#!/usr/bin/env bash
set -Eeuo pipefail

ROOT="${ROOT:-/var/www/dhv2.korexlabs.com}"
ZIP="${ZIP:-$ROOT/DH_V2_FASE_D5_6_2_SOURCE.zip}"
STAMP="$(date +%Y%m%d_%H%M%S)"
STAGE="/root/dhv2-d562-stage-$STAMP"
BACKUP_ROOT="/root/DH_V2_BACKUPS"
PRE_BACKUP="$BACKUP_ROOT/D5_6_2_PRE_$STAMP"
POST_BACKUP="$BACKUP_ROOT/D5_6_2_OK_$STAMP"
CLOSURE_BACKUP="$BACKUP_ROOT/FASE_D_CERRADA_D5_6_2_$STAMP"
TEST_LOG="/tmp/dhv2-d562-tests-$STAMP.log"
MIGRATION_LOG="/tmp/dhv2-d562-migration-$STAMP.log"
HEALTH_FILE="/tmp/dhv2-d562-health-$STAMP.json"
MIN_FREE_KB=$((4 * 1024 * 1024))

cleanup() {
  rm -rf "$STAGE"
  rm -f "$TEST_LOG" "$MIGRATION_LOG" "$HEALTH_FILE"
  docker image rm dhv2-api:d562-test dhv2-web:d562-test >/dev/null 2>&1 || true
}
trap cleanup EXIT
trap 'echo; echo "ERROR D5.6.2 en línea $LINENO: $BASH_COMMAND"' ERR

cd "$ROOT"
test -f "$ZIP"
CURRENT_API="$(node -p "require('./api-v3/package.json').version")"
CURRENT_WEB="$(node -p "require('./web-v2/package.json').version")"
case "$CURRENT_API/$CURRENT_WEB" in
  0.19.5-2/0.19.5-2|0.19.6/0.19.6|0.19.6-1/0.19.6-1) ;;
  *) echo "ERROR: base no soportada. API=$CURRENT_API WEB=$CURRENT_WEB"; exit 1 ;;
esac

echo "[1/10] Preflight y staging"
FREE_KB="$(df -Pk "$ROOT" | awk 'NR==2 {print $4}')"
if [[ ! "$FREE_KB" =~ ^[0-9]+$ ]] || (( FREE_KB < MIN_FREE_KB )); then
  echo "ERROR: espacio libre insuficiente. Libre: $(( FREE_KB / 1024 )) MB"
  exit 1
fi
[[ "$(docker inspect dhv2-db --format '{{.State.Health.Status}}' 2>/dev/null || true)" == "healthy" ]]
docker compose exec -T db sh -lc 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"'
mkdir -p "$STAGE"
unzip -q "$ZIP" -d "$STAGE"
[[ "$(node -p "require('$STAGE/api-v3/package.json').version")" == "0.19.6-2" ]]
[[ "$(node -p "require('$STAGE/web-v2/package.json').version")" == "0.19.6-2" ]]
grep -Fq "API_PHASE = 'D5.6.2'" "$STAGE/api-v3/src/version.ts"
grep -Fq "APP_PHASE = 'Fase D5.6.2 · Accesos y compatibilidad Android'" "$STAGE/web-v2/src/config/version.ts"
if find "$STAGE/api-v3/src/database/migrations" -maxdepth 1 -type f -iname '*d5-6-2*' | grep -q .; then
  echo "ERROR: D5.6.2 no debe agregar migración"
  exit 1
fi

echo "[2/10] Compilando API en staging"
docker build --target builder -t dhv2-api:d562-test "$STAGE/api-v3"

echo "[3/10] Ejecutando tests API en staging"
docker run --rm \
  -v "$STAGE/api-v3/test:/app/test:ro" \
  -v "$STAGE/api-v3/tsconfig.test.json:/app/tsconfig.test.json:ro" \
  dhv2-api:d562-test npm test 2>&1 | tee "$TEST_LOG"
grep -Eq 'tests[[:space:]]+262' "$TEST_LOG"
grep -Eq 'pass[[:space:]]+262' "$TEST_LOG"
grep -Eq 'fail[[:space:]]+0' "$TEST_LOG"

echo "[4/10] Compilando web y validando administración"
docker build -t dhv2-web:d562-test "$STAGE/web-v2"
grep -Fq 'Restablecer contraseña' "$STAGE/web-v2/src/pages/UserDetailPage.tsx"
grep -Fq 'resetUserPassword' "$STAGE/web-v2/src/lib/api.ts"
grep -Fq 'Contraseña de usuario restablecida' "$STAGE/web-v2/src/lib/format.ts"

