setup-dev-env.ps1

<#
.SYNOPSIS
  Initializes the backend application environment by generating or updating the
  `.env` file with default or user-specified values and creating self-signed
  SSL certificates if missing.

.DESCRIPTION
  This script:
    - Checks for the existence of a `.env` file in `apps/backend/`
    - Adds default or user-provided values for required environment variables
    - Generates secure random secrets (JWT, API key)
    - Optionally enables API keys
    - Generates self-signed SSL certificates if not present in `nginx/certs/`

.NOTES
  Run this script from the root of the project directory.
  Requires OpenSSL to be installed and available in PATH.
  The `.env` file generated by this script is placed in
  the apps/backend root directory.
#>

# Disable output buffering for better prompt behavior
$Host.UI.RawUI.BufferSize = $Host.UI.RawUI.BufferSize

# Define file and path variables
$envFilePath = "apps/backend/.env"
$certPath = "nginx/certs"
$certCrtPath = "$certPath/ssl_certificate.crt"
$certKeyPath = "$certPath/ssl_certificate_key.key"

# -------------------------------------------------------------------
# SUPPORTING FUNCTIONS
# -------------------------------------------------------------------

# Adds an environment variable to the .env file if it doesn't already exist.
function Write-IfMissing {
    param (
        [string]$File,
        [string]$Key,
        [string]$Value
    )
    if (-not (Select-String -Path $File -Pattern "^$Key=" -Quiet)) {
        Write-Host "`"$Key`" was not found within the .env file!"
        Add-Content -Path $File -Value "$Key=$Value"
    }
}

# Prompts the user to enter a value, falling back to a default if left blank.
function Read-ForValue {
    param (
        [string]$Prompt,
        [string]$DefaultValue
    )
    $inputValue = Read-Host "$Prompt (leave blank to use default [$DefaultValue])"
    if ([string]::IsNullOrWhiteSpace($inputValue)) {
        return $DefaultValue
    }
    return $inputValue
}

# Generates a secure random hexadecimal string.
function New-RandomHex {
    param(
        [int]$Length
    )
    # Generate random bytes and convert to hex string
    $bytes = New-Object byte[] ($Length / 2)
    [Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
    return ($bytes | ForEach-Object { $_.ToString("x2") }) -join ''
}

# ---------------------- Begin main execution ----------------------
Write-Host "Starting environment setup..."

# Check for .env file existence
if (Test-Path $envFilePath) {
    Write-Host ".env already exists, therefore all unset environment variables will now be filled with default values."
    Write-Host "If you would like to regenerate the nginx secrets, please delete the files in $certPath and run this script."
} else {
    Write-Host ".env does not exist, creating..."
    # Create empty file
    New-Item -Path $envFilePath -ItemType File -Force | Out-Null
}


# Set NODE_ENV to development
Write-IfMissing -File $envFilePath -Key "NODE_ENV" -Value "development"

# Prompt for DATABASE_USERNAME if not set
$dbusername = "postgres"
if (-not (Select-String -Path $envFilePath -Pattern "^DATABASE_USERNAME=" -Quiet)) {
    Write-Host '"DATABASE_USERNAME" was not found within the .env file!'
    $dbusername = Read-ForValue -Prompt "Enter DATABASE_USERNAME" -DefaultValue $dbusername
    Add-Content -Path $envFilePath -Value "DATABASE_USERNAME=$dbusername"
}

# Prompt for DATABASE_PASSWORD if not set
if (-not (Select-String -Path $envFilePath -Pattern "^DATABASE_PASSWORD=" -Quiet)) {
    Write-Host '"DATABASE_PASSWORD" was not found within the .env file!'
    $dbpassword = Read-Host "Enter DATABASE_PASSWORD (leave blank to not set a password)"
    Add-Content -Path $envFilePath -Value "DATABASE_PASSWORD=$dbpassword"
}

# Prompt for JWT_EXPIRE_TIME or use default
$jwtexpiretime = "1d"
if (-not (Select-String -Path $envFilePath -Pattern "^JWT_EXPIRE_TIME=" -Quiet)) {
    Write-Host '"JWT_EXPIRE_TIME" was not found within the .env file!'
    $jwtexpiretime = Read-ForValue -Prompt "Enter JWT_EXPIRE_TIME ex. 1d or 25m" -DefaultValue $jwtexpiretime
    Add-Content -Path $envFilePath -Value "JWT_EXPIRE_TIME=$jwtexpiretime"
}

# Generate JWT_SECRET if not set
if (-not (Select-String -Path $envFilePath -Pattern "^JWT_SECRET=" -Quiet)) {
    Write-Host '"JWT_SECRET" was not found within the .env file!'
    $jwtsecret = New-RandomHex -Length 64
    Add-Content -Path $envFilePath -Value "JWT_SECRET=$jwtsecret"
}

# Optional: Enable API keys
if (-not (Select-String -Path $envFilePath -Pattern "^API_KEY_SECRET=" -Quiet)) {
    $enableApiKeys = Read-Host "Enable API keys (API_KEY_SECRET) [Y/n]"
    if ($enableApiKeys.ToUpper() -eq "Y" -or [string]::IsNullOrWhiteSpace($enableApiKeys)) {
        $apikey = New-RandomHex -Length 33
        Add-Content -Path $envFilePath -Value "API_KEY_SECRET=$apikey"
    }
}

# Prompt for NGINX_HOST if not set
if (-not (Select-String -Path $envFilePath -Pattern "^NGINX_HOST=" -Quiet)) {
    Write-Host ".env does not contain NGINX_HOST..."
    $nginxhost = Read-ForValue -Prompt "Enter your FQDN/Hostname/IP Address" -DefaultValue "127.0.0.1"
    Add-Content -Path $envFilePath -Value "NGINX_HOST=$nginxhost"
}

# Generate SSL certificate if missing
if (Test-Path $certCrtPath) {
    Write-Host "SSL Certificate already exists. If you would like to regenerate the certificates,"
    Write-Host "please delete the certificate files in $certPath and re-run this script."
} else {
    Write-Host "SSL Certificate does not exist, creating self-signed certificate..."
    Write-Host "Be sure your production environment is configured to work with your self-signed certificate."
    Write-Host "Generating certificate (Expires in 7 days)..."
    openssl req -newkey rsa:4096 -x509 -sha256 -days 7 -nodes `
      -out $certCrtPath -keyout $certKeyPath `
      -subj "/C=US/ST=SelfSigned/L=SelfSigned/O=SelfSigned/OU=SelfSigned"
    Write-Host "Certificates were generated"
}

Write-Host "Environment setup completed."