#!/bin/bash
set -euo pipefail

export PATH="/usr/local/cpanel/bin:/usr/local/cpanel/scripts:$PATH"

########################################
# INGRESO DE VARIABLES
########################################

if [[ $# -lt 4 ]]; then
  echo "Uso: ./setup_cd_project2.sh <base_name> <email> \"<title>\" <product> [password] [domain] [source_db]"
  echo "Ejemplo: ./setup_cd_project2.sh juandev2 juan@mail.com \"Juan Dev Studio\" art-design"
  echo "Con BD existente: ./setup_cd_project2.sh juandev2 juan@mail.com \"Juan Dev Studio\" art-design MyPass https://juandev2.bewpro.com bp-juandev"
  exit 1
fi

BASE_NAME="$1"
EMAIL="$2"
TITLE="$3"
PRODUCT="$4"
# Si $5 viene vacío desde el webhook, generar clave (bash ${5:-x} no aplica a cadena vacía)
if [[ $# -ge 5 && -n "${5}" ]]; then
  PASSWORD="$5"
else
  PASSWORD="$(openssl rand -base64 12 | tr -d '/+=')"
fi
DOMAIN_ARG="${6:-}"   # URL completa APP_URL (ej. https://cliente.com) — desde campo «URL del sitio»
SOURCE_DB="${7:-}"    # BD ya creada en project-setup en ESTE mismo MySQL (vacío = bewpro:new)

########################################
# VARIABLES AUTOMÁTICAS
########################################

USERNAME="${BASE_NAME}"
DOMAIN_NAME="${BASE_NAME}.bewpro.com"
APP_URL="${DOMAIN_ARG:-https://${DOMAIN_NAME}}"

DB_NAME="${BASE_NAME}_bp"
DB_USER="${BASE_NAME}_bpuser"
DB_PASSWORD="${PASSWORD}"

APP_NAME="${BASE_NAME}"

REPO_SSH="git@github.com:LACOMPANIADIGITAL/cd-system.git"
REPO_REFERENCE="/opt/cd-system-reference.git"
PROJECT_DIR_NAME="${BASE_NAME}"

PHP_BIN="php"
COMPOSER_BIN="composer"
COMPOSER_CACHE_DIR="/root/.composer-cache"

HOSTINGER_DNS_ZONE="bewpro.com"
HOSTINGER_SERVER_IP="72.61.45.136"
CONFIG_FILE="/root/scripts/.airtable.env"
[[ -f "$CONFIG_FILE" ]] && source "$CONFIG_FILE"
HOSTINGER_TOKEN="${HOSTINGER_TOKEN:-}"

########################################
# CHEQUEO DE ROOT
########################################

if [[ "$(id -u)" -ne 0 ]]; then
  echo "Este script debe ejecutarse como root." >&2
  exit 1
fi

########################################
# INICIO
########################################

echo "=========================================" >&2
echo "  SETUP NUEVO PROYECTO: ${DOMAIN_NAME}"   >&2
echo "  Usuario cPanel: ${USERNAME}"             >&2
echo "  Email: ${EMAIL}"                         >&2
echo "  Título: ${TITLE}"                        >&2
echo "  Producto: ${PRODUCT}"                    >&2
echo "  URL: ${APP_URL}"                         >&2
[[ -n "${SOURCE_DB}" ]] && echo "  BD fuente: ${SOURCE_DB}" >&2
echo "=========================================" >&2

########################################
# 1. Crear cuenta cPanel
########################################

echo "[1/10] Creando cuenta cPanel..." >&2

whmapi1 createacct \
  username="${USERNAME}" \
  domain="${DOMAIN_NAME}" \
  password="${DB_PASSWORD}" \
  contactemail="noreply@bewpro.com" >/tmp/createacct_${USERNAME}.log 2>&1

if ! grep -q "result: 1" /tmp/createacct_${USERNAME}.log; then
  if grep -q "already exists" /tmp/createacct_${USERNAME}.log; then
    echo "[1/10] Cuenta ya existe — continuando (idempotente)." >&2
  else
    echo "Error creando cuenta cPanel:" >&2
    grep "reason:" /tmp/createacct_${USERNAME}.log >&2 || cat /tmp/createacct_${USERNAME}.log >&2
    exit 1
  fi
else
  echo "[1/10] Cuenta creada." >&2
fi

echo "[1/10] Esperando que el usuario esté disponible..." >&2
for i in $(seq 1 15); do
  id "${USERNAME}" &>/dev/null && break
  sleep 2
done
id "${USERNAME}" &>/dev/null || { echo "ERROR: usuario ${USERNAME} no disponible tras 30s" >&2; exit 1; }

