#!/usr/bin/env bash
# Export CDR (Call Detail Records) from a CodeB tenant.
# European Digital Identity Wallet-enabled tenants use the same key surface.
# [compliance-archive-cookbook 2026-07-23]
#
# Auth: Bearer ak_... OR X-CodeB-Admin-Signature HMAC OR admin OIDC bearer.
# Endpoint (live-verified in signal.ashx):
#   GET /signal.ashx?cdrlog=1[&direction=in|out|transit][&trunk=SLUG][&date=YYYY-MM-DD][&limit=N][&q=NUMBER][&format=csv]
# JSON envelope: { ts, events[], count, trunks[], dates[] }
# CSV columns: recordedUtc, startUtc, endUtc, direction, trunk, callingNumber,
#              calledNumber, durationSec, answered, outcome, releaseReason
set -euo pipefail

: "${CODEB_TENANT:?export CODEB_TENANT=https://phone.example.tld}"
: "${CODEB_API_KEY:?export CODEB_API_KEY=ak_...}"
DATE_FROM="${DATE_FROM:-$(date -u -d '7 days ago' +%F 2>/dev/null || date -u -v-7d +%F)}"
OUT_FILE="${OUT_FILE:-./cdr-$(date -u +%Y%m%d-%H%M%S).csv}"

curl -sSf \
  -H "Authorization: Bearer ${CODEB_API_KEY}" \
  "${CODEB_TENANT}/signal.ashx?cdrlog=1&date=${DATE_FROM}&limit=5000&format=csv" \
  -o "$OUT_FILE"

echo "[done] wrote $OUT_FILE"