#!/bin/bash
# get.scope.from.key.sh - Retrieves the scope (project/environment) for a Permit.io API key
#
# Usage: ./get.scope.from.key.sh <PERMIT_API_KEY>
#
# This script calls the Permit.io API to introspect the provided API key and
# returns the organization, project, and environment IDs and names associated with it.

if [ -z "$1" ]; then
    echo "Usage: $0 <PERMIT_API_KEY>" >&2
    echo "Example: $0 permit_key_abc123..." >&2
    exit 1
fi

API_KEY="$1"
BASE_URL="https://api.permit.io"

# Get the scope IDs
SCOPE=$(curl -s -H "Authorization: Bearer ${API_KEY}" "${BASE_URL}/v2/api-key/scope")

if [ -z "$SCOPE" ] || echo "$SCOPE" | jq -e '.error' > /dev/null 2>&1; then
    echo "Error fetching API key scope:"
    echo "$SCOPE" | jq
    exit 1
fi

ORG_ID=$(echo "$SCOPE" | jq -r '.organization_id // empty')
PROJECT_ID=$(echo "$SCOPE" | jq -r '.project_id // empty')
ENV_ID=$(echo "$SCOPE" | jq -r '.environment_id // empty')

echo "API Key Scope"
echo "============="
echo ""

# Organization info
if [ -n "$ORG_ID" ]; then
    echo "Organization:"
    echo "  ID: $ORG_ID"
fi

# Project info - fetch name if we have a project ID
if [ -n "$PROJECT_ID" ]; then
    PROJECT_INFO=$(curl -s -H "Authorization: Bearer ${API_KEY}" "${BASE_URL}/v2/projects/${PROJECT_ID}" 2>/dev/null)
    PROJECT_NAME=$(echo "$PROJECT_INFO" | jq -r '.name // empty' 2>/dev/null)
    PROJECT_KEY=$(echo "$PROJECT_INFO" | jq -r '.key // empty' 2>/dev/null)

    echo ""
    echo "Project:"
    echo "  ID:   $PROJECT_ID"
    if [ -n "$PROJECT_NAME" ]; then
        echo "  Name: $PROJECT_NAME"
    fi
    if [ -n "$PROJECT_KEY" ]; then
        echo "  Key:  $PROJECT_KEY"
    fi
fi

# Environment info - fetch name if we have an environment ID
if [ -n "$ENV_ID" ] && [ -n "$PROJECT_ID" ]; then
    ENV_INFO=$(curl -s -H "Authorization: Bearer ${API_KEY}" "${BASE_URL}/v2/projects/${PROJECT_ID}/envs/${ENV_ID}" 2>/dev/null)
    ENV_NAME=$(echo "$ENV_INFO" | jq -r '.name // empty' 2>/dev/null)
    ENV_KEY=$(echo "$ENV_INFO" | jq -r '.key // empty' 2>/dev/null)

    echo ""
    echo "Environment:"
    echo "  ID:   $ENV_ID"
    if [ -n "$ENV_NAME" ]; then
        echo "  Name: $ENV_NAME"
    fi
    if [ -n "$ENV_KEY" ]; then
        echo "  Key:  $ENV_KEY"
    fi
fi

# Determine key type
echo ""
echo "---"
if [ -n "$ENV_ID" ]; then
    echo "Key Type: Environment-scoped (can use: -project use-key)"
elif [ -n "$PROJECT_ID" ]; then
    echo "Key Type: Project-scoped (can use: -project use-key -env <env_key>)"
else
    echo "Key Type: Organization-scoped (must use: -project <project_key> -env <env_key>)"
fi