setup-security.sh

#!/bin/bash

# 🔐 Security Setup Script for Noted Application
# This script helps prepare the project for deployment

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo -e "${GREEN}🔐 Noted Application - Security Setup Script${NC}\n"

# Check if git-filter-repo is installed
check_git_filter_repo() {
    if ! command -v git-filter-repo &> /dev/null; then
        echo -e "${YELLOW}⚠️  git-filter-repo not found${NC}"
        echo "Install with: pip install git-filter-repo"
        echo "Then run this script again"
        exit 1
    fi
}

# Generate random secrets
generate_secrets() {
    echo -e "${YELLOW}📝 Generating secure secrets...${NC}\n"
    
    DB_PASS=$(openssl rand -hex 16)
    JWT_SECRET=$(openssl rand -hex 32)
    
    echo -e "${GREEN}✅ Generated secrets:${NC}"
    echo "DB_PASSWORD: $DB_PASS"
    echo "JWT_SECRET: $JWT_SECRET"
    echo ""
    
    # Create .env if it doesn't exist
    if [ ! -f ".env" ]; then
        echo -e "${YELLOW}📝 Creating root .env file...${NC}"
        cp .env.example .env
        sed -i "s/change_me_strong_password_here_min_12_chars/$DB_PASS/" .env
        echo -e "${GREEN}✅ Root .env created${NC}\n"
    else
        echo -e "${YELLOW}⚠️  .env already exists, skipping${NC}\n"
    fi
    
    # Create backend .env
    if [ ! -f "backend/.env" ]; then
        echo -e "${YELLOW}📝 Creating backend/.env...${NC}"
        cp backend/.env.example backend/.env
        sed -i "s/change_me_strong_password/$DB_PASS/" backend/.env
        sed -i "s/change_me_generate_strong_random_key_32_chars/$JWT_SECRET/" backend/.env
        sed -i "s/generate_strong_random_32_character_key_here/$JWT_SECRET/" backend/.env
        echo -e "${GREEN}✅ backend/.env created${NC}\n"
    else
        echo -e "${YELLOW}⚠️  backend/.env already exists, skipping${NC}\n"
    fi
    
    # Create frontend .env
    if [ ! -f "NoteFront/.env" ]; then
        echo -e "${YELLOW}📝 Creating NoteFront/.env...${NC}"
        cp NoteFront/.env.example NoteFront/.env
        echo -e "${GREEN}✅ NoteFront/.env created${NC}"
        echo -e "${RED}⚠️  MANUAL STEP: Edit NoteFront/.env and add Firebase credentials${NC}\n"
    else
        echo -e "${YELLOW}⚠️  NoteFront/.env already exists, skipping${NC}\n"
    fi
}

# Check if .env files are in git
check_env_in_git() {
    echo -e "${YELLOW}🔍 Checking for .env files in git...${NC}\n"
    
    ENV_FILES=$(git ls-files | grep -E '\.env$' || true)
    
    if [ -z "$ENV_FILES" ]; then
        echo -e "${GREEN}✅ No .env files in git (good!)${NC}\n"
    else
        echo -e "${RED}❌ Found .env files in git:${NC}"
        echo "$ENV_FILES"
        echo ""
        
        read -p "Remove from git history? (y/n) " -n 1 -r
        echo ""
        
        if [[ $REPLY =~ ^[Yy]$ ]]; then
            check_git_filter_repo
            echo -e "${YELLOW}Running git-filter-repo...${NC}"
            git-filter-repo --invert-paths --path backend/.env --path NoteFront/.env
            echo -e "${GREEN}✅ Removed from git history${NC}"
            echo -e "${RED}⚠️  WARNING: Run 'git push --force-all' to push to all branches${NC}\n"
        fi
    fi
}

# Create SSL certificate
generate_ssl() {
    echo -e "${YELLOW}🔐 Setting up SSL certificates...${NC}\n"
    
    if [ -f "Nginx/https/certificate.crt" ]; then
        echo -e "${YELLOW}⚠️  SSL certificate already exists${NC}\n"
        return
    fi
    
    echo "Choose SSL setup:"
    echo "1) Self-signed (development)"
    echo "2) Skip (for production, add certificates manually)"
    read -p "Select (1-2): " -n 1 -r
    echo ""
    
    if [[ $REPLY == "1" ]]; then
        echo -e "${YELLOW}Generating self-signed certificate...${NC}"
        mkdir -p Nginx/https
        openssl req -x509 -newkey rsa:4096 \
            -keyout Nginx/https/private.key \
            -out Nginx/https/certificate.crt \
            -days 365 -nodes \
            -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost"
        echo -e "${GREEN}✅ Self-signed certificate created${NC}\n"
    else
        echo -e "${YELLOW}📝 For production, add certificates to:${NC}"
        echo "- Nginx/https/certificate.crt"
        echo "- Nginx/https/private.key\n"
    fi
}

# Verify project structure
verify_structure() {
    echo -e "${YELLOW}✅ Verifying project structure...${NC}\n"
    
    required_files=(
        ".env.example"
        "backend/.env.example"
        "NoteFront/.env.example"
        "backend/.gitignore"
        "NoteFront/.gitignore"
        "DEPLOYMENT_GUIDE.md"
        "SECURITY_NOTES.md"
    )
    
    missing=0
    for file in "${required_files[@]}"; do
        if [ ! -f "$file" ]; then
            echo -e "${RED}❌ Missing: $file${NC}"
            ((missing++))
        else
            echo -e "${GREEN}✅ $file${NC}"
        fi
    done
    
    if [ $missing -eq 0 ]; then
        echo -e "${GREEN}\n✅ All required files present${NC}\n"
    else
        echo -e "${RED}\n❌ Missing $missing required files${NC}\n"
    fi
}

# Firebase setup
setup_firebase() {
    echo -e "${YELLOW}🔥 Firebase Configuration${NC}\n"
    
    if [ -f "backend/firebase-credentials.json" ]; then
        echo -e "${GREEN}✅ firebase-credentials.json found${NC}\n"
    else
        echo -e "${RED}❌ firebase-credentials.json NOT found${NC}"
        echo "Instructions:"
        echo "1. Go to https://console.firebase.google.com"
        echo "2. Select your project"
        echo "3. Settings → Service Accounts → Generate new private key"
        echo "4. Save as: backend/firebase-credentials.json"
        echo ""
    fi
}

# Main execution
main() {
    verify_structure
    
    echo -e "${YELLOW}Starting security setup...${NC}\n"
    
    generate_secrets
    check_env_in_git
    generate_ssl
    setup_firebase
    
    echo -e "${GREEN}✅ Security setup complete!${NC}\n"
    echo -e "${YELLOW}📋 Next steps:${NC}"
    echo "1. Edit all .env files with your configuration"
    echo "2. Add Firebase credentials: backend/firebase-credentials.json"
    echo "3. For production: Update domain in Nginx/default.conf"
    echo "4. Run: docker-compose build"
    echo "5. Run: docker-compose up -d"
    echo ""
    echo -e "${YELLOW}📚 Documentation:${NC}"
    echo "- Deployment: cat DEPLOYMENT_GUIDE.md"
    echo "- Security: cat SECURITY_NOTES.md"
    echo ""
}

main