#!/bin/bash

# SSL Certificate Check Script for Mnemo Cards
# Usage: ./check_ssl.sh

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

echo "🔐 Checking SSL certificates for all Mnemo Cards domains..."

# Domains to check
DOMAINS=(
    "mnemo-cards.online"
    "api.mnemo-cards.online"
    "admin.mnemo-cards.online"
    "code.mnemo-cards.online"
    "vscode.mnemo-cards.online"
)

# Check SSL certificates
echo ""
echo "📋 SSL Certificate Status:"
echo "=========================="

for domain in "${DOMAINS[@]}"; do
    cert_path="/etc/letsencrypt/live/$domain/fullchain.pem"

    if [ -f "$cert_path" ]; then
        # Get certificate info
        cert_info=$(openssl x509 -in "$cert_path" -text -noout 2>/dev/null)

        if [ $? -eq 0 ]; then
            # Extract expiry date
            expiry_date=$(echo "$cert_info" | grep "Not After" | cut -d: -f2- | xargs)
            expiry_timestamp=$(date -d "$expiry_date" +%s 2>/dev/null)
            current_timestamp=$(date +%s)

            # Calculate days until expiry
            days_until_expiry=$(( (expiry_timestamp - current_timestamp) / 86400 ))

            if [ $days_until_expiry -gt 30 ]; then
                echo -e "✅ $domain: ${GREEN}Valid${NC} (expires in $days_until_expiry days: $expiry_date)"
            elif [ $days_until_expiry -gt 7 ]; then
                echo -e "⚠️  $domain: ${YELLOW}Expires soon${NC} (in $days_until_expiry days: $expiry_date)"
            else
                echo -e "❌ $domain: ${RED}Expires very soon${NC} (in $days_until_expiry days: $expiry_date)"
            fi

            # Check if certificate covers the domain
            domain_in_cert=$(echo "$cert_info" | grep "DNS:$domain" | wc -l)
            if [ $domain_in_cert -eq 0 ]; then
                echo -e "   ${YELLOW}⚠️  Warning: Domain $domain not explicitly listed in certificate${NC}"
            fi
        else
            echo -e "❌ $domain: ${RED}Invalid certificate file${NC}"
        fi
    else
        echo -e "❌ $domain: ${RED}No certificate found${NC}"
        echo -e "   Expected at: $cert_path"
    fi
done

echo ""
echo "🔄 Checking certbot renewal configuration..."

# Check certbot renewal configuration
if [ -f "/etc/letsencrypt/renewal/mnemo-cards.online.conf" ]; then
    print_success "Main domain renewal config exists"
else
    print_warning "Main domain renewal config missing"
fi

for domain in "${DOMAINS[@]}"; do
    if [ "$domain" != "mnemo-cards.online" ]; then
        if [ -f "/etc/letsencrypt/renewal/$domain.conf" ]; then
            print_success "$domain renewal config exists"
        else
            print_warning "$domain renewal config missing"
        fi
    fi
done

echo ""
echo "⏰ Checking cron jobs for certificate renewal..."

# Check if certbot renewal is scheduled
cron_jobs=$(crontab -l 2>/dev/null | grep certbot || true)
if [ -n "$cron_jobs" ]; then
    print_success "Certbot renewal cron jobs found:"
    echo "$cron_jobs"
else
    print_warning "No certbot renewal cron jobs found"
fi

echo ""
echo "🌐 Testing HTTPS connectivity..."

# Test HTTPS connectivity
for domain in "${DOMAINS[@]}"; do
    if curl -I --max-time 10 "https://$domain" 2>/dev/null | grep -q "200\|301\|302\|403\|404"; then
        echo -e "✅ $domain: ${GREEN}HTTPS accessible${NC}"
    else
        echo -e "❌ $domain: ${RED}HTTPS not accessible${NC}"
        # Try to get more details
        curl -I --max-time 5 "https://$domain" 2>/dev/null || echo -e "   ${YELLOW}Connection failed${NC}"
    fi
done

echo ""
echo "📝 Recommendations:"
echo "=================="

# Check if any certificates expire soon
expiring_soon=false
for domain in "${DOMAINS[@]}"; do
    cert_path="/etc/letsencrypt/live/$domain/fullchain.pem"
    if [ -f "$cert_path" ]; then
        cert_info=$(openssl x509 -in "$cert_path" -text -noout 2>/dev/null)
        if [ $? -eq 0 ]; then
            expiry_date=$(echo "$cert_info" | grep "Not After" | cut -d: -f2- | xargs)
            expiry_timestamp=$(date -d "$expiry_date" +%s 2>/dev/null)
            current_timestamp=$(date +%s)
            days_until_expiry=$(( (expiry_timestamp - current_timestamp) / 86400 ))

            if [ $days_until_expiry -le 30 ]; then
                expiring_soon=true
                echo "- Certificate for $domain expires in $days_until_expiry days"
            fi
        fi
    fi
done

if [ "$expiring_soon" = true ]; then
    echo "- Run 'certbot renew' to renew expiring certificates"
fi

# Check missing certificates
missing_certs=false
for domain in "${DOMAINS[@]}"; do
    cert_path="/etc/letsencrypt/live/$domain/fullchain.pem"
    if [ ! -f "$cert_path" ]; then
        missing_certs=true
        echo "- Missing certificate for $domain"
    fi
done

if [ "$missing_certs" = true ]; then
    echo "- Run deployment scripts to obtain missing certificates"
    echo "- Or manually: 'certbot certonly --standalone -d <domain>'"
fi

echo ""
echo "🎉 SSL certificate check completed!"