#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
ARTIFACT_ROOT=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --artifact-root) ARTIFACT_ROOT="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
[ -n "$ARTIFACT_ROOT" ] || die "--artifact-root is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"

LNMP="$ARTIFACT_ROOT/runtime/lnmp2.2-from-git-20260706.tar.gz"
verify_sha256 "$LNMP" "9cdc130f859bfca6cbd138950128fda358b88fb1ebadad4f937ebc4560fe990b"

log "PLAN install base packages with dnf"
log "PLAN unpack LNMP 2.2 and run interactive LNMP installation"
log "PLAN install PHP 7.3/7.4, MySQL 5.6, Redis, Supervisor, Cron and build dependencies"
log "PLAN Supervisor business programs and Cron entries remain owned by the code release package"
log "PLAN create /workspace/wwwroot, backup and evidence directories"
log "PLAN no cloud credentials, database config, code release or service exposure in this action"

[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY: add --apply and an exact approval file to execute"
  exit 0
}

[ "$(id -u)" -eq 0 ] || die "runtime installation requires root"
[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "install-runtime" "$APPROVAL_FILE" "$TARGET_HOST_REF"
[ "${ALLOW_EOL_RUNTIME:-false}" = "true" ] || die "EOL runtime exception is not approved in project.env"
grep -qi 'openEuler' /etc/os-release || die "target OS is not openEuler"
[ "$(uname -m)" = "$CPU_ARCH" ] || die "target architecture mismatch"

require_cmd dnf
SUPERVISOR_WHEEL="$ARTIFACT_ROOT/runtime/supervisor-4.3.0-py2.py3-none-any.whl"
verify_sha256 "$SUPERVISOR_WHEEL" "0bcb763fddafba410f35cbde226aa7f8514b9fb82eb05a0c85f6588d1c13f8db"
dnf install -y \
  tar gzip bzip2 xz curl wget unzip rsync git \
  gcc gcc-c++ make autoconf automake libtool cmake \
  openssl-devel libcurl-devel libxml2-devel sqlite-devel \
  python3 python3-pip cronie

mkdir -p /opt/zhct-install/lnmp2.2 "$BACKUP_ROOT" "$EVIDENCE_ROOT" \
  "$(dirname "$STORE_ROOT")" "$(dirname "$AI_API_ROOT")"
tar -xzf "$LNMP" -C /opt/zhct-install/lnmp2.2
test -f /opt/zhct-install/lnmp2.2/install.sh

log "LNMP installer is interactive. Select the frozen compatibility baseline:"
log "MySQL 5.6.51, PHP 7.3.33; add PHP 7.4.33 with install.sh mphp."
(
  cd /opt/zhct-install/lnmp2.2
  bash install.sh lnmp
  bash install.sh mphp
)

dnf install -y redis5 mosquitto-devel || die "Redis/Mosquitto development packages unavailable from approved repository"
log "Redis package installed; activation is deferred to configure-redis.sh"

python3 -m pip install --disable-pip-version-check --no-index "$SUPERVISOR_WHEEL"
mkdir -p /etc/supervisor/conf.d /var/log/supervisor
systemctl enable --now crond
log "Supervisor executable and Cron runtime installed; no project programs or crontab entries were created"

log "RUNTIME_INSTALL_STEP_COMPLETE: run post-install version and PHP extension checks before application deployment"