#!/usr/bin/env bash
# 10-distribute-openwebui-creds.sh — per-account openwebui.creds (#610).
# For each of the 9 Open Terminal accounts: write THAT account's own
# URL + API key into <home>/.creds/openwebui.creds (mkdir -p .creds),
# 0600, owned by the account. Source of truth = the per-user TOML in
# /etc/ukrrs/open-terminal/ (keys read from there, NEVER echoed here,
# never on a command line, never in this repo or the .out log).
#   ~/projects/ultix/10-distribute-openwebui-creds.sh
set -euo pipefail
[ "$EUID" -eq 0 ] || exec sudo bash "$0"

OUT=/home/reachableceo/projects/ultix/10-distribute-openwebui-creds.out
exec > >(tee "$OUT") 2>&1
echo "== openwebui.creds distribution $(date -Is) =="

TOML_DIR=/etc/ukrrs/open-terminal

while read -r USER; do
  [ -z "$USER" ] && continue
  HOME_DIR=$(getent passwd "$USER" | cut -d: -f6)
  TOML="$TOML_DIR/$USER.toml"
  if [ ! -r "$TOML" ]; then
    echo "SKIP $USER (no TOML at $TOML)"
    continue
  fi

  PORT=$(sed -n 's/^port = //p' "$TOML" | tr -d ' ')
  KEY=$(sed -n 's/^api_key = "\(.*\)"$/\1/p' "$TOML")

  mkdir -p "$HOME_DIR/.creds"
  chown "$USER:$USER" "$HOME_DIR/.creds"
  chmod 700 "$HOME_DIR/.creds"

  CREDS="$HOME_DIR/.creds/openwebui.creds"
  cat > "$CREDS" <<EOF
# OpenWebUI Open Terminal wiring for $USER (#610). 0600, never repo/chat.
# Admin UI: Settings -> Admin -> Integrations -> Open Terminal -> "+"
OPENWEBUI_TERMINAL_URL=http://100.101.187.119:$PORT
OPENWEBUI_TERMINAL_API_KEY=$KEY
OPENWEBUI_TERMINAL_AUTH=bearer
EOF
  chown "$USER:$USER" "$CREDS"
  chmod 600 "$CREDS"

  HEALTH=$(curl -s -m 5 "http://100.101.187.119:$PORT/health" || echo unreachable)
  MODE=$(stat -c '%U:%G %a' "$CREDS")
  printf '%-24s port %s  %s  %s  health: %s\n' "$USER" "$PORT" "$CREDS" "$MODE" "$HEALTH"
done <<'LIST'
reachableceo
TSGCOO
TSGCCO
TSGCTO
TSGBOD
COS-RCEO
COS-WFO
COS-TSG
reachableceo-offstage
LIST

chown reachableceo:reachableceo "$OUT" 2>/dev/null || true
echo "== done $(date -Is) =="