#!/usr/bin/env bash
# 从 Consul 导出 KV 到 idwms/*.json（首次建仓 / 对账用）
# 注意：导出会含明文密码，勿直接 commit；先人工脱敏或改用占位符
# 用法: ./scripts/export-from-consul.sh [admin|common|itfxapi|trackapi ...]
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
export KUBECONFIG="${KUBECONFIG:-/etc/rancher/k3s/k3s.yaml}"
NS="${NAMESPACE:-prod}"
IDWMS_DIR="${ROOT}/idwms"
mkdir -p "$IDWMS_DIR"

need() { command -v "$1" >/dev/null || { echo "FAIL: 需要 $1"; exit 1; }; }
need kubectl
need curl
command -v python3 >/dev/null || command -v jq >/dev/null || {
  echo "FAIL: 需要 python3 或 jq"; exit 1;
}

json_pretty() {
  local raw="$1" out="$2"
  if command -v python3 >/dev/null; then
    python3 -c 'import json,sys; json.dump(json.load(sys.stdin), open(sys.argv[1],"w",encoding="utf-8"), ensure_ascii=False, indent=2); open(sys.argv[1],"a",encoding="utf-8").write("\n")' "$out" <<<"$raw"
  else
    jq . <<<"$raw" >"$out"
  fi
}

json_ok_str() {
  local raw="$1"
  if command -v python3 >/dev/null; then
    python3 -c 'import json,sys; json.loads(sys.stdin.read())' <<<"$raw"
  else
    jq empty <<<"$raw"
  fi
}
if [[ -z "${CONSUL_HTTP_ADDR:-}" ]]; then
  if [[ "$NS" == "test" ]]; then
    CONSUL_HTTP_ADDR="${TEST_CONSUL_HTTP_ADDR:-http://172.16.16.13:30850}"
  else
    CIP="$(kubectl -n "$NS" get svc consul -o jsonpath='{.spec.clusterIP}')"
    CONSUL_HTTP_ADDR="http://${CIP}:8500"
  fi
fi
echo "==> Consul ${CONSUL_HTTP_ADDR}"

if [[ -z "${CONSUL_HTTP_TOKEN:-}" ]]; then
  raw="$(kubectl -n "$NS" get secret consul-acl -o jsonpath='{.data.CONSUL_HTTP_TOKEN}' 2>/dev/null || true)"
  if [[ -n "$raw" ]]; then
    CONSUL_HTTP_TOKEN="$(printf '%s' "$raw" | base64 -d)"
  fi
fi

CURL_AUTH=()
if [[ -n "${CONSUL_HTTP_TOKEN:-}" ]]; then
  CURL_AUTH=(-H "X-Consul-Token: ${CONSUL_HTTP_TOKEN}")
fi

if [[ $# -eq 0 ]]; then
  TARGETS=(common admin itfxapi trackapi)
else
  TARGETS=("$@")
fi

for name in "${TARGETS[@]}"; do
  key="idwms/${name}"
  out="${IDWMS_DIR}/${name}.json"
  echo "==> GET ${key}"
  raw="$(curl -sS "${CURL_AUTH[@]}" "${CONSUL_HTTP_ADDR}/v1/kv/${key}?raw" || true)"
  if [[ -z "$raw" ]]; then
    echo "WARN: ${key} 为空或不存在，跳过"
    continue
  fi
  if ! json_ok_str "$raw" 2>/dev/null; then
    echo "FAIL: ${key} 不是 JSON"
    exit 1
  fi
  json_pretty "$raw" "$out"
  echo "OK   → ${out}"
done

echo "导出完成。提交前请把密码改成 \${MYSQL_ROOT_PASSWORD} 等占位符。"