#!/usr/bin/env bash
set -euo pipefail

REPO_DIR="/opt/NextWks"
TARGET_DIR="/opt/nextworkspace"
SERVICE_NAME="nextworkspace"
BINARY_NAME="nextworkspace"
HEALTH_CHECK_RETRIES=10
HEALTH_CHECK_INTERVAL=2

# --- Load .env from runtime root ---
ENV_FILE="$TARGET_DIR/.env"
if [ -f "$ENV_FILE" ]; then
    set -a
    source "$ENV_FILE"
    set +a
fi

# Default domain if .env wasn't loaded
DOMAIN="${DOMAIN:-nextwks.eu}"

# --- Mode detection ---
GREENFIELD=false
if [ "${1:-}" = "--destroy" ]; then
    GREENFIELD=true
    echo "[MODE] Greenfield deploy (--destroy)"
elif [ ! -d "$TARGET_DIR" ]; then
    GREENFIELD=true
    echo "[MODE] Greenfield deploy (target missing)"
else
    echo "[MODE] Smart update (target exists)"
fi

# --- Common: pull + build ---
cd "$REPO_DIR"
echo "[1/8] Pulling latest code..."
git pull

echo "[2/8] Building binary..."
export PATH=$PATH:/usr/local/go/bin
go build -o "$BINARY_NAME" .

# --- Greenfield path ---
if [ "$GREENFIELD" = true ]; then
    echo "[3/8] Removing old deployment..."
    rm -rf "$TARGET_DIR"

    echo "[4/8] Creating target directories..."
    mkdir -p "$TARGET_DIR/config/nextworkspace"
    mkdir -p "$TARGET_DIR/config/zoraxy/conf/proxy"
    mkdir -p "$TARGET_DIR/data/zoraxy"
    mkdir -p "$TARGET_DIR/compose"
    mkdir -p "$TARGET_DIR/logs"

    echo "[5/8] Copying binary..."
    cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"

    echo "[6/8] Deploying Zoraxy..."
    cp compose/zoraxy.yaml "$TARGET_DIR/compose/zoraxy.yaml"
    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" up -d 2>&1 || echo "[WARN] Zoraxy deploy had issues (see above)"

    # Generate Zoraxy proxy configs with actual domain
    echo "[*] Generating Zoraxy proxy configs..."
    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
{
    "ProxyType": 1,
    "RootOrMatchingDomain": "app.$DOMAIN",
    "ActiveOrigins": [{
        "OriginIpOrDomain": "127.0.0.1:9000",
        "RequireTLS": false,
        "Weight": 1,
        "MaxConn": 0
    }],
    "Disabled": false,
    "AuthenticationProvider": {"AuthMethod": 4}
}
ZORAXY_APP

    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/dns.$DOMAIN.config" <<ZORAXY_DNS
{
    "ProxyType": 1,
    "RootOrMatchingDomain": "dns.$DOMAIN",
    "ActiveOrigins": [{
        "OriginIpOrDomain": "127.0.0.1:8000",
        "RequireTLS": false,
        "Weight": 1,
        "MaxConn": 0
    }],
    "Disabled": false,
    "AuthenticationProvider": {"AuthMethod": 0}
}
ZORAXY_DNS

    # Copy launcher config files
    cp -r config/nextworkspace/* "$TARGET_DIR/config/nextworkspace/"

    # Create Zoraxy admin account
    echo "[*] Creating Zoraxy admin account..."
    ZORAXY_ADMIN_URL="http://127.0.0.1:8000/api/auth/register"

    # Wait for Zoraxy to be ready
    for i in $(seq 1 15); do
        if curl -sf "http://127.0.0.1:8000/api/auth/userCount" > /dev/null 2>&1; then
            break
        fi
        echo "  Waiting for Zoraxy... ($i/15)"
        sleep 2
    done

    # Fetch CSRF token from Zoraxy login page
    CSRF_TOKEN=$(curl -s http://127.0.0.1:8000/ | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
    if [ -z "$CSRF_TOKEN" ]; then
        echo "[WARN] Could not fetch CSRF token, trying without it..."
        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
            -d "username=${ADMIN_USERNAME:-admin}" \
            -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
    else
        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
            -H "X-CSRF-Token: $CSRF_TOKEN" \
            -d "username=${ADMIN_USERNAME:-admin}" \
            -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
    fi

    if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
        echo "[OK] Zoraxy admin account created"
    elif echo "$ADMIN_CREATE" | grep -qi '"error'; then
        echo "[WARN] Admin account may already exist: $ADMIN_CREATE"
    else
        echo "[INFO] Admin API response: $ADMIN_CREATE"
    fi

