<#
.SYNOPSIS
    Eksportuje certyfikat deweloperski ASP.NET Core (dotnet dev-certs) do formatu
    PEM używanego przez dev-serwer Vite (HTTPS).

.DESCRIPTION
    Zapewnia istnienie zaufanego certyfikatu deweloperskiego `dotnet dev-certs https`,
    a następnie eksportuje go do plików PEM (certyfikat + klucz prywatny) w katalogu
    client/.certs. Pliki są ignorowane przez Git i służą wyłącznie lokalnemu dev.

    Wymagany PowerShell Core 7+ (`pwsh`) — używamy metod PEM z .NET 7+.
#>
param(
    [string]$OutDir = (Join-Path $PSScriptRoot "..\client\.certs"),
    [string]$Password = "tarninahub-dev",
    [switch]$NoTrust
)

$ErrorActionPreference = "Stop"

if (-not (Get-Command dotnet -ErrorAction SilentlyContinue)) {
    throw "Nie znaleziono 'dotnet' w PATH. Zainstaluj .NET SDK 10+: https://dotnet.microsoft.com/download"
}

if ($NoTrust) {
    dotnet dev-certs https | Out-Host
}
else {
    dotnet dev-certs https --trust | Out-Host
}

$resolvedOut = [System.IO.Path]::GetFullPath($OutDir)
New-Item -ItemType Directory -Force -Path $resolvedOut | Out-Null

$pfxPath = Join-Path ([System.IO.Path]::GetTempPath()) ("tarninahub-dev-" + [guid]::NewGuid().ToString("N") + ".pfx")
$certPath = Join-Path $resolvedOut "dev.pem"
$keyPath = Join-Path $resolvedOut "dev-key.pem"

try {
    dotnet dev-certs https --export-path $pfxPath --password $Password | Out-Host

    $flags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($pfxPath, $Password, $flags)

    $certPem = [System.Security.Cryptography.PemEncoding]::Write(
        "CERTIFICATE", $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert))

    $privateKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
    if (-not $privateKey) {
        $privateKey = [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDsaPrivateKey($cert)
    }
    if (-not $privateKey) { throw "Certyfikat deweloperski nie zawiera klucza prywatnego (RSA/ECDSA)." }

    $keyPem = [System.Security.Cryptography.PemEncoding]::Write("PRIVATE KEY", $privateKey.ExportPkcs8PrivateKey())

    [System.IO.File]::WriteAllText($certPath, $certPem)
    [System.IO.File]::WriteAllText($keyPath, $keyPem)
}
finally {
    if (Test-Path -LiteralPath $pfxPath) {
        Remove-Item -LiteralPath $pfxPath -Force
    }
}

Write-Host "Certyfikat PEM: $certPath"
Write-Host "Klucz prywatny:  $keyPath"