent.trim().substring(0, 80);
                const id = el.id || '';
                const name = el.getAttribute('name') || '';
                const type = el.getAttribute('type') || '';
                const value = el.getAttribute('value') || '';
                const cls = (el.className || '').substring(0, 50);
                if (text || id || name || type || value) results.push(`<${tag}> id=${id} name=${name} type=${type} value=${value} class=${cls} text="${text}"`);
            });
            return results.join('\\n');
        }""")
        dom_path.write_text(f"URL: {page.url}\\n\\n{elements}")
        log.info(f"  Debug dump saved: {screenshot_path.name}, {dom_path.name}")
    except Exception as e:
        log.warning(f"  Debug dump failed: {e}")

# ---------------------------------------------------------------------------
# Cloudron enrollment
# ---------------------------------------------------------------------------


def enroll_cloudron(
    page: Page,
    agent: dict,
    bw: BitwardenHelper,
) -> dict:
    """
    Phase 1: Accept Cloudron invite, set password, enable 2FA.

    Returns a dict with the agent's Cloudron credentials.
    """
    name = agent["name"]
    invite_url = agent["cloudron_invite"]
    display_name = agent.get("display_name", name)

    log.info(f"[{name}] Phase 1: Cloudron enrollment — {invite_url}")

    # Check if already provisioned
    item_name = f"{name} Cloudron"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Cloudron credential already exists in Bitwarden — skipping")
        cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
        return {
            "username": cloudron_email,
            "password": bw.get_item_password(item_name),
        }

    # Generate a strong password
    password = bw.generate_password(length=32)
    log.info(f"[{name}] Generated password ({len(password)} chars)")

    # Navigate to invite link
    # Proven selectors (session 3 DOM dump of setupaccount.html):
    #   #inputUsername (prefilled from invite), #inputDisplayName,
    #   #inputPassword, #inputPasswordRepeat,
    #   submit = <div role="button"> "Set up" (disabled until form valid)
    page.goto(invite_url, wait_until="networkidle")
    page.wait_for_timeout(2000)

    page.wait_for_selector("#inputPassword", timeout=15000)

    # Pankow/Vue forms need click + keyboard.type, never fill()
    page.click("#inputDisplayName")
    page.keyboard.type(display_name)
    page.click("#inputPassword")
    page.keyboard.type(password)
    page.click("#inputPasswordRepeat")
    page.keyboard.type(password)

    # Submit button is a div[role=button]; starts disabled, enables on valid input
    setup_btn = page.locator('[role="button"]:has-text("Set up")')
    page.wait_for_timeout(1000)
    if setup_btn.count() > 0 and setup_btn.first.is_visible():
        setup_btn.first.click()
    else:
        log.warning(f"[{name}] Set up button not found/clickable, pressing Enter")
        page.keyboard.press("Enter")

    page.wait_for_timeout(5000)
    log.info(f"[{name}] Invite accepted")

    # Enable 2FA
    totp_secret = enable_cloudron_2fa(page, agent, bw)

    # Store credential in Bitwarden
    cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
    bw.create_item(
        name=item_name,
        username=cloudron_email,
        password=password,
        uris=[CLOUDRON_BASE],
        collection_name=name,
        totp_secret=totp_secret,
    )
    log.info(f"[{name}] Cloudron credential stored in Bitwarden (collection: {name})")

    return {"username": cloudron_email, "password": password, "totp_secret": totp_secret}


def enable_cloudron_2fa(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """
    Enable TOTP 2FA on a Cloudron account via the profile page.

    Cloudron's 2FA enrollment flow (discovered via DOM dump):
    1. Navigate to #/profile
    2. Click "Setup" to start 2FA enrollment
    3. Cloudron defaults to Passkey -- click "switchToTotp" to switch
    4. TOTP secret appears in page text (base32 encoded)
    5. Enter TOTP code in #totpTokenInput, click Enable

    Returns the TOTP secret (empty string if already enabled or failed).
    """
    name = agent["name"]
    log.info(f"[{name}] Enabling 2FA on Cloudron account")

    # Fresh accounts sit on setupaccount.html ("Your account is ready") --
    # hash navigation cannot leave that page. Load the panel root first.
    if "setupaccount" in page.url:
        page.goto(f"{CLOUDRON_BASE}/", wait_until="networkidle", timeout=20000)
        page.wait_for_timeout(3000)

    page.evaluate('() => window.location.hash = "#/profile"')
    page.wait_for_timeout(3000)

    # If profile didn't load, try clicking the profile nav link
    if "#/profile" not in page.url:
        for nav_text in ["Profile", "Settings", "Account"]:
            sec_link = page.locator(f'a[href*="#/profile"], a:has-text("{nav_text}")')
            if sec_link.count() > 0:
                sec_link.first.click()
                page.wait_for_timeout(3000)
                break

    _debug_dump(page, f"cloudron-profile-{name}")

