param(
    [string]$UserId = "default"
)

$ErrorActionPreference = "Stop"

$configPath = Join-Path $env:USERPROFILE ".adclaw\config.json"
if (-not (Test-Path -LiteralPath $configPath)) {
    throw "MaskanX config not found at $configPath"
}

$config = Get-Content -LiteralPath $configPath -Raw | ConvertFrom-Json
$linkedin = $config.mcp.clients.linkedin
if (-not $linkedin) {
    throw "LinkedIn MCP config was not found in $configPath"
}

$env:LINKEDIN_CLIENT_ID = $linkedin.env.LINKEDIN_CLIENT_ID
$env:LINKEDIN_CLIENT_SECRET = $linkedin.env.LINKEDIN_CLIENT_SECRET
$env:LINKEDIN_REDIRECT_URI = "http://localhost:44002/auth/linkedin/callback"

if (-not $env:LINKEDIN_CLIENT_ID -or -not $env:LINKEDIN_CLIENT_SECRET) {
    throw "LINKEDIN_CLIENT_ID or LINKEDIN_CLIENT_SECRET is missing in MaskanX config."
}

$helper = Get-ChildItem -Path (Join-Path $env:LOCALAPPDATA "npm-cache\_npx") `
    -Recurse `
    -Filter "auth-helper.js" `
    -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -like "*linkedin-mcp-server*bin*" } |
    Select-Object -First 1

if (-not $helper) {
    throw "linkedin-mcp-server auth-helper.js was not found. Start MaskanX once so npx installs linkedin-mcp-server, then retry."
}

$postingScope = "w_member_social"
$packageRoot = Split-Path -Parent (Split-Path -Parent $helper.FullName)
$authJsPath = Join-Path $packageRoot "dist\utils\linkedin-auth.js"

if (Test-Path -LiteralPath $authJsPath) {
    $authJs = Get-Content -LiteralPath $authJsPath -Raw
    if ($authJs -notmatch [regex]::Escape($postingScope)) {
        $patchedAuthJs = $authJs -replace "('email')(\s*\r?\n\s*)\]", "`$1,`$2    '$postingScope'`r`n]"
        Set-Content -LiteralPath $authJsPath -Value $patchedAuthJs -Encoding UTF8
        Write-Host "Patched LinkedIn MCP OAuth scopes to include $postingScope." -ForegroundColor Green
    }
}

$linkedinDir = Join-Path $env:USERPROFILE ".linkedin-mcp"
$usersPath = Join-Path $linkedinDir "users.json"
if (Test-Path -LiteralPath $usersPath) {
    $users = Get-Content -LiteralPath $usersPath -Raw | ConvertFrom-Json
    $userEntry = $users.$UserId
    if ($userEntry -and ($userEntry.scopes -notcontains $postingScope)) {
        $userEntry.scopes = @($userEntry.scopes) + $postingScope
        $users | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $usersPath -Encoding UTF8
        Write-Host "Updated saved LinkedIn user scopes to include $postingScope." -ForegroundColor Green
    }
}

$tokensPath = Join-Path $linkedinDir "tokens_$UserId.json"
if (Test-Path -LiteralPath $tokensPath) {
    $backupPath = "$tokensPath.before-posting-scope.bak"
    Copy-Item -LiteralPath $tokensPath -Destination $backupPath -Force
    Remove-Item -LiteralPath $tokensPath -Force
    Write-Host "Cleared old LinkedIn token so OAuth can request posting permission." -ForegroundColor Green
}

Write-Host ""
Write-Host "LinkedIn OAuth setup starting..." -ForegroundColor Cyan
Write-Host ""
Write-Host "Before continuing, make sure LinkedIn Developer Portal has this exact redirect URL:" -ForegroundColor Yellow
Write-Host "http://localhost:44002/auth/linkedin/callback"
Write-Host ""
Write-Host "A LinkedIn URL will be printed below. If the browser does not open, copy that URL manually."
Write-Host "After approving LinkedIn, wait for this script to finish."
Write-Host ""

node $helper.FullName setup --user-id $UserId --debug

Write-Host ""
Write-Host "Checking LinkedIn auth status..." -ForegroundColor Cyan
node $helper.FullName status --user-id $UserId