echo "[5/10] Backup PRE D5.6.2"
mkdir -p "$PRE_BACKUP"; chmod 700 "$PRE_BACKUP"
docker compose exec -T db sh -lc 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' > "$PRE_BACKUP/database.dump"
tar -czf "$PRE_BACKUP/source.tar.gz" \
  --exclude='api-v3/node_modules' --exclude='api-v3/dist' \
  --exclude='web-v2/node_modules' --exclude='web-v2/dist' \
  api-v3 web-v2 scripts docs docker-compose.yml .env.example .gitignore README.md
if [[ -f .env ]]; then cp -a .env "$PRE_BACKUP/.env"; chmod 600 "$PRE_BACKUP/.env"; fi
printf 'Base previa API=%s WEB=%s\n' "$CURRENT_API" "$CURRENT_WEB" > "$PRE_BACKUP/BASE_VERSION.txt"
(
  cd "$PRE_BACKUP"
  sha256sum database.dump source.tar.gz BASE_VERSION.txt > SHA256SUMS.txt
  [[ ! -f .env ]] || sha256sum .env >> SHA256SUMS.txt
  sha256sum -c SHA256SUMS.txt
)

echo "[6/10] Instalando source D5.6.2"
unzip -oq "$ZIP" -d "$ROOT"
chmod +x "$ROOT/scripts/deploy-phase-d5-6-2.sh" "$ROOT/scripts/phase-d5-6-2-acceptance.sh"
echo "API source: $(node -p "require('./api-v3/package.json').version")"
echo "WEB source: $(node -p "require('./web-v2/package.json').version")"

echo "[7/10] Construyendo imágenes finales"
docker compose build api migrate web

echo "[8/10] Verificando migraciones"
docker compose --profile tools run --rm migrate npm run migration:show 2>&1 | tee "$MIGRATION_LOG"
grep -Fq 'Pending migrations: no' "$MIGRATION_LOG"

echo "[9/10] Recreando API/web y aceptación"
docker compose up -d --force-recreate api web
for i in $(seq 1 40); do
  if curl -fsS http://127.0.0.1:3101/api/v3/health >"$HEALTH_FILE" 2>/dev/null; then break; fi
  if [[ "$i" == "40" ]]; then docker compose logs --tail=200 api; exit 1; fi
  sleep 2
done
cat "$HEALTH_FILE"; echo
grep -Fq '"version":"0.19.6-2"' "$HEALTH_FILE"
grep -Fq '"phase":"D5.6.2"' "$HEALTH_FILE"
grep -Fq '"database":"ok"' "$HEALTH_FILE"
bash "$ROOT/scripts/phase-d5-6-2-acceptance.sh"

echo "[10/10] Backup POST"
mkdir -p "$POST_BACKUP" "$CLOSURE_BACKUP"; chmod 700 "$POST_BACKUP" "$CLOSURE_BACKUP"
docker compose exec -T db sh -lc 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' > "$POST_BACKUP/database.dump"
tar -czf "$POST_BACKUP/source.tar.gz" \
  --exclude='api-v3/node_modules' --exclude='api-v3/dist' \
  --exclude='web-v2/node_modules' --exclude='web-v2/dist' \
  api-v3 web-v2 scripts docs docker-compose.yml .env.example .gitignore README.md
docker compose ps -a > "$POST_BACKUP/docker-status.txt"
cp -a "$ZIP" "$POST_BACKUP/"
printf 'D5.6.2 OK\nBase previa API=%s WEB=%s\nVersión final 0.19.6-2\nFASE D CERRADA + hotfix de acceso Android\n' "$CURRENT_API" "$CURRENT_WEB" > "$POST_BACKUP/BACKUP_OK.txt"
if [[ -f .env ]]; then cp -a .env "$POST_BACKUP/.env"; chmod 600 "$POST_BACKUP/.env"; fi
(
  cd "$POST_BACKUP"
  sha256sum database.dump source.tar.gz "$(basename "$ZIP")" BACKUP_OK.txt > SHA256SUMS.txt
  [[ ! -f .env ]] || sha256sum .env >> SHA256SUMS.txt
  sha256sum -c SHA256SUMS.txt
)
ln "$POST_BACKUP/database.dump" "$CLOSURE_BACKUP/database.dump"
ln "$POST_BACKUP/source.tar.gz" "$CLOSURE_BACKUP/source.tar.gz"
ln "$POST_BACKUP/$(basename "$ZIP")" "$CLOSURE_BACKUP/$(basename "$ZIP")"
printf 'FASE D CERRADA\nHotfix D5.6.2 aplicado\nBackup canónico: %s\nVersión: 0.19.6-2\n' "$POST_BACKUP" > "$CLOSURE_BACKUP/BACKUP_OK.txt"

echo
echo "ACEPTACIÓN DE FASE D5.6.2: OK"
echo "D5.6.2 desplegada correctamente"
echo "Backup PRE: $PRE_BACKUP"
echo "Backup POST: $POST_BACKUP"
echo "Backup fuerte FASE D CERRADA: $CLOSURE_BACKUP"