    # --- Login to Zoraxy API for authenticated operations ---
    echo "[*] Logging in to Zoraxy API..."
    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
    rm -f "$COOKIE_JAR"
    LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
        -d "username=${ADMIN_USERNAME:-master}" \
        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}")

    if echo "$LOGIN_RESPONSE" | grep -qi '"success"\|"ok"'; then
        echo "[OK] Logged in as $ADMIN_USERNAME"
    else
        echo "[WARN] Login response: $LOGIN_RESPONSE"
    fi

    # --- Configure Let's Encrypt ---
    echo "[*] Setting Let's Encrypt email..."
    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
        -d "set=${TLS_EMAIL}" > /dev/null

    echo "[*] Obtaining certificates for app.${DOMAIN}..."
    OBTAIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
        -G \
        -d "domains=app.${DOMAIN}" \
        -d "filename=app.${DOMAIN}" \
        -d "email=${TLS_EMAIL}" \
        -d "ca=Let's Encrypt" \
        -d "dns=false" 2>&1)

    if echo "$OBTAIN_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
        echo "[OK] Let's Encrypt certificate obtained for app.${DOMAIN}"
    else
        echo "[INFO] Certificate result: $OBTAIN_RESULT"
        echo "[INFO] This may fail in dev if DNS doesn't point here — auto-renew will retry."
    fi

    echo "[*] Enabling auto-renew..."
    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
        -d "enable=true" > /dev/null

    # --- Configure ZorxAuth SSO ---
    echo "[*] Configuring ZorxAuth SSO..."
    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/provider" \
        -d "enable=true" \
        -d "name=NextWorkspace" \
        -d "admin=${ADMIN_USERNAME}" > /dev/null

    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/gateway" \
        -d "redirect=https://app.${DOMAIN}/" > /dev/null

    echo "[OK] ZorxAuth SSO configured"

    # --- Generate launcher apps.yaml with actual domain ---
    cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
apps:
  - name: "NextWorkspace"
    subtitle: "Your Workspace"
    url: "https://app.${DOMAIN}/"
    icon: "home"
  - name: "Admin"
    subtitle: "Zoraxy Settings"
    url: "https://dns.${DOMAIN}/"
    icon: "settings"
EOF

    # --- Restart Zoraxy to apply config changes ---
    echo "[*] Restarting Zoraxy to apply configs..."
    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
    sleep 2

    # Write systemd service and start launcher
    echo "[7/8] Writing systemd service and starting launcher..."
    cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT
[Unit]
Description=NextWorkspace Launcher
After=network.target

[Service]
Environment=CONFIG_DIR=$TARGET_DIR/config/nextworkspace
ExecStart=$TARGET_DIR/$BINARY_NAME
WorkingDirectory=$TARGET_DIR
Restart=always
User=root
Group=root

[Install]
WantedBy=multi-user.target
UNIT

    systemctl daemon-reload
    systemctl enable --now $SERVICE_NAME

# --- Smart update path ---
else
    echo "[3/8] Stopping launcher..."
    systemctl stop $SERVICE_NAME 2>/dev/null || true

    echo "[4/8] Swapping binary..."
    cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"

    echo "[5/8] Refreshing configs..."
    if [ -f config/nextworkspace/apps.yaml ]; then
        cp config/nextworkspace/apps.yaml "$TARGET_DIR/config/nextworkspace/apps.yaml"
    fi
    if [ -d config/zoraxy/conf/proxy ]; then
        cp config/zoraxy/conf/proxy/* "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true
    fi

    echo "[6/8] Restarting Zoraxy..."
    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true

    echo "[7/8] Starting launcher..."
    systemctl restart $SERVICE_NAME
fi

# --- Health check ---
echo "[*] Running health check..."
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
    if curl -sf http://127.0.0.1:9000/health > /dev/null 2>&1; then
        echo "[OK] NextWorkspace launcher is healthy on http://127.0.0.1:9000/"
        exit 0
    fi
    echo "  Attempt $i/$HEALTH_CHECK_RETRIES — not ready yet..."
    sleep $HEALTH_CHECK_INTERVAL
done

echo "[FAIL] Health check failed — launcher did not respond on port 9000"
exit 1