#!/usr/bin/env bash
# this is the second version of this script with a few bug fixes around the
# domain creation and the ui customization.   This version works and is tested.
AWS_REGION="us-east-2"
AWS_PROFILE="aarete"
# domain prefix should be unique
DOMAIN_PREFIX="aarete-mfa-test2"
LOG_FILE="creation.log.txt"
# pool stuff
# this is the unique name of the new pool to create.  (and all of its dependencies)
NEW_USER_POOL_NAME="Aarete-MFA-Test-Pool-2"
# user stuff
TEST_USER_EMAIL="foo@gmail.com"
TEST_USER_PHONE="+18889091485"
TEMP_PASSWORD="TempPass123!"

> "$LOG_FILE"

echo "Creating Cognito User Pool..." | tee -a "$LOG_FILE"
USER_POOL_ID=$(aws cognito-idp create-user-pool \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --pool-name "$NEW_USER_POOL_NAME" \
    --username-attributes "email" \
    --auto-verified-attributes "email" \
    --policies "PasswordPolicy={MinimumLength=8,RequireUppercase=true,RequireLowercase=true,RequireNumbers=true,RequireSymbols=true}" \
    --query "UserPool.Id" --output text)

if [ $? -ne 0 ] || [ -z "$USER_POOL_ID" ]; then
    echo "Error: Failed to create Cognito User Pool." >&2
    exit 1
fi
echo "User Pool created with ID $USER_POOL_ID" | tee -a "$LOG_FILE"

echo "Enabling TOTP MFA (software token) for the user pool..." | tee -a "$LOG_FILE"
aws cognito-idp set-user-pool-mfa-config \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --user-pool-id "$USER_POOL_ID" \
    --mfa-configuration "ON" \
    --software-token-mfa-configuration Enabled=true

echo "Creating user pool domain '$DOMAIN_PREFIX'..." | tee -a "$LOG_FILE"
aws cognito-idp create-user-pool-domain \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --domain "$DOMAIN_PREFIX" \
    --user-pool-id "$USER_POOL_ID"

echo "Waiting for domain to activate (60 seconds)..." | tee -a "$LOG_FILE"
sleep 60

echo "Applying required minimal branding at pool level..." | tee -a "$LOG_FILE"
aws cognito-idp set-ui-customization \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --user-pool-id "$USER_POOL_ID" \
    --css ".banner-customizable {background-color:#000000;} .label-customizable {color:#FFFFFF;}"

echo "Creating app client for user pool..." | tee -a "$LOG_FILE"
APP_CLIENT_OUTPUT=$(aws cognito-idp create-user-pool-client \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --user-pool-id "$USER_POOL_ID" \
    --client-name "AareteMfaTestClient" \
    --generate-secret \
    --refresh-token-validity 30 \
    --allowed-o-auth-flows "code" \
    --allowed-o-auth-scopes "openid" "email" "profile" \
    --allowed-o-auth-flows-user-pool-client \
    --callback-urls "http://localhost:8080/login-callback" \
    --logout-urls "http://localhost:8080/logout" \
    --supported-identity-providers "COGNITO")

CLIENT_ID=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientId')
CLIENT_SECRET=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientSecret')

echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"



echo "Creating test user '$TEST_USER_EMAIL'..." | tee -a "$LOG_FILE"
aws cognito-idp admin-create-user \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --user-pool-id "$USER_POOL_ID" \
    --username "$TEST_USER_EMAIL" \
    --user-attributes Name=email,Value="$TEST_USER_EMAIL" Name=phone_number,Value="$TEST_USER_PHONE" \
    --temporary-password "$TEMP_PASSWORD" \
    --message-action "SUPPRESS"

aws cognito-idp admin-set-user-password \
    --region "$AWS_REGION" --profile "$AWS_PROFILE" \
    --user-pool-id "$USER_POOL_ID" \
    --username "$TEST_USER_EMAIL" \
    --password "$TEMP_PASSWORD" \
    --permanent

echo "==== Creation Summary ====" | tee -a "$LOG_FILE"
echo "User Pool ID: $USER_POOL_ID" | tee -a "$LOG_FILE"
echo "Domain URL: https://$DOMAIN_PREFIX.auth.$AWS_REGION.amazoncognito.com" | tee -a "$LOG_FILE"
echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"
echo "Test User: $TEST_USER_EMAIL" | tee -a "$LOG_FILE"