# Creates only local development secrets and a SMTP test certificate. No default administrator password.
$ErrorActionPreference = 'Stop'
$root = $PSScriptRoot
$envPath = Join-Path $root '.env.local'
if (!(Test-Path -LiteralPath $envPath)) {
    function New-Secret { [Convert]::ToHexString([Security.Cryptography.RandomNumberGenerator]::GetBytes(32)) }
    $entries = @(
        ('MYSQL_ROOT_PASSWORD=' + (New-Secret))
        ('MYSQL_PASSWORD=' + (New-Secret))
        ('RABBITMQ_PASSWORD=' + (New-Secret))
        ('S3_PASSWORD=' + (New-Secret))
        ('MANAGEMENT_INTERNAL_KEY=' + (New-Secret))
        ('JWT_KEY=' + (New-Secret))
        ('CREDENTIAL_KEY=' + [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(32)))
    )
    [IO.File]::WriteAllLines($envPath, $entries)
}
$certRoot = Join-Path $root 'data/certs'
New-Item -ItemType Directory -Force -Path $certRoot | Out-Null
if (!(Test-Path -LiteralPath (Join-Path $certRoot 'smtp.crt'))) {
    $rsa = [Security.Cryptography.RSA]::Create(2048)
    $request = [Security.Cryptography.X509Certificates.CertificateRequest]::new('CN=localhost', $rsa, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1)
    $san = [Security.Cryptography.X509Certificates.SubjectAlternativeNameBuilder]::new()
    $san.AddDnsName('localhost'); $san.AddDnsName('smtp'); $san.AddIpAddress([Net.IPAddress]::Loopback)
    $request.CertificateExtensions.Add($san.Build())
    $cert = $request.CreateSelfSigned([DateTimeOffset]::UtcNow.AddMinutes(-5), [DateTimeOffset]::UtcNow.AddMonths(6))
    [IO.File]::WriteAllText((Join-Path $certRoot 'smtp.crt'), $cert.ExportCertificatePem())
    [IO.File]::WriteAllText((Join-Path $certRoot 'smtp.key'), $rsa.ExportPkcs8PrivateKeyPem())
    $rsa.Dispose(); $cert.Dispose()
}
Write-Output 'Local dependency secrets and SMTP certificate are ready. No administrator account was created.'