#!/usr/bin/env bash
# List all NPMplus proxy hosts and whether each has a certificate assigned.
# Uses .env for NPM_URL, NPM_EMAIL, NPM_PASSWORD.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_ROOT"

_orig_npm_url="${NPM_URL:-}"
_orig_npm_email="${NPM_EMAIL:-}"
_orig_npm_password="${NPM_PASSWORD:-}"
[ -f .env ] && { set +u; set -a; source .env 2>/dev/null || true; set +a; set -u; }
[ -n "$_orig_npm_url" ] && NPM_URL="$_orig_npm_url"
[ -n "$_orig_npm_email" ] && NPM_EMAIL="$_orig_npm_email"
[ -n "$_orig_npm_password" ] && NPM_PASSWORD="$_orig_npm_password"

NPM_URL="${NPM_URL:-https://192.168.11.167:81}"
NPM_EMAIL="${NPM_EMAIL:-admin@example.org}"
NPM_PASSWORD="${NPM_PASSWORD:-}"

[ -z "$NPM_PASSWORD" ] && { echo "NPM_PASSWORD required (e.g. in .env)"; exit 1; }

AUTH_JSON=$(jq -n --arg identity "$NPM_EMAIL" --arg secret "$NPM_PASSWORD" '{identity:$identity,secret:$secret}')
TOKEN=$(curl -s -k -X POST "$NPM_URL/api/tokens" -H "Content-Type: application/json" -d "$AUTH_JSON" | jq -r '.token // empty')
[ -z "$TOKEN" ] || [ "$TOKEN" = "null" ] && { echo "Auth failed"; exit 1; }

PROXY_JSON=$(curl -s -k -X GET "$NPM_URL/api/nginx/proxy-hosts" -H "Authorization: Bearer $TOKEN")
TOTAL=$(echo "$PROXY_JSON" | jq 'length')
WITH_CERT=$(echo "$PROXY_JSON" | jq '[.[] | select(.certificate_id != null and .certificate_id > 0)] | length')
NO_CERT=$(echo "$PROXY_JSON" | jq '[.[] | select(.certificate_id == null or .certificate_id == 0)] | length')

echo ""
echo "NPMplus Proxy Hosts vs Certificates"
echo "Total proxy hosts: $TOTAL  |  With cert: $WITH_CERT  |  No cert: $NO_CERT"
echo ""
printf "%-6s %-50s %-10s\n" "ID" "Domain(s)" "Cert ID"
echo "--------------------------------------------------------------------------------"

echo "$PROXY_JSON" | jq -c '.[]' | while read -r host; do
  id=$(echo "$host" | jq -r '.id')
  domains=$(echo "$host" | jq -r '.domain_names // [] | if type == "array" then join(", ") else . end' | head -c 48)
  cert_id=$(echo "$host" | jq -r '.certificate_id // 0')
  [ "$cert_id" = "null" ] || [ -z "$cert_id" ] && cert_id="0"
  [ "$cert_id" = "0" ] && cert_display="— none —" || cert_display="$cert_id"
  printf "%-6s %-50s %-10s\n" "$id" "$domains" "$cert_display"
done

echo ""
if [ "$NO_CERT" -gt 0 ]; then
  echo "Hosts without a certificate (request cert in NPM UI or run request-npmplus-certificates.sh):"
  echo "$PROXY_JSON" | jq -r '.[] | select(.certificate_id == null or .certificate_id == 0) | "  \(.id)  \(.domain_names | join(", "))"'
  echo ""
fi