#!/usr/bin/env bash
# create_token.sh —— 在 Git Bash 中运行
set -euo pipefail
export LANG=C.UTF-8 LC_ALL=C.UTF-8

: "${CF_BOOT_TOKEN:?请先 export CF_BOOT_TOKEN=引导令牌}"

TOKEN_NAME="full-edit-token"   # 建议英文,创建后可在控制台改名
INCLUDE_ACCOUNT=true           # 包含账户级权限
INCLUDE_ZONE=true              # 包含区域(Zone)级权限
INCLUDE_USER=true              # 包含用户级权限
USER_ID="你的用户ID"            # 用户 ID(不是账户 ID),控制台头像→我的个人资料可查
ALLOW_IPS='[]'                 # 例如 '["1.2.3.4/32"]',空数组为不限制
EXPIRES_ON=""                  # 例如 "2027-01-01T00:00:00Z",空为永不过期
MAX_POLICIES=10                # Cloudflare 单个令牌的 policy 上限
EXCLUDE_REGEX="API Tokens?"    # 排除不可授予的权限组,如 "API Tokens?|Billing|Registrar",空为不排除

API="https://api.cloudflare.com/client/v4"
AUTH="Authorization: Bearer $CF_BOOT_TOKEN"

# 1. 拉取全部权限组
GROUPS_JSON=$(curl -s -H "$AUTH" "$API/user/tokens/permission_groups")
echo "$GROUPS_JSON" | jq -e '.success' >/dev/null \
  || { echo "获取权限组失败:"; echo "$GROUPS_JSON"; exit 1; }
echo "权限组总数: $(echo "$GROUPS_JSON" | jq '.result | length')"

# 2. 取某作用域下"每个下拉项的最高权限"的 id 列表
best_ids() {
  local scope="$1"
  echo "$GROUPS_JSON" | jq -c --arg scope "$scope" --arg ex "$EXCLUDE_REGEX" '
    [ .result[]
      | select(.scopes | index($scope))
      | select(if $ex == "" then true else (.name | test($ex) | not) end)
      | . as $g
      | ($g.name | capture("^(?<base>.*?)\\s+(?<lvl>Read|Write|Edit)$")? // {base:$g.name, lvl:"Other"}) as $m
      | {base:$m.base, id:$g.id,
         rank:(if $m.lvl=="Write" or $m.lvl=="Edit" then 2 elif $m.lvl=="Read" then 1 else 3 end)}
    ]
    | group_by(.base)
    | map(max_by(.rank) | {id})
  '
}

# 3. 收集各作用域的权限项
declare -a SCOPE_RES SCOPE_IDS
add_scope() {  # $1=资源JSON  $2=权限ID数组JSON
  local n
  n=$(echo "$2" | jq 'length')
  if [ "$n" -eq 0 ]; then echo "跳过空作用域: $1"; return 0; fi
  SCOPE_RES+=("$1"); SCOPE_IDS+=("$2")
}

if [ "$INCLUDE_ACCOUNT" = true ]; then
  add_scope '{"com.cloudflare.api.account.*":"*"}' "$(best_ids com.cloudflare.api.account)"
fi

if [ "$INCLUDE_ZONE" = true ]; then
  add_scope '{"com.cloudflare.api.account.zone.*":"*"}' "$(best_ids com.cloudflare.api.account.zone)"
fi

if [ "$INCLUDE_USER" = true ]; then
  add_scope "{\"com.cloudflare.api.user.$USER_ID\":\"*\"}" "$(best_ids com.cloudflare.api.user)"
fi

# 4. 自动计算每条 policy 的容量,使总条数 <= MAX_POLICIES
N=${#SCOPE_RES[@]}
[ "$N" -eq 0 ] && { echo "没有可提交的权限作用域"; exit 1; }
for i in $(seq 0 $((N-1))); do
  echo "作用域 $((i+1)): $(echo "${SCOPE_IDS[$i]}" | jq 'length') 个权限项  ${SCOPE_RES[$i]}"
done

if [ "$N" -gt "$MAX_POLICIES" ]; then
  echo "作用域数量已超过 policy 上限,请拆分令牌"; exit 1
fi

CHUNK=1
while :; do
  need=0
  for i in $(seq 0 $((N-1))); do
    c=$(echo "${SCOPE_IDS[$i]}" | jq 'length')
    need=$(( need + (c + CHUNK - 1) / CHUNK ))
  done
  [ "$need" -le "$MAX_POLICIES" ] && break
  CHUNK=$((CHUNK+1))
  [ "$CHUNK" -gt 1000 ] && { echo "无法满足上限"; exit 1; }
done
echo "自动选定每条 policy 容量: $CHUNK(预计 $need 条 policy)"

# 5. 生成 policies
POLICIES='[]'
for i in $(seq 0 $((N-1))); do
  P=$(jq -cn --argjson res "${SCOPE_RES[$i]}" --argjson ids "${SCOPE_IDS[$i]}" --argjson n "$CHUNK" '
    [ range(0; ($ids|length); $n) as $k
      | {effect:"allow", resources:$res, permission_groups:$ids[$k:$k+$n]} ]')
  POLICIES=$(jq -cn --argjson a "$POLICIES" --argjson b "$P" '$a + $b')
done

echo "将提交 $(echo "$POLICIES" | jq 'length') 条 policy,共 $(echo "$POLICIES" | jq '[.[].permission_groups|length]|add') 个权限项"

# 6. 组装请求体(写入文件,避免 shell/编码问题)
jq -n --arg name "$TOKEN_NAME" --argjson p "$POLICIES" \
  --argjson ips "$ALLOW_IPS" --arg exp "$EXPIRES_ON" '
  {name:$name, policies:$p}
  + (if ($ips|length)>0 then {condition:{"request.ip":{in:$ips}}} else {} end)
  + (if $exp != "" then {expires_on:$exp} else {} end)' > body.json

jq -e . body.json >/dev/null && echo "body.json 合法,大小: $(wc -c < body.json) 字节"

# 7. 创建令牌
RESP=$(curl -s -X POST "$API/user/tokens" \
  -H "$AUTH" -H "Content-Type: application/json; charset=utf-8" \
  --data-binary @body.json)

if [ "$(echo "$RESP" | jq -r '.success')" = "true" ]; then
  echo "创建成功,请立即保存(仅显示一次):"
  echo "$RESP" | jq -r '.result.value'
  rm -f body.json
else
  echo "创建失败:"
  echo "$RESP" | jq '.errors'
  echo "请求体保留在 body.json 中以便排查"
  echo "提示:若报错与用户级权限有关,把 INCLUDE_USER 改为 false 后重试"
  exit 1
fi

权限组总数: 413
作用域 1: 181 个权限项  {"com.cloudflare.api.account.*":"*"}
作用域 2: 51 个权限项  {"com.cloudflare.api.account.zone.*":"*"}
自动选定每条 policy 容量: 26(预计 9 条 policy)
将提交 9 条 policy,共 232 个权限项
body.json 合法,大小: 18871 字节
创建成功,请立即保存(仅显示一次):
cfut_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

[
  {
    "code": 6007,
    "message": "Malformed JSON in request body"
  }
]

policies must have a length lower than or equal to 10

{
  "code": 1001,
  "message": "sub-token is not allowed to have permissions to manage other tokens"
}

{
  "code": 9109,
  "message": "Unauthorized to access requested resource"
}

{
  "code": 6003,
  "message": "Invalid request headers",
  "error_chain": [
    {
      "code": 6111,
      "message": "Invalid format for Authorization header"
    }
  ]
}