#!/bin/sh
# Store prod s.f0xx.org API bearer for lab outbound mail (links must live in prod DB).
set -eu
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
. "$ROOT/scripts/lib/common.sh"
load_cluster_env

TOKEN="${1:-}"
if [ -z "$TOKEN" ]; then
  die "usage: ensure-auth-email-api-bearer.sh <bearer_token>
Mint on prod BE: php81 /var/www/localhost/htdocs/apps/s/scripts/seed_bearer.php --label=auth-email-system"
fi

SECRETS="${CAST_CLUSTER_ROOT}/secrets.lab.env"
touch "$SECRETS"
chmod 600 "$SECRETS"
grep -v '^URL_SHORTENER_API_BEARER_TOKEN=' "$SECRETS" > /tmp/secrets.new || true
printf 'URL_SHORTENER_API_BEARER_TOKEN=%s\n' "$TOKEN" >> /tmp/secrets.new
mv /tmp/secrets.new "$SECRETS"
chmod 600 "$SECRETS"

_short="$(curl -fsS -X POST "${URL_SHORTENER_API_BASE:-http://artc0.intra.raptor.org}/api/v1/shorten" \
  -H 'Content-Type: application/json' \
  -H "Host: ${URL_SHORTENER_API_HOST:-s.f0xx.org}" \
  -d "{\"url\":\"https://example.com/lab-smoke\",\"bearer\":\"${TOKEN}\",\"ttl\":60}" \
  | php83 -r '$j=json_decode(stream_get_contents(STDIN),true); echo (string)($j["u"]??"");' 2>/dev/null)" || _short=""
[ -n "$_short" ] || die "API smoke failed — token rejected by ${SHORT_LINKS_PUBLIC_BASE:-https://s.f0xx.org}"

log "ensure-auth-email-api-bearer_ok smoke=${_short}"
log "next: compose-lab-backend.sh && verify-mail-lab.sh …"