#!/bin/bash

# =============================================================================
# Mnemo Cards Admin Panel - Deployment Configuration
# =============================================================================
# This file contains all deployment variables and settings for the admin panel.
# Modify these values according to your environment.

# =============================================================================
# SERVER CONFIGURATION
# =============================================================================

# Server connection details
export SERVER_IP="147.45.152.129"
export SERVER_USER="root"

# Domain configuration
export DOMAIN="admin.mnemo-cards.online"

# =============================================================================
# APPLICATION CONFIGURATION
# =============================================================================

# Application details
export APP_NAME="mnemo_cards_admin"
export APP_TITLE="Mnemo Cards Admin Panel"

# Web root directory on server
export WEB_ROOT="/var/www/$APP_NAME"

# Nginx configuration paths
export NGINX_CONFIG="/etc/nginx/sites-available/$APP_NAME"
export NGINX_ENABLED="/etc/nginx/sites-enabled/$APP_NAME"

# =============================================================================
# API CONFIGURATION
# =============================================================================

# API endpoints (via nginx reverse proxy on port 443)
export API_BASE_URL="https://api.mnemo-cards.online"
export API_BASE_URL_DEV="https://api.mnemo-cards.online"

# =============================================================================
# SSL CONFIGURATION
# =============================================================================

# SSL certificate paths (Let's Encrypt)
export SSL_CERT_PATH="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"
export SSL_KEY_PATH="/etc/letsencrypt/live/$DOMAIN/privkey.pem"

# SSL certificate renewal script path
export SSL_RENEWAL_SCRIPT="/root/mnemo_cards/tools/ssl/renew_admin_ssl.sh"

# Self-signed certificate paths (fallback)
export SSL_SELF_CERT="/etc/ssl/certs/nginx-selfsigned.crt"
export SSL_SELF_KEY="/etc/ssl/private/nginx-selfsigned.key"

# SSL configuration
export SSL_PROTOCOLS="TLSv1.2 TLSv1.3"
export SSL_CIPHERS="ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"

# =============================================================================
# NGINX CONFIGURATION
# =============================================================================

# Enhanced security headers for admin panel
export CSP_POLICY="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https://api.mnemo-cards.online;"
export X_FRAME_OPTIONS="DENY"
export X_XSS_PROTECTION="1; mode=block"
export X_CONTENT_TYPE_OPTIONS="nosniff"
export REFERRER_POLICY="strict-origin-when-cross-origin"
export STRICT_TRANSPORT_SECURITY="max-age=31536000; includeSubDomains"

# Cache settings (shorter for admin panel)
export CACHE_EXPIRES="1h"
export CACHE_CONTROL="private, must-revalidate"

# =============================================================================
# DEPLOYMENT CONFIGURATION
# =============================================================================

# Build configuration
export BUILD_COMMAND="npm run build"
export BUILD_DIR="dist"

# Backup configuration
export BACKUP_DIR="/var/www/$APP_NAME.backup"
export BACKUP_TIMESTAMP=$(date +%Y%m%d_%H%M%S)

# File permissions
export WEB_USER="www-data"
export WEB_GROUP="www-data"
export WEB_PERMISSIONS="755"

# =============================================================================
# EMAIL CONFIGURATION (for Let's Encrypt)
# =============================================================================

export LETSENCRYPT_EMAIL="admin@mnemo-cards.online"

# =============================================================================
# FIREWALL CONFIGURATION
# =============================================================================

export FIREWALL_ALLOW_NGINX="Nginx Full"
export FIREWALL_ALLOW_SSH="ssh"

# =============================================================================
# CRON CONFIGURATION (for certificate renewal)
# =============================================================================

export CRON_RENEWAL_TIMES="0 12 * * * 0 0 * * *"
export CRON_RENEWAL_COMMAND="certbot renew --quiet --post-hook \"systemctl reload nginx\" --cert-name admin.mnemo-cards.online"

# =============================================================================
# COLORS FOR OUTPUT
# =============================================================================

export RED='\033[0;31m'
export GREEN='\033[0;32m'
export YELLOW='\033[1;33m'
export BLUE='\033[0;34m'
export NC='\033[0m' # No Color

