#!/bin/bash
# ─────────────────────────────────────────────
#  SPB Git — Personal Git Platform
# ─────────────────────────────────────────────
#  Author  : Simon-Pierre Boucher
#  Contact : contact@spboucher.ai
#  File    : deploy/setup-m3u96a.sh
#  Purpose : Idempotent bootstrap of the full stack on node m3u96a
#  License : MIT © Simon-Pierre Boucher
# ─────────────────────────────────────────────
#
# Run FROM the app directory on m3u96a:
#   bash deploy/setup-m3u96a.sh
#
# What it does (all idempotent):
#   1. Verifies node ≥ 20, git, ngrok (installs ngrok via brew when missing).
#   2. Creates the data prefix:  /srv on Linux, ~/srv on macOS (SIP-safe).
#   3. npm ci --omit=dev + fonts.
#   4. Writes .env with resolved paths.
#   5. Generates the bootstrap PAT — printed ONCE, never stored in clear.
#   6. Starts pm2 apps (server + ngrok tunnel) and saves the process list.
#
set -euo pipefail

say()  { printf '\033[1;34m▸ %s\033[0m\n' "$*"; }
ok()   { printf '\033[1;32m✓ %s\033[0m\n' "$*"; }
fail() { printf '\033[1;31m✗ %s\033[0m\n' "$*" >&2; exit 1; }

APP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$APP_DIR"

# ── 1. prerequisites ─────────────────────────────────────────────
command -v git >/dev/null || fail "git is required"
command -v node >/dev/null || fail "node ≥ 20 is required (brew install node@20 or nvm install 20)"
NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
[ "$NODE_MAJOR" -ge 20 ] || fail "node ≥ 20 required, found $(node --version)"
ok "node $(node --version), git $(git --version | awk '{print $3}')"

if ! command -v ngrok >/dev/null; then
  if command -v brew >/dev/null; then
    say "installing ngrok via homebrew"
    brew install ngrok >/dev/null
  else
    fail "ngrok not found — install it from https://ngrok.com/download"
  fi
fi
ok "ngrok $(ngrok version 2>/dev/null | head -1)"

if ! command -v pm2 >/dev/null; then
  say "installing pm2 globally"
  npm install -g pm2 >/dev/null
fi
ok "pm2 $(pm2 --version)"

# ── 2. directories ───────────────────────────────────────────────
# /srv is read-only on macOS system volumes → use ~/srv there.
if [ "$(uname)" = "Darwin" ]; then
  PREFIX="$HOME/srv"
else
  PREFIX="/srv"
  [ -w "$PREFIX" ] || sudo mkdir -p "$PREFIX" && sudo chown "$(whoami)" "$PREFIX" 2>/dev/null || true
fi
GIT_ROOT="$PREFIX/git"
DATA_DIR="$PREFIX/spbgit/data"
CACHE_DIR="$PREFIX/spbgit/cache"
LOG_DIR="$PREFIX/spbgit/logs"
BACKUP_DIR="$PREFIX/spbgit/backups"
mkdir -p "$GIT_ROOT" "$DATA_DIR" "$CACHE_DIR" "$LOG_DIR" "$BACKUP_DIR"
ok "directories ready under $PREFIX"

# ── 3. dependencies ──────────────────────────────────────────────
say "installing production dependencies"
npm ci --omit=dev --no-audit --no-fund >/dev/null
ok "npm dependencies installed"

# ── 4. environment ───────────────────────────────────────────────
if [ ! -f .env ]; then
  cat > .env <<ENV
# Written by deploy/setup-m3u96a.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
SPBGIT_PORT=7420
SPBGIT_HOST=127.0.0.1
SPBGIT_PUBLIC_URL=https://git.spboucher.ai
SPBGIT_GIT_ROOT=$GIT_ROOT
SPBGIT_DATA_DIR=$DATA_DIR
SPBGIT_CACHE_DIR=$CACHE_DIR
SPBGIT_LOG_LEVEL=info
SPBGIT_ENV=production
ENV
  chmod 600 .env
  ok ".env written"
else
  ok ".env already present — left untouched"
fi

