#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
SECRETS_ENV=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --secrets-env) SECRETS_ENV="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
[ -n "$SECRETS_ENV" ] || die "--secrets-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"
require_secret_permissions "$SECRETS_ENV"
assert_no_placeholders "$SECRETS_ENV"

[ "$MYSQL_COMPAT_SQL_MODE" = "NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION" ] ||
  die "unsupported MYSQL_COMPAT_SQL_MODE"
case "$MYSQL_CNF_PATH" in
  /etc/my.cnf|/usr/local/mysql/my.cnf) ;;
  *) die "unsupported MYSQL_CNF_PATH" ;;
esac

log "PLAN apply MySQL 5.6 compatibility sql-mode without STRICT_TRANS_TABLES"
log "PLAN set utf8mb4, local name resolution, connection and packet baseline"

[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY: MySQL configuration unchanged"
  exit 0
}

[ "$(id -u)" -eq 0 ] || die "MySQL configuration requires root"
[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "configure-mysql" "$APPROVAL_FILE" "$TARGET_HOST_REF"
load_env_file "$SECRETS_ENV"
require_file "$MYSQL_CNF_PATH"
require_cmd python3
require_cmd mysql

BACKUP_DIR="$BACKUP_ROOT/mysql-config-$(date '+%Y%m%dT%H%M%S%z')"
BACKUP_FILE="$BACKUP_DIR/$(basename "$MYSQL_CNF_PATH").before"
python3 "$PACKAGE_ROOT/tools/configure_mysql.py" \
  --config "$MYSQL_CNF_PATH" \
  --snippet "$PACKAGE_ROOT/runtime/mysql/zhct-online-single.cnf" \
  --backup "$BACKUP_FILE"

restart_mysql() {
  if systemctl list-unit-files mysql.service >/dev/null 2>&1; then
    systemctl restart mysql
  elif systemctl list-unit-files mysqld.service >/dev/null 2>&1; then
    systemctl restart mysqld
  elif [ -x /etc/init.d/mysql ]; then
    /etc/init.d/mysql restart
  else
    return 1
  fi
}

set +e
restart_mysql
restart_rc=$?
actual_mode=""
if [ "$restart_rc" -eq 0 ]; then
  actual_mode="$(
    MYSQL_PWD="$MYSQL_ADMIN_PASSWORD" mysql \
      --batch --skip-column-names \
      --host="$MYSQL_HOST" --port="$MYSQL_PORT" --user="$MYSQL_ADMIN_USER" \
      --execute="SELECT @@GLOBAL.sql_mode;" 2>/dev/null
  )"
fi
set -e
if [ "$restart_rc" -ne 0 ] || [ "$actual_mode" != "$MYSQL_COMPAT_SQL_MODE" ]; then
  cp -p "$BACKUP_FILE" "$MYSQL_CNF_PATH"
  restart_mysql || true
  die "MySQL configuration validation failed; previous file restored"
fi

log "MYSQL_CONFIG_APPLIED sql_mode=$actual_mode backup=$BACKUP_DIR"