    # Check if 2FA is already enabled
    page_text = page.evaluate("() => document.body.innerText")
    if "totp" in page_text.lower() and "enabled" in page_text.lower():
        log.info(f"[{name}] 2FA already enabled on Cloudron")
        return ""

    # Step 1: Click "Setup" to start 2FA enrollment
    # (forced-enrollment screen says "Set up passkey"; profile says "Setup")
    setup_clicked = False
    for selector in [
        'text=Setup',
        'text=Set up',
        '[role="button"]:has-text("Setup")',
        '[role="button"]:has-text("Set up")',
        'button:has-text("Setup")',
        'button:has-text("Set up")',
        'a:has-text("Setup")',
    ]:
        loc = page.locator(selector)
        if loc.count() > 0 and loc.first.is_visible():
            loc.first.click()
            page.wait_for_timeout(3000)
            setup_clicked = True
            break

    if not setup_clicked:
        log.warning(f"[{name}] Could not find 2FA Setup button")
        _debug_dump(page, f"cloudron-2fa-no-setup-{name}")
        return ""

    # Step 2: Switch from Passkey to TOTP mode
    page_text = page.evaluate("() => document.body.innerText")
    if "switchToTotp" in page_text or "Passkey" in page_text:
        for selector in [
            'text=switchToTotp',
            'text=profile.enable2FA.switchToTotp',
            'a:has-text("TOTP")',
            '[role="button"]:has-text("TOTP")',
        ]:
            loc = page.locator(selector)
            if loc.count() > 0 and loc.first.is_visible():
                loc.first.click()
                page.wait_for_timeout(3000)
                break

    _debug_dump(page, f"cloudron-2fa-totp-mode-{name}")

    # Step 3: Extract TOTP secret (base32 string in page text)
    import re
    page_text = page.evaluate("() => document.body.innerText")
    totp_secret = ""

    # Look in code/pre elements first
    for el in page.query_selector_all("code, pre"):
        text = el.text_content().strip().replace(" ", "")
        if text and re.match(r'^[A-Z2-7=]+$', text):
            totp_secret = text
            break

    # Fall back to regex in page text
    if not totp_secret:
        matches = re.findall(r'[A-Z2-7]{16,}=?', page_text.replace(" ", ""))
        if matches:
            totp_secret = matches[0]

    if not totp_secret:
        log.error(f"[{name}] Could not extract TOTP secret")
        _debug_dump(page, f"cloudron-2fa-no-secret-{name}")
        return ""

    log.info(f"[{name}] Extracted TOTP secret: {totp_secret[:4]}...")

    # Step 4: Enter TOTP confirmation code
    import pyotp
    totp_code = pyotp.TOTP(totp_secret).now()

    token_input = page.query_selector("#totpTokenInput")
    if not token_input:
        for sel in ['input[name="totpToken"]', 'input[type="text"]:visible']:
            loc = page.locator(sel)
            if loc.count() > 0 and loc.first.is_visible():
                token_input = loc.first.element_handle()
                break

    if token_input:
        token_input.click()
        page.keyboard.type(totp_code)
        page.wait_for_timeout(500)

        # Click Enable/Confirm button
        for btn_text in ["Enable", "Confirm", "Verify", "OK", "Save"]:
            loc = page.locator(f'[role="button"]:has-text("{btn_text}"), button:has-text("{btn_text}")')
            if loc.count() > 0 and loc.first.is_visible():
                loc.first.click()
                break
        page.wait_for_timeout(3000)
        log.info(f"[{name}] 2FA confirmation submitted")
    else:
        log.warning(f"[{name}] Could not find TOTP confirmation input")
        _debug_dump(page, f"cloudron-2fa-no-input-{name}")

    return totp_secret


def decode_qr_from_base64(data_uri: str) -> str:
    """Decode a TOTP secret from a base64 QR code data URI."""
    import base64
    import io

    from PIL import Image
    from pyzbar.pyzbar import decode

    # Extract base64 data from data URI
    header, b64data = data_uri.split(",", 1)
    img_bytes = base64.b64decode(b64data)
    img = Image.open(io.BytesIO(img_bytes))

    decoded = decode(img)
    if decoded:
        # TOTP URIs look like: otpauth://totp/Label?secret=XXXX&...
        uri = decoded[0].data.decode()
        if "secret=" in uri:
            return uri.split("secret=")[1].split("&")[0]

    raise RuntimeError("Could not decode TOTP secret from QR code")


# ---------------------------------------------------------------------------
# System access (Phase 2)
# ---------------------------------------------------------------------------


def cloudron_panel_login(page: Page, agent: dict, bw: BitwardenHelper) -> bool:
    """
    Login to the Cloudron panel to establish an SSO session.

    Once authenticated to the Cloudron panel, subsequent SSO flows to
    Cloudron-managed apps (Gitea, Redmine, Discourse, etc.) auto-approve
    without requiring a separate consent click.

