#!/usr/bin/env bash
set -Eeuo pipefail

APP_DIR="${APP_DIR:-/opt/cmpp-platform}"
ENV_FILE="${ENV_FILE:-/etc/cmpp-platform/cmpp-platform.env}"
ADMIN_CREDENTIAL_FILE="${ADMIN_CREDENTIAL_FILE:-/root/cmpp-platform-admin.txt}"

if [[ "$(id -u)" -ne 0 ]]; then
  echo "Run as root." >&2
  exit 1
fi

if [[ ! -f "$ENV_FILE" ]]; then
  echo "Missing environment file: $ENV_FILE" >&2
  exit 1
fi

set -a
source "$ENV_FILE"
set +a

if [[ "${API_ENABLE_SEND_WORKER:-}" != "true" ]]; then
  echo "API_ENABLE_SEND_WORKER=true is required in $ENV_FILE; refusing to deploy with SMS sending disabled." >&2
  exit 1
fi

if [[ ! "${API_SEND_WORKER_CONCURRENCY:-}" =~ ^[1-9][0-9]*$ ]]; then
  echo "API_SEND_WORKER_CONCURRENCY must be a positive integer in $ENV_FILE." >&2
  exit 1
fi

if [[ -z "${CMPP_PUBLIC_HOST:-}" || ! "${CMPP_PUBLIC_PORT:-}" =~ ^[1-9][0-9]*$ ]]; then
  echo "CMPP_PUBLIC_HOST and a positive CMPP_PUBLIC_PORT are required in $ENV_FILE; these are the customer-facing CMPP endpoint." >&2
  exit 1
fi

cd "$APP_DIR"

echo "[deploy] Installing dependencies"
npm ci --include=dev
npm --prefix api ci --include=dev

echo "[deploy] Verifying dependency security mitigations"
npm run security:verify

echo "[deploy] Generating Prisma client and applying migrations"
npm --prefix api run prisma:generate
npm --prefix api run prisma:migrate:deploy

echo "[deploy] Building frontend, API and gateway"
rm -rf api/dist api/tsconfig.build.tsbuildinfo "$APP_DIR/dist/cmpp-gateway"
npm run build
npm --prefix api run build
(cd gateway && GOPROXY="${GOPROXY:-https://goproxy.cn,direct}" /usr/local/bin/go build -o "$APP_DIR/dist/cmpp-gateway" ./cmd/gateway)
chmod 755 "$APP_DIR/dist" "$APP_DIR/dist/assets"
find "$APP_DIR/dist/assets" -type d -exec chmod 755 {} +
find "$APP_DIR/dist/assets" -type f -exec chmod 644 {} +
chmod 644 "$APP_DIR/dist/index.html"

echo "[deploy] Ensuring production admin"
PROD_ADMIN_CREDENTIAL_FILE="$ADMIN_CREDENTIAL_FILE" node tools/deploy/ensure-production-admin.mjs
chmod 600 "$ADMIN_CREDENTIAL_FILE" || true

echo "[deploy] Ensuring runtime log directories"
install -d -m 0755 "$APP_DIR/logs/api" "$APP_DIR/logs/gateway"

echo "[deploy] Ensuring HTTP response compression"
cat >/etc/nginx/conf.d/cmpp-compression.conf <<'EOF'
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 5;
gzip_types application/json application/javascript text/javascript text/css text/plain text/csv image/svg+xml;
EOF
nginx -t

echo "[deploy] Restarting services"
systemctl daemon-reload
if [[ "${OBJECT_STORAGE_DRIVER:-minio}" == "local" ]]; then
  systemctl disable --now cmpp-minio 2>/dev/null || true
  systemctl enable --now cmpp-api cmpp-gateway nginx
else
  systemctl enable --now cmpp-minio
  systemctl restart cmpp-minio
  systemctl enable --now cmpp-api cmpp-gateway nginx
fi
systemctl restart cmpp-gateway
systemctl restart cmpp-api
systemctl restart nginx

echo "[deploy] Health checks"
sleep 3
curl -fsS "http://127.0.0.1:${API_PORT:-3000}/api/health" >/dev/null
curl -fsS "http://127.0.0.1:8090/health" >/dev/null
redis-cli -h "${REDIS_HOST:-127.0.0.1}" -p "${REDIS_PORT:-6379}" ping >/dev/null
pg_isready -d "${DATABASE_URL%%\?*}" >/dev/null

echo "[deploy] Done"