#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$repo_root"

deploy_host="${DEPLOY_HOST:-AMS-DEV01}"
deploy_user="${DEPLOY_USER:-zak}"
deploy_path="${DEPLOY_PATH:-/home/${deploy_user}/magent}"
ssh_opts="${DEPLOY_SSH_OPTS:-"-o StrictHostKeyChecking=yes"}"
timestamp="$(date -u +%Y%m%dT%H%M%SZ)"

remote="${deploy_user}@${deploy_host}"

echo "Deploying tracked repository contents to ${remote}:${deploy_path}"

git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
  set -e
  umask 077
  mkdir -p '${deploy_path}'
  chmod 700 '${deploy_path}'
  backup_root=\"\${HOME}/magent-backups/${timestamp}\"
  mkdir -p \"\${backup_root}\"
  chmod 700 \"\${backup_root}\"
  cd '${deploy_path}'
  for path in backend frontend docker-compose.yml docker-compose.hub.yml Dockerfile README.md docker scripts .build_number .gitattributes .gitignore; do
    if [ -e \"\$path\" ]; then
      cp -a \"\$path\" \"\${backup_root}/\"
    fi
  done
  (umask 022; tar -xf - -C '${deploy_path}')
  if [ -f '${deploy_path}/.env' ]; then
    chmod 600 '${deploy_path}/.env'
  fi
  mkdir -p '${deploy_path}/data'
  chmod 700 '${deploy_path}/data'
  docker compose build
  if ! grep -Eq '^[[:space:]]*SETTINGS_ENCRYPTION_KEY=' .env; then
    settings_key=\"\$(docker compose run --rm --no-deps --entrypoint python magent -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')\"
    printf '\nSETTINGS_ENCRYPTION_KEY=%s\n' \"\${settings_key}\" >> .env
    chmod 600 .env
  fi
  docker compose run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
  docker compose run --rm --user 0 --cap-add CHOWN --cap-add DAC_OVERRIDE magent chown -R 1000:1000 /app/data
  docker compose up -d
"

echo "Running remote smoke checks"
ssh ${ssh_opts} "${remote}" "
  set -e
  python3 - <<'PY'
from urllib import request

checks = [
    ('http://127.0.0.1:8000/health', 200),
    ('http://127.0.0.1:3000/login', 200),
]

for url, expected in checks:
    with request.urlopen(url, timeout=20) as response:
        if response.status != expected:
            raise SystemExit(f'{url} returned {response.status}, expected {expected}')
        print(url, response.status)
PY
"

echo "Deployment completed successfully"