setup_local.sh

#!/usr/bin/env bash
#
# setup_local.sh
#
# Set up the OGCR dynamic entities on a fresh LOCAL OBP-API, from start to finish:
#   1. Check DirectLogin works (.env: LOCAL_OBP_USERNAME / _PASSWORD / _CONSUMER_KEY).
#   2. Grant the logged in user CanCreateBank, if they don't hold it. OBP only allows
#      this to a user who may grant Roles, e.g. one in super_admin_user_ids.
#   3. Create the space bank (OBP_ENTITY_SPACE_ID, default ogcr) if it doesn't exist.
#   4. Regenerate entities_output.txt from the sheet and grant the user the definition,
#      Domain API and group Roles (create_entitlements.sh).
#   5. Check login and those Roles (check_login_and_roles.sh --no-entities). The record
#      Roles can't be checked yet: OBP grants them to whoever creates an entity, in step 6.
#   6. Recreate the entities, example data, Role Groups, resource docs and Glossary Items
#      (recreate_dynamic_entities.sh, which asks for confirmation unless --yes), then
#      grant any record Roles still missing and check all the Roles. The chain
#      entities (activity_on_chain, ...) are created inside that run, right after the
#      sheet's entities and before the docs that join them, with OGCR-chain-cache's
#      scripts/setup-entities.sh (OGCR_CHAIN_SETUP), when it is cloned next to this repo.
#
# Usage:
#   ./setup_local.sh [--yes] [--no-recreate] [--no-chain]
#
# --yes          pass --yes to recreate_dynamic_entities.sh (no confirmation)
# --no-recreate  stop after step 5 (Roles in place, nothing recreated)
# --no-chain     don't create the chain entities (the docs that join them are then skipped)
#
# Always LOCAL: it refuses to run with OBP_TARGET / --target set to anything else.
# Every step is safe to re-run; Roles and the bank are only created when missing.
# Run ./setup_venv.sh first.

set -euo pipefail

# Run from the directory this script lives in, so relative paths resolve.
cd "$(dirname "$0")"

if [ ! -x ".venv/bin/python" ]; then
  echo "No .venv; run ./setup_venv.sh first." >&2
  exit 1
fi
PYTHON=".venv/bin/python"
export PYTHON

ASSUME_YES=false
RECREATE=true
CHAIN=true
for arg in "$@"; do
  case "$arg" in
    --yes) ASSUME_YES=true ;;
    --no-recreate) RECREATE=false ;;
    --no-chain) CHAIN=false ;;
    --target=*|-*) echo "Unknown option: $arg (this script is LOCAL only)" >&2; exit 2 ;;
    *) echo "Unknown argument: $arg" >&2; exit 2 ;;
  esac
done

if [ -n "${OBP_TARGET:-}" ] && [ "$(echo "$OBP_TARGET" | tr '[:lower:]' '[:upper:]')" != "LOCAL" ]; then
  echo "setup_local.sh only works on LOCAL, not OBP_TARGET=${OBP_TARGET}." >&2
  exit 2
fi
export OBP_TARGET=LOCAL

CHAIN_SETUP="../OGCR-chain-cache/scripts/setup-entities.sh"

step() {
  echo
  echo "=================================================="
  echo " $1"
  echo "=================================================="
}

step "STEP 1-2: Log in, and make sure the user holds CanCreateBank"
# Logs in through obp_client.py (which also checks OBP is reachable) and prints
# what it did; never prints the token.
OBP_LOG_LEVEL="${OBP_LOG_LEVEL:-WARNING}" "$PYTHON" - <<'EOF'
import sys
import obp_target
from obp_client import token, obp_host, session, authorization, require_user_mode

require_user_mode("setup_local.sh")
if not token:
	sys.exit("✗ DirectLogin failed; check LOCAL_OBP_USERNAME, LOCAL_OBP_PASSWORD and LOCAL_OBP_CONSUMER_KEY in .env")
headers = {"Authorization": authorization(token), "Content-Type": "application/json"}

