#!/usr/bin/env bash
set -Eeuo pipefail

APP="/var/www/dhv2.korexlabs.com"
KEY="/root/.ssh/dhv2_github"
BACKUP_ROOT="/root/DH_V2_BACKUPS"
DEPLOY_REF="${DHV2_DEPLOY_REF:-deploy}"
STAMP="$(date +%Y%m%d_%H%M%S)"
BACKUP="$BACKUP_ROOT/GITHUB_DEPLOY_${STAMP}"
STAGE="/root/dhv2-github-stage-${STAMP}"
LOG="/tmp/dhv2-github-deploy-${STAMP}.log"
API_TEST_IMAGE="dhv2-api:github-${STAMP}"
WEB_TEST_IMAGE="dhv2-web:github-${STAMP}"
PHASE="bootstrap"
PREV_SHA=""
TARGET_SHA=""
EXPECTED_API_VERSION=""
EXPECTED_WEB_VERSION=""
APP_TOUCHED=0

cd "$APP"
export GIT_SSH_COMMAND="ssh -i $KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
exec > >(tee -a "$LOG") 2>&1

cleanup() {
  set +e
  git worktree remove --force "$STAGE" >/dev/null 2>&1 || true
  rm -rf "$STAGE"
  docker image rm "$API_TEST_IMAGE" "$WEB_TEST_IMAGE" >/dev/null 2>&1 || true
}

publish_status() {
  local rc="${1:-1}"
  set +e

  local outcome="failure"
  [ "$rc" -eq 0 ] && outcome="success"
  local current="unknown"
  current="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
  local status_file log_file status_blob log_blob tree commit

  status_file="$(mktemp /tmp/dhv2-status.XXXXXX)"
  log_file="$(mktemp /tmp/dhv2-log.XXXXXX)"

  {
    echo "status=$outcome"
    echo "exit_code=$rc"
    echo "phase=$PHASE"
    echo "timestamp=$(date --iso-8601=seconds)"
    echo "deploy_ref=$DEPLOY_REF"
    echo "previous_sha=${PREV_SHA:-unknown}"
    echo "target_sha=${TARGET_SHA:-unknown}"
    echo "current_sha=$current"
    echo "api_version=${EXPECTED_API_VERSION:-unknown}"
    echo "web_version=${EXPECTED_WEB_VERSION:-unknown}"
    echo "app_touched=$APP_TOUCHED"
    echo "backup=${BACKUP:-unknown}"
  } > "$status_file"

  tail -n 500 "$LOG" > "$log_file" 2>/dev/null || true
  status_blob="$(git hash-object -w "$status_file" 2>/dev/null || true)"
  log_blob="$(git hash-object -w "$log_file" 2>/dev/null || true)"

  if [ -n "$status_blob" ] && [ -n "$log_blob" ]; then
    tree="$(printf '100644 blob %s\tdeploy.log\n100644 blob %s\tstatus.txt\n' "$log_blob" "$status_blob" | git mktree 2>/dev/null || true)"
    if [ -n "$tree" ]; then
      commit="$(printf 'deploy-status: %s · phase %s\n' "$outcome" "$PHASE" | git -c user.name='DH V2 Deploy Bot' -c user.email='deploy@dhv2.local' commit-tree "$tree" 2>/dev/null || true)"
      [ -z "$commit" ] || git push --force origin "$commit:refs/heads/deploy-status" >/dev/null 2>&1 || true
    fi
  fi

  rm -f "$status_file" "$log_file"
}

on_exit() {
  local rc=$?
  trap - EXIT ERR
  cleanup
  publish_status "$rc"
  exit "$rc"
}
trap on_exit EXIT

rollback() {
  local rc=$?
  trap - ERR
  PHASE="rollback"

  echo
  echo "============================================================"
  echo " DH V2 · DEPLOY FALLÓ · ROLLBACK"
  echo "============================================================"

  cd "$APP"
  if [ "$APP_TOUCHED" -eq 1 ] && [ -n "${PREV_SHA:-}" ]; then
    echo "Restaurando aplicación al commit previo: $PREV_SHA"
    git reset --hard "$PREV_SHA" || true
    docker compose build api web </dev/null || true
    docker compose up -d --no-deps --force-recreate api web </dev/null || true
  else
    echo "El candidato falló antes de modificar producción; no se reconstruye ni reinicia la aplicación activa."
  fi

  echo
  echo "Estado actual:"
  docker compose ps -a </dev/null || true

  if [ "$APP_TOUCHED" -eq 1 ]; then
    echo
    echo "Últimos logs:"
    docker compose logs --tail=160 api web </dev/null || true
  fi