    Returns True if login succeeded or session already active.
    """
    name = agent["name"]
    cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
    cloudron_item = f"{name} Cloudron"
    password = bw.get_item_password(cloudron_item)

    log.info(f"[{name}] Establishing Cloudron panel session")

    page.goto(f"{CLOUDRON_BASE}/login.html", wait_until="networkidle", timeout=15000)
    page.wait_for_timeout(2000)

    # Already logged in? (must be on the panel, not redirected to OIDC)
    if "login" not in page.url.lower() and "openid" not in page.url.lower():
        log.info(f"[{name}] Cloudron panel session already active")
        return True

    # If redirected to OIDC login page, fill that too
    # (Cloudron login.html and OIDC login look similar, both use #inputUsername/#inputPassword)

    # Fill Cloudron login form (Pankow/Vue needs keyboard events, not fill())
    page.wait_for_selector("#inputPassword", timeout=15000)
    page.click("#inputUsername")
    page.keyboard.type(cloudron_email)
    page.click("#inputPassword")
    page.keyboard.type(password)

    # Submit: Cloudron Pankow UI uses <div role="button"> instead of <button>.
    submitted = False
    for text in ["Log in", "Sign in", "Submit", "Continue"]:
        btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
        if btn.count() > 0 and btn.first.is_visible():
            btn.first.click()
            submitted = True
            break
    if not submitted:
        page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
        submitted = True
    page.wait_for_timeout(5000)

    # Handle TOTP if prompted (Cloudron OIDC uses #inputTotpToken, not #inputTotp)
    totp_input = page.query_selector("#inputTotpToken")
    if totp_input and totp_input.is_visible():
        totp_code = bw.get_totp(cloudron_item)
        totp_input.click()
        page.keyboard.type(totp_code)
        # Cloudron TOTP submit button has specific ID
        submit = page.locator('#totpTokenSubmitButton')
        if submit.count() == 0:
            for text in ["Log in", "Sign in", "Submit", "Continue"]:
                submit = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                if submit.count() > 0 and submit.first.is_visible():
                    break
        if submit.count() > 0:
            submit.first.click()
        else:
            page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
        page.wait_for_timeout(5000)

    # After submit, check if we're past the login form.
    # The OIDC flow stays on /openid/interaction/... but changes from
    # login form to consent page. Check for absence of password field.
    page.wait_for_timeout(3000)
    has_password = page.query_selector('#inputPassword')
    if not has_password or not has_password.is_visible():
        log.info(f"[{name}] Cloudron panel login successful")
        return True

    # Handle consent/authorize page if present
    for consent_text in ["Continue", "Authorize", "Allow", "Accept"]:
        consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}")')
        if consent_btn.count() > 0 and consent_btn.first.is_visible():
            consent_btn.first.click()
            page.wait_for_timeout(5000)
            break

    has_password = page.query_selector('#inputPassword')
    if not has_password or not has_password.is_visible():
        log.info(f"[{name}] Cloudron panel login successful")
        return True

    log.error(f"[{name}] Cloudron panel login failed (still on login page: {page.url})")
    return False


def sso_login(page: Page, system_url: str, agent: dict, bw: BitwardenHelper,
              sso_button_selector: str = "") -> bool:
    """
    Log into a Cloudron-managed app via SSO.

    Requires an active Cloudron panel session (call cloudron_panel_login first).
    Clicks the SSO/OAuth button on the app's login page, which redirects
    through Cloudron's OIDC provider and back to the app authenticated.

    Args:
        sso_button_selector: CSS selector for the SSO button. If empty,
            tries common patterns (oauth2 link, "cloudron" text, etc.).

    Returns True if login succeeded.
    """
    name = agent["name"]
    log.info(f"[{name}] SSO login: {system_url}")

    page.goto(system_url, wait_until="networkidle")
    page.wait_for_timeout(2000)

    # Already authenticated?
    if not page.query_selector('input[type="password"]'):
        log.info(f"[{name}] Already authenticated at {system_url}")
        return True

    # Click the SSO/OAuth button
    sso_clicked = False

    if sso_button_selector:
        btn = page.locator(sso_button_selector)
        if btn.count() > 0:
            btn.first.click()
            sso_clicked = True

    if not sso_clicked:
        for selector in [
            'a[href*="oauth2/cloudron"]',
            'a[href*="oauth"]',
            'button[id*="login-oauth"]',
            'a:has-text("cloudron")',
            'a:has-text("Cloud")',
            'button:has-text("cloudron")',
            'button:has-text("Cloud")',
        ]:
            btn = page.locator(selector)
            if btn.count() > 0 and btn.first.is_visible():
                btn.first.click()
                sso_clicked = True
                break

    if not sso_clicked:
        log.error(f"[{name}] Could not find SSO button at {system_url}")
        _debug_dump(page, f"sso-no-button-{name}")
        return False

    page.wait_for_timeout(5000)
    log.info(f"[{name}] SSO redirect: {page.url}")

