#!/usr/bin/env bash
# Installe la mise à jour ACF PRO côté serveur (auth.json + cron).
#
# Usage (depuis la racine du dépôt, avec accès SSH configuré) :
#   ./scripts/setup-acf-pro-cron-server.sh
#   ./scripts/setup-acf-pro-cron-server.sh --dry-run

set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

ENV_FILE="${DEPLOY_ENV:-$ROOT/.secrets/.env}"
DRY_RUN=false
CRON_LINE='0 7 * * 1 bash /home/sc1mear8437/public_html/scripts/update-acf-pro-server.sh >> /home/sc1mear8437/logs/acf-update.log 2>&1'

while [[ $# -gt 0 ]]; do
  case "$1" in
    --env) ENV_FILE="$2"; shift 2 ;;
    --dry-run) DRY_RUN=true; shift ;;
    *) echo "Option inconnue : $1" >&2; exit 1 ;;
  esac
done

AUTH_LOCAL="${ACF_AUTH_FILE:-$ROOT/.secrets/auth.json}"
[[ -f "$AUTH_LOCAL" ]] || { echo "auth.json local introuvable : $AUTH_LOCAL" >&2; exit 1; }

load_env_file() {
  local file="$1"
  [[ -f "$file" ]] || { echo "Fichier introuvable : $file" >&2; exit 1; }
  while IFS= read -r line || [[ -n "$line" ]]; do
    line="${line%%#*}"
    line="${line#"${line%%[![:space:]]*}"}"
    line="${line%"${line##*[![:space:]]}"}"
    [[ -n "$line" ]] || continue
    [[ "$line" == *"="* ]] || continue
    local key="${line%%=*}"
    local val="${line#*=}"
    key="${key#"${key%%[![:space:]]*}"}"
    key="${key%"${key##*[![:space:]]}"}"
    val="${val#"${val%%[![:space:]]*}"}"
    val="${val%"${val##*[![:space:]]}"}"
    if [[ "$val" == \"*\" && "$val" == *\" ]]; then
      val="${val:1:${#val}-2}"
    elif [[ "$val" == \'*\' && "$val" == *\' ]]; then
      val="${val:1:${#val}-2}"
    fi
    export "$key=$val"
  done < "$file"
}

if [[ -z "${DEPLOY_HOST:-}" ]]; then
  load_env_file "$ENV_FILE"
fi

: "${DEPLOY_HOST:?DEPLOY_HOST manquant}"
: "${DEPLOY_USER:?DEPLOY_USER manquant}"
DEPLOY_PORT="${DEPLOY_PORT:-22}"

SSH_OPTS=(-4 -o StrictHostKeyChecking=accept-new -o ConnectTimeout=120 -p "${DEPLOY_PORT}")
SCP_OPTS=(-4 -o StrictHostKeyChecking=accept-new -o ConnectTimeout=120 -P "${DEPLOY_PORT}")
if [[ -n "${SSH_PRIVATE_KEY_FILE:-}" ]]; then
  key="$SSH_PRIVATE_KEY_FILE"
  [[ "$key" != /* ]] && key="$ROOT/$key"
  SSH_OPTS+=(-i "$key" -o IdentitiesOnly=yes)
  SCP_OPTS+=(-i "$key" -o IdentitiesOnly=yes)
fi

REMOTE="${DEPLOY_USER}@${DEPLOY_HOST}"
REMOTE_HOME="/home/${DEPLOY_USER}"

run_ssh() {
  if [[ "$DRY_RUN" == true ]]; then
    echo "[dry-run] ssh ${SSH_OPTS[*]} ${REMOTE} $*"
  else
    ssh "${SSH_OPTS[@]}" "${REMOTE}" "$@"
  fi
}

run_scp() {
  if [[ "$DRY_RUN" == true ]]; then
    echo "[dry-run] scp ${SCP_OPTS[*]} $1 ${REMOTE}:$2"
  else
    scp "${SCP_OPTS[@]}" "$1" "${REMOTE}:$2"
  fi
}

echo "→ Déploiement composer.json, composer.lock et script serveur"
if [[ "$DRY_RUN" == true ]]; then
  echo "[dry-run] ./scripts/deploy-ssh.sh --only-path composer.json"
  echo "[dry-run] ./scripts/deploy-ssh.sh --only-path composer.lock"
  echo "[dry-run] ./scripts/deploy-ssh.sh --only-path scripts/update-acf-pro-server.sh"
else
  ./scripts/deploy-ssh.sh --only-path composer.json
  ./scripts/deploy-ssh.sh --only-path composer.lock
  ./scripts/deploy-ssh.sh --only-path scripts/update-acf-pro-server.sh
fi

echo "→ auth.json dans ${REMOTE_HOME}/.secrets/ (hors webroot)"
run_ssh "mkdir -p '${REMOTE_HOME}/.secrets' '${REMOTE_HOME}/logs' '${REMOTE_HOME}/tmp' && chmod 700 '${REMOTE_HOME}/.secrets'"
run_scp "$AUTH_LOCAL" "${REMOTE_HOME}/.secrets/auth.json"
run_ssh "chmod 600 '${REMOTE_HOME}/.secrets/auth.json' && chmod 755 '${REMOTE_HOME}/public_html/scripts/update-acf-pro-server.sh'"

echo "→ Cron hebdomadaire (lundi 07:00 UTC)"
run_ssh "
  set -euo pipefail
  tmp=\$(mktemp)
  crontab -l 2>/dev/null | grep -v 'update-acf-pro-server.sh' >\"\$tmp\" || true
  echo '${CRON_LINE}' >>\"\$tmp\"
  crontab \"\$tmp\"
  rm -f \"\$tmp\"
  echo 'Crontab actuel :'
  crontab -l
"

echo "Terminé. Test manuel : ssh ${REMOTE} 'bash ${REMOTE_HOME}/public_html/scripts/update-acf-pro-server.sh'"