  echo
  if [ -d "$BACKUP" ]; then
    echo "Backup PRE disponible en: $BACKUP"
    echo "database-before.dump y asset-media-before.tar.gz permiten una restauración manual integral si hiciera falta."
  else
    echo "No fue necesario crear backup PRE: el fallo ocurrió durante el preflight del candidato, antes de tocar producción."
  fi
  exit "$rc"
}
trap rollback ERR

echo
echo "============================================================"
echo " DH V2 · DEPLOY DESDE GITHUB · $DEPLOY_REF"
echo "============================================================"

for cmd in git docker curl tar node; do
  command -v "$cmd" >/dev/null || { echo "ERROR: falta $cmd"; false; }
done
[ -f "$KEY" ] || { echo "ERROR: falta deploy key $KEY"; false; }
[ -d .git ] || { echo "ERROR: $APP no es repositorio Git"; false; }
[ -f .env ] || { echo "ERROR: falta $APP/.env"; false; }

git config --global --get-all safe.directory 2>/dev/null | grep -Fxq "$APP" || git config --global --add safe.directory "$APP"

if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
  echo "ERROR: hay cambios locales versionados en producción."
  git status --short
  false
fi

PREV_SHA="$(git rev-parse HEAD)"
PHASE="fetch"
git fetch origin "$DEPLOY_REF"
TARGET_SHA="$(git rev-parse "origin/$DEPLOY_REF")"

echo "Actual:   $PREV_SHA"
echo "Objetivo: $TARGET_SHA"

if [ "$TARGET_SHA" = "$PREV_SHA" ]; then
  echo "Producción ya está en el commit autorizado."
  PHASE="complete"
  exit 0
fi

if ! git merge-base --is-ancestor "$PREV_SHA" "$TARGET_SHA"; then
  echo "ERROR: origin/$DEPLOY_REF no es fast-forward desde producción."
  false
fi

PHASE="candidate-preflight"
rm -rf "$STAGE"
git worktree add --detach "$STAGE" "$TARGET_SHA" >/dev/null

EXPECTED_API_VERSION="$(node -p "require('$STAGE/api-v3/package.json').version")"
EXPECTED_WEB_VERSION="$(node -p "require('$STAGE/web-v2/package.json').version")"

echo "API candidata: $EXPECTED_API_VERSION"
echo "WEB candidata: $EXPECTED_WEB_VERSION"

docker compose --env-file "$APP/.env" -f "$STAGE/docker-compose.yml" config >/dev/null

while IFS= read -r -d '' script; do
  bash -n "$script"
done < <(find "$STAGE/scripts" -type f -name '*.sh' -print0)

echo
echo "========== TEST API CANDIDATA =========="
docker build --target builder -t "$API_TEST_IMAGE" "$STAGE/api-v3" </dev/null
docker run --rm \
  -v "$STAGE/api-v3/test:/app/test:ro" \
  -v "$STAGE/api-v3/tsconfig.test.json:/app/tsconfig.test.json:ro" \
  "$API_TEST_IMAGE" npm test </dev/null

echo
echo "========== BUILD WEB CANDIDATA =========="
docker build -t "$WEB_TEST_IMAGE" "$STAGE/web-v2" </dev/null

PHASE="backup"
echo
echo "========== BACKUP PRE =========="
install -d -m 700 "$BACKUP"
docker compose exec -T db sh -lc 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' </dev/null > "$BACKUP/database-before.dump"
tar \
  --exclude='./.git' \
  --exclude='./.env' \
  --exclude='*/node_modules' \
  --exclude='*/dist' \
  --exclude='*.zip' \
  --exclude='*.tar.gz' \
  --exclude='*.tgz' \
  -czf "$BACKUP/source-before.tar.gz" .
install -m 600 .env "$BACKUP/.env"
git rev-parse HEAD > "$BACKUP/previous.sha"
printf '%s\n' "$TARGET_SHA" > "$BACKUP/target.sha"
docker compose ps -a > "$BACKUP/docker-before.txt"

echo "Respaldando volumen de fotos/importaciones..."
docker compose run --rm --no-deps --user root \
  -v "$BACKUP:/backup" \
  api sh -lc 'tar -czf /backup/asset-media-before.tar.gz -C /app/storage/asset-media .'

