#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
SECRETS_ENV=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --secrets-env) SECRETS_ENV="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
[ -n "$SECRETS_ENV" ] || die "--secrets-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"
require_secret_permissions "$SECRETS_ENV"
assert_no_placeholders "$SECRETS_ENV"
validate_project_root "$STORE_ROOT"

log "PLAN replace Store's inline Baidu keys with /etc/zhct/online-single/cloud-secrets.php reference"
log "PLAN create backup and run PHP syntax check; secret values will not be printed"

[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY: Store files unchanged"
  exit 0
}

[ "$(id -u)" -eq 0 ] || die "Baidu configuration requires root"
[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "configure-baidu-online" "$APPROVAL_FILE" "$TARGET_HOST_REF"
[ -d "$STORE_ROOT/application" ] || die "Store application directory not found"
require_cmd python3

BACKUP_DIR="$BACKUP_ROOT/baidu-online-$(date '+%Y%m%dT%H%M%S%z')"
python3 "$PACKAGE_ROOT/tools/configure_baidu_online.py" \
  --project-root "$STORE_ROOT" \
  --secrets-env "$SECRETS_ENV" \
  --secret-file /etc/zhct/online-single/cloud-secrets.php \
  --backup-dir "$BACKUP_DIR"

chown root:www /etc/zhct/online-single/cloud-secrets.php
chmod 640 /etc/zhct/online-single/cloud-secrets.php
chown root:www "$STORE_ROOT/application/config.php"
chmod 640 "$STORE_ROOT/application/config.php"

PHP_BIN="${PHP73_BIN:-/usr/local/php/bin/php}"
"$PHP_BIN" -l "$STORE_ROOT/application/config.php"
log "BAIDU_ONLINE_CONFIG_APPLIED backup=$BACKUP_DIR"