#!/usr/bin/env bash
# Merchant Integration · signing helpers for bash + openssl (for trying the API by hand with curl).
# Spec: Integration Guide › Authentication. Self-test against the published test vector:  bash merchant-sign.sh
#
#   source merchant-sign.sh
#   BODY='{"platform":"evo"}'
#   merchant_curl POST /merchant/v1/games/list "$BODY"     # needs API_HOST, MERCHANT_CODE, SECRET_KEY in the environment

# body_sha256 <body>
body_sha256() { printf '%s' "$1" | openssl dgst -sha256 | awk '{print $NF}'; }

# merchant_sign <secretKey> <METHOD> <path> <merchantCode> <timestamp> <requestId> <body>
merchant_sign() {
  local s
  s=$(printf '%s\n%s\n%s\n%s\n%s\n%s' "$2" "$3" "$4" "$5" "$6" "$(body_sha256 "$7")")
  printf '%s' "$s" | openssl dgst -sha256 -hmac "$1" | awk '{print $NF}'
}

# merchant_curl <METHOD> <path> <body>: one signed call to https://$API_HOST<path>
merchant_curl() {
  local ts rid sig
  ts=$(($(date +%s) * 1000))
  rid=$(openssl rand -hex 16)
  sig=$(merchant_sign "$SECRET_KEY" "$1" "$2" "$MERCHANT_CODE" "$ts" "$rid" "$3")
  curl -sS -X "$1" "https://$API_HOST$2" \
    -H 'Content-Type: application/json; charset=utf-8' \
    -H "X-Merchant-Code: $MERCHANT_CODE" -H "X-Request-Id: $rid" \
    -H "X-Timestamp: $ts" -H "X-Signature: $sig" \
    --data-binary "$3"
}

if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
  body='{"txnId":"T7K2M9QXH4ZP8WNA","amount":"10.00"}'
  [[ $(body_sha256 "$body") == b8d0525520debc2d5e2c62e83d2303a4cd29ed0c18c4139e98196c76c14fc2b8 ]] || { echo "FAIL: body hash" >&2; exit 1; }
  sig=$(merchant_sign test-secret-key-0001 POST /wallet/debit M0001 1792000000000 req-0001 "$body")
  [[ $sig == e5273ee9fb4c05408af2f8b32b26b4b98bc891fb77e5ffe5b46f9c112ebe6589 ]] || { echo "FAIL: signature $sig" >&2; exit 1; }
  echo "merchant-sign.sh: self-test passed $sig"
fi