(
  cd "$BACKUP"
  sha256sum database-before.dump source-before.tar.gz asset-media-before.tar.gz .env previous.sha target.sha docker-before.txt > SHA256SUMS.txt
  sha256sum -c SHA256SUMS.txt
)
chmod 600 "$BACKUP"/* "$BACKUP/.env" 2>/dev/null || true

PHASE="fast-forward"
echo
echo "========== FAST-FORWARD =========="
git log --oneline --no-decorate "$PREV_SHA..$TARGET_SHA"
APP_TOUCHED=1
git merge --ff-only "origin/$DEPLOY_REF"

PHASE="build"
echo
echo "========== BUILD PRODUCCIÓN =========="
docker compose build api migrate web </dev/null

PHASE="migrations"
echo
echo "========== MIGRACIONES + FRESH START =========="
docker compose --profile tools run --rm migrate </dev/null
docker compose --profile tools run --rm migrate npm run migration:show </dev/null | tee "$BACKUP/migrations.txt"
grep -Fq 'Pending migrations: no' "$BACKUP/migrations.txt"

PHASE="media-clean"
echo
echo "========== LIMPIEZA DE ARCHIVOS CARGADOS =========="
docker compose run --rm --no-deps --user root api sh -lc '
  set -eu
  ROOT=/app/storage/asset-media
  before="$(find "$ROOT" -type f 2>/dev/null | wc -l | tr -d " ")"
  echo "files_before=$before"
  for path in "$ROOT"/* "$ROOT"/.[!.]* "$ROOT"/..?*; do
    [ -e "$path" ] || continue
    rm -rf -- "$path"
  done
  mkdir -p "$ROOT/imports"
  chown -R node:node "$ROOT"
  after="$(find "$ROOT" -type f 2>/dev/null | wc -l | tr -d " ")"
  echo "files_after=$after"
  [ "$after" = "0" ]
' | tee "$BACKUP/media-clean.txt"
grep -Fq 'files_after=0' "$BACKUP/media-clean.txt"

PHASE="recreate"
echo
echo "========== RECREATE API + WEB =========="
docker compose up -d --no-deps --force-recreate api web </dev/null

PHASE="health"
echo
echo "========== HEALTH =========="
HEALTH_OK=0
for _ in $(seq 1 60); do
  if curl -fsS --max-time 5 http://127.0.0.1:3101/api/v3/health > "$BACKUP/health.json" 2>/dev/null; then
    if grep -F '"status":"ok"' "$BACKUP/health.json" >/dev/null; then
      HEALTH_OK=1
      break
    fi
  fi
  sleep 2
done

if [ "$HEALTH_OK" -ne 1 ]; then
  echo "ERROR: API no pasó healthcheck."
  docker compose logs --tail=180 api
  false
fi

cat "$BACKUP/health.json"
echo

grep -Fq "\"version\":\"$EXPECTED_API_VERSION\"" "$BACKUP/health.json"
grep -Fq '"database":"ok"' "$BACKUP/health.json"

WEB_CODE="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 http://127.0.0.1:8182/)"
[ "$WEB_CODE" = "200" ] || { echo "ERROR: WEB HTTP $WEB_CODE"; false; }

PHASE="verify"
echo
echo "========== VERIFICACIÓN FINAL =========="
docker compose ps -a | tee "$BACKUP/docker-after.txt"
if docker compose ps --status running --services | grep -Fxq api && docker compose ps --status running --services | grep -Fxq web && docker compose ps --status running --services | grep -Fxq db; then
  echo "Servicios críticos: OK"
else
  echo "ERROR: falta un servicio crítico en ejecución."
  false
fi

PHASE="post-backup"
docker compose exec -T db sh -lc 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' </dev/null > "$BACKUP/database-after.dump"
git rev-parse HEAD > "$BACKUP/deployed.sha"
printf 'API=%s\nWEB=%s\n' "$EXPECTED_API_VERSION" "$EXPECTED_WEB_VERSION" > "$BACKUP/deployed-versions.txt"
(
  cd "$BACKUP"
  sha256sum database-after.dump deployed.sha deployed-versions.txt health.json migrations.txt media-clean.txt docker-after.txt >> SHA256SUMS.txt
  sha256sum -c SHA256SUMS.txt
)
chmod 600 "$BACKUP"/* "$BACKUP/.env" 2>/dev/null || true

PHASE="complete"
trap - ERR

echo
echo "============================================================"
echo " DH V2 · DEPLOY OK"
echo "============================================================"
echo "Commit: $TARGET_SHA"
echo "API:    $EXPECTED_API_VERSION"
echo "WEB:    $EXPECTED_WEB_VERSION"
echo "Backup: $BACKUP"
echo "============================================================"