#!/usr/bin/env bash
#
# Build a standalone copy of the license generator to run on another of YOUR
# machines (Mac, Linux, Windows, or any Docker host).
#
#   bash tools/license/package.sh [output.zip]
#   # → core/dist/ravin-license-generator-<stamp>.zip   (dist/ never ships)
#
# The zip contains the plain signing key: anyone holding it can issue any
# license. Copy it with scp or a USB stick, not email or chat, and never onto
# a customer's server. Issued licenses are NOT included.
set -euo pipefail

DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"   # core/tools/license
CORE="$(cd "${DIR}/../.." && pwd)"
STAMP="$(date +%Y%m%d-%H%M%S)"
OUT="${1:-${CORE}/dist/ravin-license-generator-${STAMP}.zip}"
NAME="ravin-license-generator"

WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
B="${WORK}/${NAME}"

mkdir -p "$B/app/Support/License" "$B/tools" "$B/licenses"
cp "${CORE}/app/Support/License/LicenseSecret.php" \
   "${CORE}/app/Support/License/LicenseCanonical.php" \
   "${CORE}/app/Support/License/LicenseSigner.php" "$B/app/Support/License/"
rsync -a --exclude '.DS_Store' --exclude 'package.sh' "${DIR}/" "$B/tools/license/"
touch "$B/licenses/.keep"

cat > "$B/start.sh" <<'EOF'
#!/usr/bin/env bash
# Mac / Linux with PHP 8.1+:  bash start.sh
exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/tools/license/ui.sh" "$@"
EOF
cat > "$B/start-docker.sh" <<'EOF'
#!/usr/bin/env bash
# Any machine with Docker (no PHP needed):  bash start-docker.sh
exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/tools/license/docker/docker-run.sh" "$@"
EOF
printf '%s\r\n' '@echo off' 'rem Windows with PHP 8.1+ on PATH: double-click this file.' 'call "%~dp0tools\license\ui.cmd"' > "$B/start.cmd"
chmod +x "$B/start.sh" "$B/start-docker.sh" "$B/tools/license/ui.sh" "$B/tools/license/docker/docker-run.sh"

cat > "$B/README.md" <<'EOF'
# Ravin license generator (owner only)

This folder can sign Ravin licenses. **Keep it private.** Anyone who has it can
issue any license. Only put it on computers and servers you control. Never put
it on a customer's server.

## Start

| Machine | Command | Needs |
| --- | --- | --- |
| Mac / Linux | `bash start.sh` | PHP 8.1+ CLI |
| Windows | double-click `start.cmd` | PHP 8.1+ on PATH |
| Any server | `bash start-docker.sh` | Docker |

Then open <http://127.0.0.1:8099>. The page only answers on the machine it runs on.

## On a remote server

It still listens on the server's 127.0.0.1 only. From your own computer:

```bash
ssh -L 8099:127.0.0.1:8099 user@your-server
```

Leave that open and browse to <http://127.0.0.1:8099> on your computer.
Do not open port 8099 in the firewall.

## Where licenses go

`licenses/` next to this README (set `LICENSE_STORE` to change it). Each
license gets a folder with `license.php`, `record.json` and `README.md`, which
hold the authenticator reset secret. Back that folder up.

Licenses made on different machines are separate. Copy a customer's folder to
another machine's `licenses/` to renew it there.

Checking ionCube-encoded files needs the ionCube Loader in the local PHP. The
Docker image has no loader, so check the plain file before encoding there.
EOF

mkdir -p "$(dirname "$OUT")"
rm -f "$OUT"
( cd "$WORK" && zip -qr -X "$OUT" "$NAME" )
chmod 600 "$OUT"

echo "Package: $OUT"
echo "Contains the plain signing key. Copy it only to machines you control (scp / USB)."