print(f"Host: {obp_host}  ({obp_target.describe()})")
me = session.get(f"{obp_host}/obp/v6.0.0/users/current", headers=headers)
if me.status_code != 200:
	sys.exit(f"✗ Could not read the current user ({me.status_code}): {me.text[:300]}")
user = me.json()
user_id = user["user_id"]
print(f"✓ Logged in as {user.get('username')} (user_id {user_id})")

held = {(e.get("role_name"), e.get("bank_id", "")) for e in user.get("entitlements", {}).get("list", [])}
if ("CanCreateBank", "") in held:
	print("✓ Already holds CanCreateBank")
else:
	r = session.post(f"{obp_host}/obp/v7.0.0/users/{user_id}/entitlements", headers=headers,
		json={"bank_id": "", "role_name": "CanCreateBank"})
	if r.status_code not in (200, 201):
		sys.exit(f"✗ Could not grant CanCreateBank ({r.status_code}): {r.text[:300]}\n"
			"  Granting Roles needs CanCreateEntitlementAtAnyBank, or the user's id in super_admin_user_ids in OBP-API's props.")
	print("✓ Granted CanCreateBank")
EOF

step "STEP 3: Space bank"
./create_space_bank.sh

step "STEP 4: Roles for the entities"
"$PYTHON" parse_minimum_fields.py --save
./create_entitlements.sh

step "STEP 5: Check login and the Roles needed to create the entities"
./check_login_and_roles.sh --no-entities

if [ "$RECREATE" = true ]; then
  step "STEP 6: Recreate the dynamic entities"
  if [ "$CHAIN" = true ] && [ -x "$CHAIN_SETUP" ]; then
    OGCR_CHAIN_SETUP="$(cd "$(dirname "$CHAIN_SETUP")" && pwd)/$(basename "$CHAIN_SETUP")"
    export OGCR_CHAIN_SETUP
    echo "The chain entities are created with ${OGCR_CHAIN_SETUP} (STEP 2b of the recreate)."
  else
    unset OGCR_CHAIN_SETUP
    if [ "$CHAIN" = true ]; then
      echo "⚠ No ${CHAIN_SETUP}: the chain entities are not created." >&2
      echo "  Clone or update OGCR-chain-cache next to this repo (it needs scripts/setup-entities.sh) and run this again." >&2
    else
      echo "⚠ --no-chain: the chain entities are not created." >&2
    fi
    CHAIN_DOCS="$(OBP_LOG_LEVEL=WARNING "$PYTHON" -c 'from parse_minimum_fields import CHAIN_CACHE_ENTITIES as chain
from dynamic_resource_docs import DOCS, entities_read
print(", ".join(n for n, d in DOCS.items() if set(entities_read(d)) & chain) or "(none)")' 2>/dev/null)" \
      || CHAIN_DOCS="the registry Queries that join activity_on_chain"
    echo "  Without them these Dynamic Resource Docs are skipped: ${CHAIN_DOCS}" >&2
  fi
  # A run that reports problems (e.g. docs skipped for a missing entity) still created
  # the entities, so their record Roles are granted and checked before it is passed on.
  RECREATE_STATUS=0
  if [ "$ASSUME_YES" = true ]; then
    ./recreate_dynamic_entities.sh --yes || RECREATE_STATUS=$?
  else
    ./recreate_dynamic_entities.sh || RECREATE_STATUS=$?
  fi
  step "STEP 6: Record Roles for the entities"
  ./create_entitlements.sh
  ./check_login_and_roles.sh
  if [ "$RECREATE_STATUS" -ne 0 ]; then
    echo
    echo "✗ The recreate reported problems (exit ${RECREATE_STATUS}); see STEP 6 above." >&2
    exit "$RECREATE_STATUS"
  fi
else
  echo
  echo "Skipping the recreate (--no-recreate). Run ./recreate_dynamic_entities.sh when ready."
  step "STEP 6: Glossary Items"
  # The recreate publishes them; without it, publish them here so OGCR-App's Help page works.
  ./publish_smart_contracts_glossary_item.sh --yes || echo "✗ The Smart Contracts Glossary Item was not published; see above." >&2
  ./publish_architecture_glossary_item.sh --yes || echo "✗ The Architecture Glossary Item was not published; see above." >&2
fi

echo
echo "Done."