#!/usr/bin/env bash
# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
#
# Mints an enrollment link on the probe server and prints it — as text, as a QR code if
# `qrencode` is around, and as an adb command if a device is attached.
#
# The admin listener is localhost-only by design, so this goes over SSH. The link carries a
# single-use bearer token: treat it like a password until it is redeemed.
#
# Usage: echolot-app/scripts/enroll-link.sh [note]
set -euo pipefail

SSH_HOST="${ECHOLOT_SSH:-claude-echolot}"
NOTE="${1:-manual}"

MINTED=$(ssh -o BatchMode=yes "$SSH_HOST" \
  "curl -s -X POST 'http://127.0.0.1:8444/admin/enroll-tokens?note=$NOTE'")

URI=$(printf '%s' "$MINTED" | python -c 'import json,sys;print(json.load(sys.stdin).get("enroll_uri",""))')
if [ -z "$URI" ]; then
  echo "server returned no enroll_uri (needs server-v0.5.4+):" >&2
  echo "$MINTED" >&2
  exit 1
fi

echo "$URI"
echo

# A QR is the point of the format: scanning beats pasting a 200-character string onto a phone.
if command -v qrencode >/dev/null 2>&1; then
  qrencode -t ANSIUTF8 "$URI"
else
  echo "(install qrencode to get a scannable QR here)"
fi

# With a device attached, the deep link can be delivered straight to the app — no typing at all.
if command -v adb >/dev/null 2>&1 && [ -n "$(adb devices | sed -n '2p')" ]; then
  echo
  echo "attached device — deliver it directly with:"
  echo "  adb shell am start -a android.intent.action.VIEW -d '$URI'"
fi