    # Handle Cloudron OIDC login page if redirected.
    # The OIDC page may show: (a) a login form, (b) a consent page,
    # or (c) nothing visible (auto-redirect). Handle all three.
    if "openid" in page.url or "interaction" in page.url:
        page.wait_for_timeout(2000)

        has_login_form = page.query_selector("#inputPassword")
        if has_login_form and has_login_form.is_visible():
            log.info(f"[{name}] Handling Cloudron OIDC login")
            cloudron_email = agent.get("cloudron_email", f"{name}@turnsys.com")
            cloudron_item = f"{name} Cloudron"
            password = bw.get_item_password(cloudron_item)

            page.click("#inputUsername")
            page.keyboard.type(cloudron_email)
            page.click("#inputPassword")
            page.keyboard.type(password)

            for text in ["Log in", "Sign in", "Submit", "Continue"]:
                btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                if btn.count() > 0 and btn.first.is_visible():
                    btn.first.click()
                    break
            else:
                page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
            page.wait_for_timeout(5000)

            # Handle TOTP if prompted
            totp_input = page.query_selector("#inputTotp")
            if totp_input and totp_input.is_visible():
                totp_code = bw.get_totp(cloudron_item)
                totp_input.fill(totp_code)
                for text in ["Log in", "Sign in", "Submit", "Continue"]:
                    btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
                    if btn.count() > 0 and btn.first.is_visible():
                        btn.first.click()
                        break
                page.wait_for_timeout(5000)
        else:
            log.info(f"[{name}] OIDC session active — looking for consent")

        # Try to find and click any consent/authorize button.
        # The OIDC page may require explicit consent even when authenticated.
        page.wait_for_timeout(2000)
        for consent_text in ["Continue", "Authorize", "Allow", "Accept", "Approve"]:
            consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}"), input[value="{consent_text}"]')
            if consent_btn.count() > 0:
                log.info(f"[{name}] Clicking OIDC consent: {consent_text}")
                consent_btn.first.click(force=True)
                page.wait_for_timeout(5000)
                break
        else:
            # No consent button found — try submitting any form on the page
            # (OIDC auto-approve may need a form POST)
            page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
            page.wait_for_timeout(5000)

    page.wait_for_timeout(3000)
    log.info(f"[{name}] SSO result: {page.url}")

    # Verify we're back on the target app (not stuck on OIDC/login)
    if "openid" in page.url or "interaction" in page.url:
        log.error(f"[{name}] SSO login failed (stuck on OIDC page)")
        _debug_dump(page, f"sso-stuck-{name}")
        return False

    if "login" in page.url.lower():
        log.error(f"[{name}] SSO login failed (still on login page)")
        _debug_dump(page, f"sso-failed-{name}")
        return False

    log.info(f"[{name}] SSO login successful")
    return True


def provision_gitea(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """Generate a Gitea API token via SSO login. Returns the token."""
    name = agent["name"]
    systems = agent.get("systems", {})
    gitea_cfg = systems.get("gitea", {})

    if not gitea_cfg:
        log.info(f"[{name}] No Gitea config — skipping")
        return ""

    item_name = f"{name} Gitea"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Gitea token already exists — skipping")
        return bw.get_item_password(item_name)

    url = gitea_cfg.get("url", GITEA_URL)
    token_name = gitea_cfg.get("token_name", f"{name}-api")

    sso_login(page, f"{url}/user/login", agent, bw,
              sso_button_selector='a[href*="oauth2/cloudron"]')

    # Navigate to API token settings
    page.goto(f"{url}/user/settings/applications", wait_until="domcontentloaded")
    page.wait_for_timeout(3000)
    _debug_dump(page, f"gitea-settings-{name}")

    # Generate new token — the input may not be visible to Playwright
    # (behind flash message or in collapsed section). Use JS to fill.
    page.evaluate(f"""() => {{
        const input = document.querySelector('#name');
        if (input) {{
            input.value = '{token_name}';
            input.dispatchEvent(new Event('input', {{bubbles: true}}));
            input.dispatchEvent(new Event('change', {{bubbles: true}}));
        }}
    }}""")

    # Select scopes via JS (radio buttons may also be non-visible)
    scope_map = {
        "repository": "write:repository",
        "user": "write:user",
        "organization": "write:organization",
        "issue": "write:issue",
        "package": "write:package",
        "notification": "read:notification",
        "misc": "read:misc",
    }
    page.evaluate("""(scopes) => {
        for (const [cat, val] of Object.entries(scopes)) {
            const radio = document.querySelector('input[value="' + val + '"]');
            if (radio) { radio.checked = true; radio.dispatchEvent(new Event('change', {bubbles: true})); }
        }
    }""", scope_map)

    # Click Generate Token via JS
    page.evaluate("""() => {
        const btns = document.querySelectorAll('button');
        for (const b of btns) {
            if (b.textContent.trim() === 'Generate Token') { b.click(); return; }
        }
    }""")
    page.wait_for_timeout(3000)