# ── 5. bootstrap PAT (only when no token exists yet) ─────────────
if [ ! -s "$DATA_DIR/tokens.json" ] || [ "$(node -p "try{JSON.parse(require('fs').readFileSync('$DATA_DIR/tokens.json','utf8')).tokens.length}catch(e){0}")" = "0" ]; then
  say "generating bootstrap personal access token"
  BOOTSTRAP_TOKEN="$(node --input-type=module -e "
    import { loadConfig, ensureDirs } from '$APP_DIR/src/config.mjs';
    import { TokenStore } from '$APP_DIR/src/auth/token.mjs';
    const config = loadConfig();
    ensureDirs(config);
    const { token } = await new TokenStore(config.dataDir).create('bootstrap');
    console.log(token);
  ")"
  printf '\n\033[1;33m┌────────────────────────────────────────────────────────────┐\033[0m\n'
  printf '\033[1;33m│ BOOTSTRAP TOKEN — shown once, copy it now:                 │\033[0m\n'
  printf '\033[1;33m└────────────────────────────────────────────────────────────┘\033[0m\n'
  printf '\n  %s\n\n' "$BOOTSTRAP_TOKEN"
  printf 'Configure your laptop with:  spbgit init\n\n'
else
  ok "tokens already exist — no bootstrap token generated"
fi

# ── 6. ngrok auth + pm2 ──────────────────────────────────────────
# Resolve the authtoken: env first, then the agent's default config file.
# A resolved config (real token, chmod 600) is written OUTSIDE the repo and
# handed to pm2 via SPBGIT_NGROK_CONFIG — deploy/ngrok.yml stays a template.
NGROK_DEFAULT_CFG="$HOME/Library/Application Support/ngrok/ngrok.yml"
[ -f "$NGROK_DEFAULT_CFG" ] || NGROK_DEFAULT_CFG="$HOME/.config/ngrok/ngrok.yml"
AUTHTOKEN="${NGROK_AUTHTOKEN:-}"
if [ -z "$AUTHTOKEN" ] && [ -f "$NGROK_DEFAULT_CFG" ]; then
  AUTHTOKEN="$(grep -E '^[[:space:]]*authtoken:' "$NGROK_DEFAULT_CFG" | head -1 | awk '{print $2}')"
fi
RESOLVED_CFG="$PREFIX/spbgit/ngrok.resolved.yml"
if [ -n "$AUTHTOKEN" ]; then
  cat > "$RESOLVED_CFG" <<NGROK
version: 3
agent:
  authtoken: $AUTHTOKEN
endpoints:
  - name: spbgit
    url: https://git.spboucher.ai
    upstream:
      url: http://127.0.0.1:7420
NGROK
  chmod 600 "$RESOLVED_CFG"
  export SPBGIT_NGROK_CONFIG="$RESOLVED_CFG"
  ok "ngrok config resolved → $RESOLVED_CFG"
else
  printf '\033[1;33m! No ngrok authtoken found (env or agent config).\033[0m\n'
  printf '  Run: ngrok config add-authtoken <token>   (or export NGROK_AUTHTOKEN)\n'
fi

say "starting pm2 apps"
SPBGIT_LOG_DIR="$LOG_DIR" SPBGIT_NGROK_CONFIG="${SPBGIT_NGROK_CONFIG:-}" pm2 start deploy/ecosystem.config.cjs --update-env >/dev/null
pm2 save >/dev/null
ok "pm2 apps started (spbgit-server, spbgit-tunnel) and saved"
printf '  To survive reboots, run once: \033[1mpm2 startup\033[0m (follow its instructions)\n'

# ── 7. health check ──────────────────────────────────────────────
say "waiting for /healthz"
for _ in $(seq 1 20); do
  if curl -sf http://127.0.0.1:7420/healthz >/dev/null 2>&1; then
    ok "server healthy: $(curl -s http://127.0.0.1:7420/healthz)"
    ok "public URL: https://git.spboucher.ai (once DNS/ngrok domain is configured)"
    exit 0
  fi
  sleep 1
done
fail "server did not become healthy — check: pm2 logs spbgit-server"