#!/usr/bin/env bash
# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
#
# Mints an enrollment link on the probe server and prints it — as text, as a QR code if
# `qrencode` is around, and as an adb command if a device is attached.
#
# The link is minted by the server binary on the host rather than over HTTP. The admin API this
# used to call is gone: the admin UI that replaced it is authenticated, as it should be, and
# adding a second unauthenticated door on loopback is what briefly exposed the old one to the
# network. A root shell on the host needs no authentication anyway — whoever has one already has
# every privilege the server has.
#
# The link carries a single-use bearer token: treat it like a password until it is redeemed.
#
# Usage: echolot-app/scripts/enroll-link.sh [note]
set -euo pipefail

SSH_HOST="${ECHOLOT_SSH:-claude-echolot}"
NOTE="${1:-manual}"

# The env file is sourced rather than assumed: the state directory and the public URL live there,
# and minting against the wrong state directory would produce a token the running server has
# never heard of.
REMOTE='set -a; . /etc/echolot/server.env; set +a;
        exec /usr/local/bin/echolot-server --mint-enroll-token'
RAW=$(ssh -o BatchMode=yes "$SSH_HOST" "sudo sh -c \"$REMOTE '$NOTE'\"" 2>/dev/null || true)
URI=$(printf '%s' "$RAW" | tr -d '\r' | grep -m1 '^echolot://enroll' || true)

if [ -z "$URI" ]; then
  echo "could not mint a link — needs a server with --mint-enroll-token (v0.9.7+)." >&2
  echo "raw response:" >&2
  printf '%s\n' "$RAW" >&2
  exit 1
fi

echo "$URI"
echo

# A QR is the point of the format: scanning beats pasting a 200-character string onto a phone.
if command -v qrencode >/dev/null 2>&1; then
  qrencode -t ANSIUTF8 "$URI"
else
  echo "(install qrencode to get a scannable QR here)"
fi

# With a device attached, the deep link can be delivered straight to the app — no typing at all.
if command -v adb >/dev/null 2>&1 && [ -n "$(adb devices | sed -n '2p')" ]; then
  echo
  echo "attached device — deliver it directly with:"
  echo "  adb shell am start -a android.intent.action.VIEW -d '$URI'"
fi