# Regenerate self-signed server certificate for ShopDB nginx
# Run from repository root: .\certs\regenerate-server-cert.ps1

$ErrorActionPreference = "Stop"

$CertDir = "certs"
$DaysValid = 365

Write-Host "=== ShopDB Server Certificate Generator ===" -ForegroundColor Cyan
Write-Host ""

# Check if running from repo root
if (-not (Test-Path "docker-compose.yml")) {
    Write-Host "ERROR: Must run from repository root" -ForegroundColor Red
    Write-Host "Usage: .\certs\regenerate-server-cert.ps1"
    exit 1
}

# Backup old certificate
if (Test-Path "$CertDir\server.crt") {
    Write-Host "Backing up existing certificate..."
    Copy-Item "$CertDir\server.crt" "$CertDir\server.crt.backup" -Force
    Copy-Item "$CertDir\server.key" "$CertDir\server.key.backup" -Force

    $oldExpiry = openssl x509 -in "$CertDir\server.crt" -noout -enddate 2>$null
    Write-Host "  Old certificate: $oldExpiry"
}

# Generate new certificate
Write-Host ""
Write-Host "Generating new self-signed certificate (valid $DaysValid days)..." -ForegroundColor Yellow

openssl req -x509 -newkey rsa:2048 -nodes `
  -keyout "$CertDir\server.key" `
  -out "$CertDir\server.crt" `
  -days $DaysValid `
  -config "$CertDir\openssl.cnf" 2>$null

Write-Host ""
Write-Host "Certificate generated successfully!" -ForegroundColor Green
Write-Host ""

# Show certificate details
Write-Host "=== Certificate Details ===" -ForegroundColor Cyan
openssl x509 -in "$CertDir\server.crt" -noout -subject -dates -fingerprint -sha256

Write-Host ""
Write-Host "=== Next Steps ===" -ForegroundColor Yellow
Write-Host "1. Restart nginx: docker-compose restart nginx"
Write-Host "2. If agents use ServerCertThumbprint pinning:"
Write-Host "   - Update appsettings.json with new thumbprint (shown above)"
Write-Host "   - Restart all agents BEFORE old certificate expires"
Write-Host ""