#!/bin/bash
# Uppdatera nginx-config för LandveX Finance

set -euo pipefail

NGINX_CONF="/etc/nginx/sites-enabled/landvex-ssl.conf"
BACKUP="${NGINX_CONF}.bak-$(date +%s)"

# Backup
cp "$NGINX_CONF" "$BACKUP"
echo "Backup: $BACKUP"

# Ta bort basic auth-blocket och ersätt med JWT-version
python3 << 'PYEOF'
import re

with open("/etc/nginx/sites-enabled/landvex-ssl.conf", "r") as f:
    content = f.read()

# Hitta och ersätt finance-blocket
old_block = '''    # ── Finance — lösenordsskyddad ──────────────────────────────────────
        location = /ouroboros/finance/whoami {
        auth_basic "LandveX Finance";
        auth_basic_user_file /etc/nginx/auth/finance.htpasswd;
        add_header Content-Type "application/json" always;
        add_header Cache-Control "no-store" always;
        return 200 '{"user":"$remote_user"}';
    }

    location /ouroboros/finance/ {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        alias /opt/amos/public/ouroboros/finance/;
        index index.html;
        auth_basic "LandveX Finance";
        auth_basic_user_file /etc/nginx/auth/finance.htpasswd;
        try_files $uri $uri/ /ouroboros/finance/index.html;
    }'''

new_block = '''    # ── Finance — JWT-baserad auth (ingen basic auth) ───────────────────
    location = /ouroboros/finance/whoami {
        add_header Content-Type "application/json" always;
        add_header Cache-Control "no-store" always;
        return 200 '{"status":"jwt-auth-required","message":"Send JWT in Authorization header"}';
    }

    location /ouroboros/finance/ {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
        alias /opt/amos/public/ouroboros/finance/;
        index index.html;
        try_files $uri $uri/ /ouroboros/finance/index.html;
    }'''

content = content.replace(old_block, new_block)

# Ta bort hårdkodat intern token
content = content.replace('proxy_set_header Authorization "Bearer wavult-amos-internal-2026";', '')

with open("/etc/nginx/sites-enabled/landvex-ssl.conf", "w") as f:
    f.write(content)

print("Nginx config uppdaterad")
PYEOF

# Testa nginx config
nginx -t && echo "NGINX_OK" || {
    echo "NGINX_FAIL — återställer backup"
    cp "$BACKUP" "$NGINX_CONF"
    exit 1
}

# Ladda om nginx
systemctl reload nginx && echo "RELOAD_OK" || echo "RELOAD_FAIL"