    # Extract the generated token.
    # Gitea shows it in a flash-info message div as plain text (the token
    # string itself, not wrapped in <code>).
    token_el = page.query_selector('.ui.info.message.flash-info, .ui.info.message')
    if not token_el:
        token_el = page.query_selector('.ui.message code, input[readonly]')

    token = ""
    if token_el:
        token = token_el.text_content().strip()
        # The flash message may contain extra text; extract just the token
        # (Gitea tokens are 40-char hex strings)
        import re
        match = re.search(r'[a-f0-9]{40}', token)
        if match:
            token = match.group(0)
    if not token:
        log.error(f"[{name}] Could not extract Gitea API token")
        _debug_dump(page, f"gitea-no-token-{name}")
        return ""

    log.info(f"[{name}] Gitea token generated: {token[:8]}...")

    # Store in Bitwarden
    bw.create_item(
        name=item_name,
        username=name,
        password=token,
        uris=[url],
        collection_name=name,
        custom_fields={"token_name": token_name},
    )
    log.info(f"[{name}] Gitea token stored in Bitwarden")

    return token


def provision_discourse(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """
    Discourse SSO login + User API key generation.

    Proven flow (session 2, verified on vp-techops):
    1. Click .login-button to open the login modal
    2. Click the OpenID Connect button inside the modal
    3. First login redirects to /signup with email pre-authenticated:
       fill username, click Sign Up
    4. User API key via the RSA-encrypted flow:
       - Generate RSA keypair, pass public key to /user-api-key/new
       - Click Authorize
       - Capture the POST response payload, decrypt (PKCS1v15),
         parse JSON to extract the "key" field

    The resulting key authenticates via the User-Api-Key header
    (NOT Api-Key -- that is for admin-created keys).

    Returns the API key (empty string on failure).
    """
    name = agent["name"]
    systems = agent.get("systems", {})
    discourse_cfg = systems.get("discourse", {})

    if not discourse_cfg:
        log.info(f"[{name}] No Discourse config -- skipping")
        return ""

    item_name = f"{name} Discourse"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Discourse key already exists -- skipping")
        return bw.get_item_password(item_name)

    url = discourse_cfg.get("url", DISCOURSE_URL)
    username = agent.get("username", name.replace("-", ""))

    # --- SSO login ---
    page.goto(f"{url}/", wait_until="domcontentloaded", timeout=30000)
    page.wait_for_timeout(3000)

    if not page.query_selector("#current-user, .current-user"):
        login_btn = page.locator(".login-button, button:has-text('Log In')")
        if login_btn.count() > 0:
            login_btn.first.click()
            page.wait_for_timeout(3000)

        sso_btn = page.locator('button:has-text("OpenID")')
        if sso_btn.count() > 0:
            sso_btn.first.click()
            page.wait_for_timeout(5000)

        # First login: /signup with email already authenticated by OIDC
        if "/signup" in page.url:
            page.wait_for_timeout(2000)
            username_input = page.locator('#new-account-username, input[name="username"]')
            if username_input.count() > 0 and username_input.first.is_visible():
                username_input.first.click()
                page.keyboard.type(username)
                page.wait_for_timeout(1000)
                for btn_text in ["Create Account", "Sign Up", "Register"]:
                    loc = page.locator(f'button:has-text("{btn_text}")')
                    if loc.count() > 0 and loc.first.is_visible():
                        loc.first.click()
                        page.wait_for_timeout(5000)
                        break
                log.info(f"[{name}] Discourse account created: {username}")

    page.goto(f"{url}/", wait_until="domcontentloaded", timeout=30000)
    page.wait_for_timeout(3000)
    if not page.query_selector("#current-user, .current-user"):
        log.error(f"[{name}] Discourse SSO login failed")
        _debug_dump(page, f"discourse-login-failed-{name}")
        return ""
    log.info(f"[{name}] Discourse SSO login OK")

    # --- User API key (RSA flow) ---
    import base64
    import secrets
    import uuid as uuid_lib
    from urllib.parse import quote_plus

    from cryptography.hazmat.primitives import hashes, serialization
    from cryptography.hazmat.primitives.asymmetric import padding as asym_padding
    from cryptography.hazmat.primitives.asymmetric import rsa as asym_rsa

    private_key = asym_rsa.generate_private_key(public_exponent=65537, key_size=2048)
    public_pem = private_key.public_key().public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo,
    ).decode("ascii")

    nonce = secrets.token_hex(16)
    client_id = str(uuid_lib.uuid4())
    app_name = f"TSG-Agent-{agent.get('display_name', name)}"
    params = (
        f"?application_name={quote_plus(app_name)}"
        f"&client_id={client_id}"
        f"&nonce={nonce}"
        f"&scopes=read%2Cwrite"
        f"&public_key={quote_plus(public_pem)}"
    )

