#!/usr/bin/env bash
# file: scripts/devnet/prepare_elgamal_registry_fixture.sh
# version: 1
set -euo pipefail

CLUSTER_URL="${KB_ELGAMAL_CLUSTER_URL:-https://api.devnet.solana.com}"
PROFILE="${KB_ELGAMAL_PROFILE:-local_devnet}"
FIXTURE_DIR="${KB_ELGAMAL_FIXTURE_DIR:-./wallets/temporary/${PROFILE}/elgamal_registry_validation}"
FIXTURE_FILE="${FIXTURE_DIR}/fixture.env"
TOKEN_2022_PROGRAM="${TOKEN_2022_PROGRAM:-TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb}"
ELGAMAL_REGISTRY_PROGRAM="${ELGAMAL_REGISTRY_PROGRAM:-regVYJW7tcT8zipN5YiBvHsvR5jXW1uLFxaHSbugABg}"
ZK_ELGAMAL_PROOF_PROGRAM="${ZK_ELGAMAL_PROOF_PROGRAM:-ZkE1Gama1Proof11111111111111111111111111111}"

usage() {
  cat <<USAGE
Usage:
  ELGAMAL_REGISTRY_ADDRESS=<PDA> \\
  ELGAMAL_PUBKEY_BASE64=<base64-32-bytes> \\
  PUBKEY_VALIDITY_PROOF_CONTEXT=<pubkey> \\
  TOKEN_2022_CONFIDENTIAL_ACCOUNT=<pubkey> \\
  scripts/devnet/prepare_elgamal_registry_fixture.sh [--force]

The script validates and records an already generated cryptographic fixture.
It never fabricates an ElGamal key or a zero-knowledge proof.
USAGE
}

FORCE=false
if [[ "${1:-}" == "--force" ]]; then
  FORCE=true
elif [[ $# -ne 0 ]]; then
  usage
  exit 2
fi

for command in solana base64; do
  if ! command -v "$command" >/dev/null 2>&1; then
    printf 'Commande requise absente: %s\n' "$command" >&2
    exit 1
  fi
done

required_variables=(
  ELGAMAL_REGISTRY_ADDRESS
  ELGAMAL_PUBKEY_BASE64
  PUBKEY_VALIDITY_PROOF_CONTEXT
  TOKEN_2022_CONFIDENTIAL_ACCOUNT
)
for variable in "${required_variables[@]}"; do
  if [[ -z "${!variable:-}" ]]; then
    printf 'Variable requise absente: %s\n' "$variable" >&2
    usage
    exit 1
  fi
done

validate_existing_account() {
  local label="$1"
  local value="$2"
  if ! solana account "$value" --url "$CLUSTER_URL" --output json-compact >/dev/null 2>&1; then
    printf '%s non lisible sur %s: %s\n' "$label" "$CLUSTER_URL" "$value" >&2
    exit 1
  fi
}

validate_registry_address() {
  local output
  if output="$(solana account "$ELGAMAL_REGISTRY_ADDRESS" --url "$CLUSTER_URL" --output json-compact 2>&1)"; then
    printf 'Registry déjà présent; la fixture conviendra à UpdateRegistry mais CreateRegistry doit utiliser un nouveau propriétaire/PDA.\n' >&2
    return 0
  fi
  if [[ "$output" == *"AccountNotFound"* ]]; then
    return 0
  fi
  printf 'Adresse Registry invalide ou RPC indisponible: %s\n%s\n' "$ELGAMAL_REGISTRY_ADDRESS" "$output" >&2
  exit 1
}

if ! decoded_length="$(printf '%s' "$ELGAMAL_PUBKEY_BASE64" | base64 --decode 2>/dev/null | wc -c)"; then
  printf 'ELGAMAL_PUBKEY_BASE64 n\x27est pas un Base64 valide.\n' >&2
  exit 1
fi
if [[ "$decoded_length" -ne 32 ]]; then
  printf 'ELGAMAL_PUBKEY_BASE64 doit décoder exactement 32 octets; obtenu: %s.\n' "$decoded_length" >&2
  exit 1
fi

validate_registry_address
validate_existing_account "Proof Context State PubkeyValidity" "$PUBKEY_VALIDITY_PROOF_CONTEXT"
validate_existing_account "Token-2022 confidential account" "$TOKEN_2022_CONFIDENTIAL_ACCOUNT"

for program in "$TOKEN_2022_PROGRAM" "$ELGAMAL_REGISTRY_PROGRAM" "$ZK_ELGAMAL_PROOF_PROGRAM"; do
  if ! solana program show "$program" --url "$CLUSTER_URL" >/dev/null 2>&1; then
    printf 'Programme requis absent ou non exécutable sur %s: %s\n' "$CLUSTER_URL" "$program" >&2
    exit 1
  fi
done

if [[ -e "$FIXTURE_FILE" && "$FORCE" != true ]]; then
  printf 'Fixture déjà présente: %s; utiliser --force pour la remplacer.\n' "$FIXTURE_FILE" >&2
  exit 1
fi

mkdir -p "$FIXTURE_DIR"
umask 077
cat > "$FIXTURE_FILE" <<ENV
export KB_ELGAMAL_CLUSTER_URL='$CLUSTER_URL'
export TOKEN_2022_PROGRAM='$TOKEN_2022_PROGRAM'
export ELGAMAL_REGISTRY_PROGRAM='$ELGAMAL_REGISTRY_PROGRAM'
export ZK_ELGAMAL_PROOF_PROGRAM='$ZK_ELGAMAL_PROOF_PROGRAM'
export ELGAMAL_REGISTRY_ADDRESS='$ELGAMAL_REGISTRY_ADDRESS'
export ELGAMAL_PUBKEY_BASE64='$ELGAMAL_PUBKEY_BASE64'
export PUBKEY_VALIDITY_PROOF_CONTEXT='$PUBKEY_VALIDITY_PROOF_CONTEXT'
export TOKEN_2022_CONFIDENTIAL_ACCOUNT='$TOKEN_2022_CONFIDENTIAL_ACCOUNT'
ENV
chmod 600 "$FIXTURE_FILE"
printf 'Fixture ElGamal Registry validée: %s\n' "$FIXTURE_FILE"
printf 'Registry: %s\n' "$ELGAMAL_REGISTRY_ADDRESS"
printf 'Proof context: %s\n' "$PUBKEY_VALIDITY_PROOF_CONTEXT"
printf 'Token account: %s\n' "$TOKEN_2022_CONFIDENTIAL_ACCOUNT"