#!/usr/bin/env bash
# 🤖 tools/marketing-shots/tunnel.sh — lend the local demo instance a real public
# https address via `lchat try --local`, so the native apps (especially the
# iPhone) can join over real TLS. Prints the try-*.11relay.com origin +
# ready-to-open sign-in links. Wrapped by `./tools/dev shots tunnel`.
#
# Prereqs: `./tools/dev shots up` is already running (this tunnels its port). The
# tunnel uses the production gateway tunnel.11ch.at — it carries only the same
# encrypted traffic any hosted space would; the instance it fronts is your local
# demo DB.
#
#   ./tools/marketing-shots/tunnel.sh
#
# Foreground: it holds the tunnel open (Ctrl-C retires the address). Each printed
# sign-in link is SINGLE-USE — for another device run:
#   node tools/marketing-shots/device-link.mjs <origin>
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$ROOT"
KIT="$ROOT/tools/marketing-shots"

PORT="${LCHAT_DEMO_PORT:-8848}"
if ! curl -sf "http://127.0.0.1:$PORT/api/version" >/dev/null 2>&1; then
  echo "tunnel: nothing answering on 127.0.0.1:$PORT — start ./tools/dev shots up first." >&2
  exit 1
fi
if [ ! -f "$KIT/.demo-state.json" ]; then
  echo "tunnel: no .demo-state.json — run ./tools/dev shots up first." >&2
  exit 1
fi

LOG="$(mktemp -t capkit-tunnel.XXXXXX)"
echo "tunnel: opening a public address for 127.0.0.1:$PORT via tunnel.11ch.at…"
"$ROOT/lchat" try --local "127.0.0.1:$PORT" >"$LOG" 2>&1 &
TRY_PID=$!
trap 'echo; echo "tunnel: retiring the address…"; kill "$TRY_PID" 2>/dev/null || true; rm -f "$LOG"' EXIT INT TERM

# Wait for the gateway to assign an origin (grep it out of the try output).
ORIGIN=""
for _ in $(seq 1 120); do
  ORIGIN="$(grep -oE 'https://try-[a-z0-9.-]+' "$LOG" | head -1 || true)"
  [ -n "$ORIGIN" ] && break
  kill -0 "$TRY_PID" 2>/dev/null || { echo "tunnel: lchat try exited early:" >&2; cat "$LOG" >&2; exit 1; }
  sleep 0.5
done
[ -n "$ORIGIN" ] || { echo "tunnel: gateway didn't assign an address in time:" >&2; cat "$LOG" >&2; exit 1; }

# Mint two fresh single-use sign-in links on the public origin (Mac + iPhone).
MAC_LINK="$(node tools/marketing-shots/device-link.mjs "$ORIGIN")"
IOS_LINK="$(node tools/marketing-shots/device-link.mjs "$ORIGIN")"

cat <<EOF

──────────────────────────────────────────────────────────────────────
  ✔ Public address:  $ORIGIN

  Mac app  — Spaces ▸ Add from link… and paste (signs in as "Cass"):
    $MAC_LINK

  iPhone   — open this link ON THE DEVICE (Safari → Open in the app / join):
    $IOS_LINK

  Each link is single-use. Need another device? run:
    node tools/marketing-shots/device-link.mjs $ORIGIN

  Ctrl-C retires the address (the space's data stays in tools/marketing-shots/.demo.db).
──────────────────────────────────────────────────────────────────────

EOF

wait "$TRY_PID"