    api_responses = []

    def handle_response(response):
        if "user-api-key" in response.url and response.request.method == "POST":
            try:
                api_responses.append(response.text())
            except Exception:
                pass

    page.on("response", handle_response)
    try:
        page.goto(f"{url}/user-api-key/new{params}", wait_until="domcontentloaded", timeout=30000)
        page.wait_for_timeout(3000)

        for btn_text in ["Authorize", "Approve", "Continue"]:
            loc = page.locator(f'button:has-text("{btn_text}"), .btn-primary')
            if loc.count() > 0 and loc.first.is_visible():
                loc.first.click()
                break
        page.wait_for_timeout(3000)
    finally:
        page.remove_listener("response", handle_response)

    api_key = ""
    for resp_text in api_responses:
        try:
            data = json.loads(resp_text)
            encrypted_raw = data.get("key") or data.get("payload") or ""
            if not encrypted_raw:
                continue
            encrypted = base64.b64decode(
                encrypted_raw.replace("\n", "").replace("\r", "").replace(" ", "")
            )
            # Discourse uses PKCS1v15; try OAEP variants as fallback
            paddings = [
                asym_padding.PKCS1v15(),
                asym_padding.OAEP(
                    mgf=asym_padding.MGF1(algorithm=hashes.SHA256()),
                    algorithm=hashes.SHA256(), label=None),
                asym_padding.OAEP(
                    mgf=asym_padding.MGF1(algorithm=hashes.SHA1()),
                    algorithm=hashes.SHA1(), label=None),
            ]
            for pad in paddings:
                try:
                    decrypted = private_key.decrypt(encrypted, pad).decode("ascii")
                    try:
                        api_key = json.loads(decrypted).get("key", decrypted)
                    except json.JSONDecodeError:
                        api_key = decrypted
                    break
                except Exception:
                    continue
            if api_key:
                break
        except Exception:
            continue

    if not api_key:
        log.error(f"[{name}] Could not extract Discourse API key")
        _debug_dump(page, f"discourse-no-key-{name}")
        return ""

    log.info(f"[{name}] Discourse API key obtained: {api_key[:8]}...")

    bw.create_item(
        name=item_name,
        username=username,
        password=api_key,
        uris=[url],
        collection_name=name,
    )
    log.info(f"[{name}] Discourse API key stored in Bitwarden")

    return api_key


def provision_redmine(page: Page, agent: dict, bw: BitwardenHelper) -> str:
    """
    Redmine SSO login + API access key extraction.

    Proven flow (session 2, verified on vp-techops):
    1. Click "Continue with KNEL Cloud" (#login-oauth-submit-1)
    2. OIDC may show a consent page -- click Continue
    3. On /my/account click "Show" in the .api-key-actions section
    4. Read the 40-hex key from the #api-access-key pre element
    5. If no key exists yet, click the API-key Reset link via targeted
       DOM traversal (a generic "Reset" match clicks the wrong section)

    Prereq: the Cloudron user must have Redmine app access granted by
    the Cloudron admin, else OIDC shows "You do not have access".

    Returns the API key (empty string on failure).
    """
    name = agent["name"]
    systems = agent.get("systems", {})
    redmine_cfg = systems.get("redmine", {})

    if not redmine_cfg:
        log.info(f"[{name}] No Redmine config -- skipping")
        return ""

    item_name = f"{name} Redmine"
    if bw.item_exists(item_name):
        log.info(f"[{name}] Redmine key already exists -- skipping")
        return bw.get_item_password(item_name)

    url = redmine_cfg.get("url", REDMINE_URL)
    username = agent.get("username", name.replace("-", ""))

    # --- SSO login ---
    page.goto(f"{url}/login", wait_until="domcontentloaded", timeout=30000)
    page.wait_for_timeout(3000)

    sso_btn = page.locator(
        '#login-oauth-submit-1, button:has-text("KNEL"), button:has-text("Continue")'
    )
    if sso_btn.count() > 0 and sso_btn.first.is_visible():
        sso_btn.first.click()
        page.wait_for_timeout(5000)

        if "openid" in page.url.lower():
            for consent in ["Continue", "Authorize", "Allow", "Accept"]:
                cbtn = page.locator(
                    f'[role="button"]:has-text("{consent}"), button:has-text("{consent}")'
                )
                if cbtn.count() > 0 and cbtn.first.is_visible():
                    cbtn.first.click()
                    page.wait_for_timeout(5000)
                    break

    if "/login" in page.url:
        log.error(f"[{name}] Redmine SSO failed (still on login page)")
        _debug_dump(page, f"redmine-sso-failed-{name}")
        return ""
    log.info(f"[{name}] Redmine SSO login OK")

    # --- API key ---
    page.goto(f"{url}/my/account", wait_until="domcontentloaded", timeout=30000)
    page.wait_for_timeout(3000)
    _debug_dump(page, f"redmine-account-{name}")

    api_key = ""