# =============================================================================
# HELPER FUNCTIONS
# =============================================================================

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

# Function to check if running from correct directory
check_project_root() {
    # If we're not in the React project root, try to navigate there
    if [ ! -f "package.json" ]; then
        # Find the project root by searching upwards from the script location
        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
        CURRENT_DIR="$SCRIPT_DIR"

        # Search upwards up to 5 levels to find mnemo_cards_admin/web/package.json
        for i in {1..5}; do
            # Check if we're in tools/deploy/admin (relative path)
            if [ -f "$CURRENT_DIR/../../../mnemo_cards_admin/web/package.json" ]; then
                PROJECT_ROOT="$(cd "$CURRENT_DIR/../../../mnemo_cards_admin/web" && pwd)"
                break
            fi

            # Check if we're in mnemo_cards_admin/web directory directly
            if [ -f "$CURRENT_DIR/package.json" ] && [[ "$CURRENT_DIR" == *"mnemo_cards_admin/web" ]]; then
                PROJECT_ROOT="$CURRENT_DIR"
                break
            fi

            # Check if current directory contains mnemo_cards_admin/web
            if [ -d "$CURRENT_DIR/mnemo_cards_admin/web" ] && [ -f "$CURRENT_DIR/mnemo_cards_admin/web/package.json" ]; then
                PROJECT_ROOT="$CURRENT_DIR/mnemo_cards_admin/web"
                break
            fi

            # Move up one directory
            CURRENT_DIR="$(dirname "$CURRENT_DIR")"
        done

        if [ -n "$PROJECT_ROOT" ] && [ -f "$PROJECT_ROOT/package.json" ]; then
            print_info "Navigating to React project root: $PROJECT_ROOT"
            cd "$PROJECT_ROOT"
        else
            print_error "Could not find React project directory (mnemo_cards_admin/web)"
            print_error "Searched from: $SCRIPT_DIR"
            print_error "Please run this script from within the mnemo_cards project directory"
            exit 1
        fi
    fi
}

# Function to check if build directory exists
check_build_directory() {
    if [ ! -d "$BUILD_DIR" ]; then
        print_error "Build directory not found. Please run '$BUILD_COMMAND' first"
        exit 1
    fi
}

# Function to build React app for production
build_react_app() {
    print_status "Building React app for production..."
    npm install
    npm run build

    if [ $? -ne 0 ]; then
        print_error "React build failed"
        exit 1
    fi

    print_success "React build completed successfully"
}

# Function to create backup
create_backup() {
    if [ -d "$WEB_ROOT" ] && [ "$(ls -A $WEB_ROOT 2>/dev/null)" ]; then
        print_status "Creating backup of existing deployment..."
        cp -r "$WEB_ROOT" "${BACKUP_DIR}.${BACKUP_TIMESTAMP}"
        print_success "Backup created: ${BACKUP_DIR}.${BACKUP_TIMESTAMP}"
    fi
}

# Function to set file permissions
set_permissions() {
    print_status "Setting proper permissions..."
    chown -R $WEB_USER:$WEB_GROUP "$WEB_ROOT"
    chmod -R $WEB_PERMISSIONS "$WEB_ROOT"
    print_success "Permissions set successfully"
}

# Function to test nginx configuration
test_nginx() {
    print_status "Testing nginx configuration..."
    nginx -t
    if [ $? -ne 0 ]; then
        print_error "Nginx configuration test failed"
        exit 1
    fi
    print_success "Nginx configuration is valid"
}

# Function to restart nginx
restart_nginx() {
    print_status "Restarting nginx..."
    systemctl restart nginx
    systemctl enable nginx
    print_success "Nginx restarted successfully"
}

# =============================================================================
# EXPORT ALL VARIABLES
# =============================================================================

# Make sure all variables are exported
export -f print_status print_warning print_error print_success print_info
export -f check_project_root check_build_directory build_react_app
export -f create_backup set_permissions test_nginx restart_nginx

print_info "Configuration loaded successfully"
print_info "Server: $SERVER_USER@$SERVER_IP"
print_info "Domain: $DOMAIN"
print_info "API URL: $API_BASE_URL"
print_info "Web Root: $WEB_ROOT"