#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"
validate_project_root "$STORE_ROOT"
validate_project_root "$AI_API_ROOT"

TMP_CONF="$(mktemp)"
trap 'rm -f "$TMP_CONF"' EXIT
python3 "$PACKAGE_ROOT/tools/render_template.py" \
  --env "$PROJECT_ENV" \
  --template "$PACKAGE_ROOT/runtime/nginx/online-single.conf.template" \
  --output "$TMP_CONF"

log "PLAN install tuned global Nginx config"
log "PLAN render Nginx Store :${PUBLIC_PORT} and AI API loopback :${AI_API_INTERNAL_PORT}"
[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY rendered=$TMP_CONF"
  exit 0
}

[ "$(id -u)" -eq 0 ] || die "Nginx configuration requires root"
[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "configure-nginx" "$APPROVAL_FILE" "$TARGET_HOST_REF"
FRONTEND_INDEX="${STORE_ROOT}/public${FRONTEND_ENTRY_PATH}index.html"
require_file "$FRONTEND_INDEX"

NGINX_BIN="${NGINX_BIN:-/usr/local/nginx/sbin/nginx}"
NGINX_CONF_DIR="${NGINX_CONF_DIR:-/usr/local/nginx/conf/vhost}"
NGINX_MAIN_CONF="${NGINX_MAIN_CONF:-/usr/local/nginx/conf/nginx.conf}"
require_file "$NGINX_BIN"
require_file "$NGINX_MAIN_CONF"
mkdir -p "$NGINX_CONF_DIR"
mkdir -p "$DATA_ROOT/wwwlogs"
TARGET_CONF="$NGINX_CONF_DIR/${PROJECT_CODE}-online-single.conf"
BACKUP_DIR="$BACKUP_ROOT/nginx-config-$(date '+%Y%m%dT%H%M%S%z')"
mkdir -p "$BACKUP_DIR"
cp -p "$NGINX_MAIN_CONF" "$BACKUP_DIR/nginx.conf.before"
TARGET_EXISTED=0
if [ -f "$TARGET_CONF" ]; then
  TARGET_EXISTED=1
  cp -p "$TARGET_CONF" "$BACKUP_DIR/project-vhost.conf.before"
fi
install -m 0644 "$PACKAGE_ROOT/runtime/nginx/nginx.conf.tuned" "$NGINX_MAIN_CONF"
install -m 0644 "$TMP_CONF" "$TARGET_CONF"

rollback_nginx() {
  cp -p "$BACKUP_DIR/nginx.conf.before" "$NGINX_MAIN_CONF"
  if [ "$TARGET_EXISTED" -eq 1 ]; then
    cp -p "$BACKUP_DIR/project-vhost.conf.before" "$TARGET_CONF"
  else
    mv "$TARGET_CONF" "$BACKUP_DIR/project-vhost.conf.rejected"
  fi
  "$NGINX_BIN" -t >/dev/null 2>&1 && "$NGINX_BIN" -s reload >/dev/null 2>&1 || true
}

if ! "$NGINX_BIN" -t; then
  rollback_nginx
  die "Nginx syntax validation failed; previous configuration restored"
fi
if ! "$NGINX_BIN" -s reload; then
  rollback_nginx
  die "Nginx reload failed; previous configuration restored"
fi
log "NGINX_CONFIG_APPLIED main=$NGINX_MAIN_CONF vhost=$TARGET_CONF backup=$BACKUP_DIR"