#!/bin/bash
#
# Phase 3: Identity Provider Secrets
# Manual identity-provider setup, recorded in the local operator secret file.
#

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/config.sh"

log_info "=========================================="
log_info "Phase 3: Identity Provider Secrets"
log_info "=========================================="

SECRETS_FILE="${STATE_DIR}/secrets/${ENVIRONMENT}.env"

log_warning "This phase requires manual identity-provider configuration"
log_info "See docs/deployment/DEPLOYMENT_GUIDE.md for detailed instructions"

# Check if secrets already exist
log_step "3.1 Checking for existing identity-provider configuration..."

if [ -f "${SECRETS_FILE}" ]; then
  # shellcheck source=/dev/null
  source "${SECRETS_FILE}"
fi

if [ -n "${OIDC_ISSUER:-}" ] || [ -n "${VC_ISSUER_DID:-}" ] || [ -n "${VC_ISSUER_DOMAIN:-}" ]; then
  log_success "Identity-provider configuration found in ${SECRETS_FILE}"
  [ -n "${OIDC_ISSUER:-}" ] && log_info "OIDC issuer: ${OIDC_ISSUER}"
  [ -n "${VC_ISSUER_DID:-}" ] && log_info "VC issuer DID: ${VC_ISSUER_DID}"
  [ -n "${VC_ISSUER_DOMAIN:-}" ] && log_info "VC issuer domain: ${VC_ISSUER_DOMAIN}"
else
  log_warning "Identity-provider configuration not found"
  log_info "Please complete manual steps:"
  log_info "  1. Set OIDC issuer and client details if this environment uses OIDC"
  log_info "  2. Set VC_ISSUER_DID or VC_ISSUER_DOMAIN for credential issuance"
  log_info "  3. Store those values in ${SECRETS_FILE}"
  log_info ""
fi

# Save state
save_state "phase3" "manual-steps-required"

log_success "=========================================="
log_success "Phase 3: Identity Provider Secrets - Manual steps required"
log_success "=========================================="