    # A key usually exists (auto-created); reveal it via "Show"
    show_btn = page.locator('.api-key-actions a:has-text("Show"), a:has-text("Show")')
    if show_btn.count() > 0 and show_btn.first.is_visible():
        show_btn.first.click()
        page.wait_for_timeout(2000)
        api_el = page.query_selector("#api-access-key")
        if api_el:
            matches = re.findall(r"[a-f0-9]{40}", api_el.text_content())
            if matches:
                api_key = matches[0]

    # No key yet: generate via the Reset link next to #api-access-key
    if not api_key:
        reset_clicked = page.evaluate("""() => {
            const apiSection = document.querySelector('#api-access-key');
            if (!apiSection) return false;
            let container = apiSection.closest('div, p, fieldset');
            while (container && container.parentElement) {
                const reset = Array.from(container.querySelectorAll('a, button')).find(el =>
                    el.textContent.trim().toLowerCase() === 'reset' && el.offsetParent !== null
                );
                if (reset) { reset.click(); return true; }
                container = container.parentElement;
                if (container.tagName === 'FIELDSET' || container.tagName === 'FORM') break;
            }
            return false;
        }""")
        if reset_clicked:
            page.wait_for_timeout(3000)
            confirm = page.locator(
                'button:has-text("OK"), button:has-text("Confirm"), button:has-text("Yes")'
            )
            if confirm.count() > 0 and confirm.first.is_visible():
                confirm.first.click()
                page.wait_for_timeout(3000)
            api_el = page.query_selector("#api-access-key")
            if api_el:
                matches = re.findall(r"[a-f0-9]{40}", api_el.text_content())
                if matches:
                    api_key = matches[0]

    if not api_key:
        log.error(f"[{name}] Could not get Redmine API key")
        _debug_dump(page, f"redmine-no-key-{name}")
        return ""

    log.info(f"[{name}] Redmine API key obtained: {api_key[:8]}...")

    bw.create_item(
        name=item_name,
        username=username,
        password=api_key,
        uris=[url],
        collection_name=name,
    )
    log.info(f"[{name}] Redmine API key stored in Bitwarden")

    return api_key


# ---------------------------------------------------------------------------
# Verification
# ---------------------------------------------------------------------------


def verify_gitea(token: str, agent: dict) -> bool:
    """Verify the Gitea API token works."""
    import urllib.request

    url = agent.get("systems", {}).get("gitea", {}).get("url", GITEA_URL)
    req = urllib.request.Request(f"{url}/api/v1/user", headers={"Authorization": f"token {token}"})
    try:
        resp = urllib.request.urlopen(req, timeout=10)
        data = json.loads(resp.read())
        log.info(f"  Gitea verify: user={data.get('login', '?')}")
        return resp.status == 200
    except Exception as e:
        log.error(f"  Gitea verify FAILED: {e}")
        return False


def verify_redmine(key: str, agent: dict) -> bool:
    """Verify the Redmine API key works."""
    import urllib.request

    url = agent.get("systems", {}).get("redmine", {}).get("url", REDMINE_URL)
    req = urllib.request.Request(f"{url}/users/current.json", headers={"X-Redmine-API-Key": key})
    try:
        resp = urllib.request.urlopen(req, timeout=10)
        data = json.loads(resp.read())
        log.info(f"  Redmine verify: user={data.get('user', {}).get('login', '?')}")
        return resp.status == 200
    except Exception as e:
        log.error(f"  Redmine verify FAILED: {e}")
        return False


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------


def load_manifest(path: str) -> list[dict]:
    """Load and validate the agent manifest."""
    with open(path) as f:
        data = yaml.safe_load(f)

    agents = data.get("agents", [])
    if not agents:
        log.error("No agents found in manifest")
        sys.exit(1)

    for agent in agents:
        if "cloudron_invite" not in agent or "REPLACE" in agent["cloudron_invite"]:
            log.warning(f"Agent {agent.get('name', '?')} has no valid Cloudron invite")

    return agents


def provision_agent(
    context: BrowserContext,
    agent: dict,
    bw: BitwardenHelper,
    phase1_only: bool = False,
) -> dict:
    """Provision a single agent identity."""
    name = agent["name"]
    results = {"name": name, "cloudron": False, "gitea": False, "discourse": False, "redmine": False}

    page = context.new_page()

    try:
        # Phase 1: Cloudron enrollment
        enroll_cloudron(page, agent, bw)
        results["cloudron"] = True
        log.info(f"[{name}] Phase 1 complete: Cloudron identity enrolled")

        if phase1_only:
            log.info(f"[{name}] Phase 1 only — skipping system access")
            return results

        systems = agent.get("systems", {})
        if not systems:
            log.info(f"[{name}] No systems configured — Phase 1 only")
            return results

        # Establish Cloudron panel session for SSO (shared across all apps)
        sso_page = context.new_page()
        cloudron_panel_login(sso_page, agent, bw)
        sso_page.close()

