#!/bin/bash
# Complete device-flow authentication in bash

BASE="https://api.playanagrama.com"

# 1. Start auth
START=$(curl -s -X POST "$BASE/cli/auth/start" \
  -H "Content-Type: application/json" \
  -d '{"label":"terminal","clientName":"bash-script"}')

DEVICE_CODE=$(echo "$START" | jq -r '.device_code')
URL=$(echo "$START" | jq -r '.verification_url')
INTERVAL=$(echo "$START" | jq -r '.interval // 3')

echo "🔗 Open: $URL"
echo "   Waiting for approval..."

# 2. Poll loop
for i in $(seq 1 60); do
  sleep "$INTERVAL"
  POLL=$(curl -s -w "\n%{http_code}" -X POST "$BASE/cli/auth/poll" \
    -H "Content-Type: application/json" \
    -d "{\"device_code\":\"$DEVICE_CODE\"}")

  HTTP_CODE=$(echo "$POLL" | tail -1)
  BODY=$(echo "$POLL" | head -1)
  STATUS=$(echo "$BODY" | jq -r '.status // empty')

  if [ "$HTTP_CODE" = "200" ] && [ "$STATUS" = "approved" ]; then
    TOKEN=$(echo "$BODY" | jq -r '.token')
    echo "✅ Got token: ${TOKEN:0:20}..."
    # Use it: curl -H "Authorization: Bearer $TOKEN" ...
    exit 0
  elif [ "$HTTP_CODE" = "410" ]; then
    echo "❌ Session expired. Start over."
    exit 1
  elif [ "$HTTP_CODE" = "409" ]; then
    echo "❌ Token already consumed."
    exit 1
  fi
  printf "."
done

echo "❌ Timed out."
exit 1