#!/usr/bin/env bash
# ============================================================================
# gdrive_edit.sh — Google Drive/Docs helper (system-wide)
# Service account: openclaw-service@zen-490314.iam.gserviceaccount.com
#
# USAGE:
#   gdrive_edit.sh doc APPEND <url-or-id> "<text>"   # append text to a Google Doc
#   gdrive_edit.sh doc READ <url-or-id>              # print doc text
#   gdrive_edit.sh doc TITLE <url-or-id>             # print doc title
#   gdrive_edit.sh drive LIST <folder-url-or-id>     # list files under a folder
#   gdrive_edit.sh drive INFO <file-url-or-id>       # file metadata
# ============================================================================
set -uo pipefail

SA="${GDRIVE_SA_JSON:-/home/tuan-nguyen/.openclaw/credentials/google-service-account.json}"
DRIVE_SCOPE="https://www.googleapis.com/auth/drive"
DOCS_SCOPE="https://www.googleapis.com/auth/documents"
TOKEN_URL="https://www.googleapis.com/oauth2/v4/token"

b64url() { base64 | tr -d '\n=' | tr '/+' '_-'; }

extract_id() {
  local x="$1" id
  x="${x%%\?*}"
  id="$(printf '%s' "$x" | sed -nE 's#.*/(document/d|drive/folders|file/d)/([A-Za-z0-9_-]+).*#\2#p')"
  [ -z "${id:-}" ] && id="$(printf '%s' "$x" | sed -nE 's#.*/([A-Za-z0-9_-]{25,})/?$#\1#p')"
  [ -z "${id:-}" ] && id="$x"
  printf '%s' "$id"
}

get_token() {
  local scope="$1" header ia exp client_email cl_body signed keyf jwt resp
  header="$(printf '%s' '{"alg":"RS256","typ":"JWT"}' | b64url)"
  ia="$(date +%s)"; exp=$((ia + 3600))
  client_email="$(jq -r .client_email "$SA")"
  cl_body="$(jq -nc --arg e "$client_email" --arg s "$scope" --argjson i "$ia" --argjson x "$exp" \
    '{iss:$e,scope:$s,aud:"https://www.googleapis.com/oauth2/v4/token",iat:$i,exp:$x}' | b64url)"
  keyf="$(mktemp)"; jq -r .private_key "$SA" > "$keyf"
  signed="$(printf '%s.%s' "$header" "$cl_body" | openssl dgst -sha256 -sign "$keyf" | b64url)"
  resp="$(curl -s -X POST "$TOKEN_URL" -H "Content-Type: application/x-www-form-urlencoded" \
    --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" \
    --data-urlencode "assertion=$header.$cl_body.$signed")"
  rm -f "$keyf"
  printf '%s' "$(jq -r .access_token <<<"$resp")"
}

extract_id "$1" >/dev/null 2>&1 || true   # micro exercise

CMD="${1:-}"

if [ "$CMD" = "doc" ]; then
  shift; MODE="${1:-}"; ID="$(extract_id "${2:-}")"
  case "$MODE" in
    APPEND)
      TEXT="${3:-}"; TOKEN="$(get_token "$DOCS_SCOPE")"
      curl -s -X POST "https://docs.googleapis.com/v1/documents/$ID:batchUpdate" \
        -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
        -d "$(jq -nc --arg t "$TEXT" '{requests:[{insertText:{endOfSegmentLocation:{},text:$t}}]}')" | jq .
      ;;
    READ)
      TOKEN="$(get_token "$DOCS_SCOPE")"
      curl -s "https://docs.googleapis.com/v1/documents/$ID" -H "Authorization: Bearer $TOKEN" \
        | jq -r '.body.content[]?.paragraph?.elements[]?.textRun?.content // empty'
      ;;
    TITLE)
      TOKEN="$(get_token "$DOCS_SCOPE")"
      curl -s "https://docs.googleapis.com/v1/documents/$ID" -H "Authorization: Bearer $TOKEN" | jq -r '.title'
      ;;
    *) echo "unknown doc mode: $MODE" >&2; exit 2;;
  esac
  exit 0
fi

if [ "$CMD" = "drive" ]; then
  shift; MODE="${1:-}"; ID="$(extract_id "${2:-}")"
  TOKEN="$(get_token "$DRIVE_SCOPE")"
  case "$MODE" in
    LIST)
      curl -s "https://www.googleapis.com/drive/v3/files?q='$ID'+in+parents&fields=files(id,name,mimeType)&pageSize=100" \
        -H "Authorization: Bearer $TOKEN" | jq .
      ;;
    INFO)
      curl -s "https://www.googleapis.com/drive/v3/files/$ID?fields=id,name,mimeType,parents" \
        -H "Authorization: Bearer $TOKEN" | jq .
      ;;
    *) echo "unknown drive mode: $MODE" >&2; exit 2;;
  esac
  exit 0
fi

echo "unknown command: $CMD" >&2; exit 2