        # Phase 2: System access (fresh page for each system)
        for system_name in ["gitea", "discourse", "redmine"]:
            system_page = context.new_page()
            try:
                if system_name == "gitea":
                    token = provision_gitea(system_page, agent, bw)
                    results["gitea"] = bool(token) and verify_gitea(token, agent)
                elif system_name == "discourse":
                    key = provision_discourse(system_page, agent, bw)
                    results["discourse"] = bool(key)
                elif system_name == "redmine":
                    key = provision_redmine(system_page, agent, bw)
                    results["redmine"] = bool(key) and verify_redmine(key, agent)
            except Exception as e:
                log.error(f"[{name}] {system_name} provisioning failed: {e}")
            finally:
                system_page.close()

        log.info(f"[{name}] All phases complete: {results}")

    except Exception as e:
        log.error(f"[{name}] Provisioning failed: {e}")
        results["error"] = str(e)
    finally:
        page.close()

    # Save state (in finally so partial results survive failures)
    state_file = STATE_DIR / f"{name}.json"
    try:
        with open(state_file, "w") as f:
            json.dump(results, f, indent=2)
    except OSError:
        log.warning(f"[{name}] Could not write state file: {state_file}")

    return results


def main():
    parser = argparse.ArgumentParser(description="Provision AI agent identities")
    parser.add_argument("--manifest", default="agents.yaml", help="Path to manifest file")
    parser.add_argument("--agent", help="Provision only this agent")
    parser.add_argument("--phase1-only", action="store_true", help="Cloudron enrollment only")
    parser.add_argument("--enable-2fa", action="store_true", help="Enable 2FA on existing Cloudron accounts")
    parser.add_argument("--dry-run", action="store_true", help="Validate manifest without browser")
    parser.add_argument("--headed", action="store_true", help="Show browser (debugging)")
    args = parser.parse_args()

    # Ensure state directory exists (deferred from module level so --dry-run works)
    STATE_DIR.mkdir(parents=True, exist_ok=True)

    # Load manifest
    agents = load_manifest(args.manifest)
    if args.agent:
        agents = [a for a in agents if a["name"] == args.agent]
        if not agents:
            log.error(f"Agent '{args.agent}' not found in manifest")
            sys.exit(1)

    log.info(f"Manifest: {len(agents)} agent(s) to provision")
    for a in agents:
        log.info(f"  - {a['name']} ({a.get('display_name', '?')}) [{a.get('priority', '?')}]")

    if args.dry_run:
        log.info("Dry run — manifest validated successfully")
        return

    # Initialize Bitwarden
    bw = BitwardenHelper(
        client_id=os.environ["BW_CLIENTID"],
        client_secret=os.environ["BW_CLIENTSECRET"],
        password=os.environ["BW_PASSWORD"],
        totp_secret=os.environ.get("BW_TOTP_SECRET", ""),
        server_url=os.environ.get("BW_SERVER", ""),
    )
    log.info("Connecting to Bitwarden...")
    bw.login()
    log.info("Bitwarden session established")

    # Launch Playwright
    headless = not args.headed
    if os.environ.get("HEADFUL", "false").lower() == "true":
        headless = False

    all_results = []

    with sync_playwright() as pw:
        browser = pw.chromium.launch(headless=headless)

        for agent in agents:
            # Fresh context per agent (no cookie/session bleed)
            context = browser.new_context(
                accept_downloads=False,
                java_script_enabled=True,
            )
            log.info(f"=== Provisioning: {agent['name']} ===")
            try:
                if args.enable_2fa:
                    page = context.new_page()
                    cloudron_panel_login(page, agent, bw)
                    totp_secret = enable_cloudron_2fa(page, agent, bw)
                    if totp_secret:
                        item_name = f"{agent['name']} Cloudron"
                        bw.update_item(item_name, totp_secret=totp_secret)
                        log.info(f"[{agent['name']}] Updated BW item with TOTP secret (in place)")
                    page.close()
                    all_results.append({"name": agent["name"], "2fa": bool(totp_secret)})
                else:
                    result = provision_agent(context, agent, bw, args.phase1_only)
                    all_results.append(result)
            except Exception as e:
                log.error(f"FAILED: {agent['name']}: {e}")
                all_results.append({"name": agent["name"], "error": str(e)})
            finally:
                context.close()

        browser.close()

    # Summary
    log.info("\n=== PROVISIONING SUMMARY ===")
    for r in all_results:
        status = "OK" if "error" not in r else "FAILED"
        systems = []
        for s in ["cloudron", "gitea", "discourse", "redmine"]:
            if r.get(s):
                systems.append(s)
        log.info(f"  {r['name']}: {status} — {', '.join(systems) if systems else '(none)'}")

    # Exit non-zero if any failed
    if any("error" in r for r in all_results):
        sys.exit(1)


if __name__ == "__main__":
    main()