########################################
# 2. Crear DB, usuario y permisos
########################################

echo "[2/10] Creando DB y usuario..." >&2

uapi --user="${USERNAME}" Mysql create_database name="${DB_NAME}" >&2
uapi --user="${USERNAME}" Mysql create_user name="${DB_USER}" password="${DB_PASSWORD}" >&2
uapi --user="${USERNAME}" Mysql set_privileges_on_database \
  user="${DB_USER}" \
  database="${DB_NAME}" \
  privileges=ALL >&2

echo "[2/10] DB ${DB_NAME} y USER ${DB_USER} creados." >&2

########################################
# 3. Copiar claves SSH al usuario
########################################

echo "[3/10] Configurando claves SSH..." >&2

mkdir -p "/home/${USERNAME}/.ssh"

[ -f /root/.ssh/id_rsa ]     && cp /root/.ssh/id_rsa*     "/home/${USERNAME}/.ssh/" || true
[ -f /root/.ssh/id_ed25519 ] && cp /root/.ssh/id_ed25519* "/home/${USERNAME}/.ssh/" || true

if compgen -G "/home/${USERNAME}/.ssh/*.pub" > /dev/null; then
  cat "/home/${USERNAME}/.ssh/"*.pub > "/home/${USERNAME}/.ssh/authorized_keys"
fi

chown -R "${USERNAME}:${USERNAME}" "/home/${USERNAME}/.ssh"
chmod 700 "/home/${USERNAME}/.ssh"
chmod 600 "/home/${USERNAME}/.ssh"/* 2>/dev/null || true
chmod 644 "/home/${USERNAME}/.ssh/"*.pub 2>/dev/null || true
chmod 600 "/home/${USERNAME}/.ssh/authorized_keys" 2>/dev/null || true

echo "[3/10] Claves SSH configuradas." >&2

########################################
# 4. Crear estructura git-files
########################################

echo "[4/10] Preparando estructura git-files..." >&2

su - "${USERNAME}" -c "mkdir -p public_html/git-files/${PROJECT_DIR_NAME}" >&2

su - "${USERNAME}" -c "
  mkdir -p ~/.ssh
  ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null || true
  chmod 700 ~/.ssh
  chmod 644 ~/.ssh/known_hosts
" >&2

########################################
# 5. Clonar cd-system (con reference local)
########################################

echo "[5/10] Clonando repositorio cd-system..." >&2

if [[ ! -d "${REPO_REFERENCE}" ]]; then
  echo "[5/10] Inicializando reference clone (primera vez, puede tardar)..." >&2
  git clone --bare "${REPO_SSH}" "${REPO_REFERENCE}" >&2
else
  git -C "${REPO_REFERENCE}" fetch --all --quiet >&2
fi

if su - "${USERNAME}" -c "test -d public_html/git-files/${PROJECT_DIR_NAME}/.git" 2>/dev/null; then
  echo "[5/10] Repo ya existe — haciendo git pull (idempotente)." >&2
  su - "${USERNAME}" -c "
    cd public_html/git-files/${PROJECT_DIR_NAME} &&
    git pull --ff-only origin cd-system
  " >&2
else
  su - "${USERNAME}" -c "
    cd public_html/git-files/${PROJECT_DIR_NAME} &&
    git clone --branch cd-system --reference ${REPO_REFERENCE} ${REPO_SSH} .
  " >&2
fi

########################################
# 6. Composer + .env base
########################################

echo "[6/10] Configurando Laravel..." >&2

su - "${USERNAME}" -c "
  cd public_html/git-files/${PROJECT_DIR_NAME} &&
  cp .env.example .env
" >&2

APP_KEY_VALUE="base64:$(openssl rand -base64 32)"

su - "${USERNAME}" -c "
  cd public_html/git-files/${PROJECT_DIR_NAME} &&
  sed -i \
    -e 's|^APP_NAME=.*|APP_NAME=\"${APP_NAME}\"|' \
    -e 's|^APP_ENV=.*|APP_ENV=production|' \
    -e 's|^APP_DEBUG=.*|APP_DEBUG=false|' \
    -e 's|^APP_URL=.*|APP_URL=${APP_URL}|' \
    -e 's|^APP_KEY=.*|APP_KEY=${APP_KEY_VALUE}|' \
    -e 's|^DB_CONNECTION=.*|DB_CONNECTION=mysql|' \
    -e 's|^DB_HOST=.*|DB_HOST=localhost|' \
    -e 's|^DB_PORT=.*|DB_PORT=3306|' \
    -e 's|^DB_DATABASE=.*|DB_DATABASE=${DB_NAME}|' \
    -e 's|^DB_USERNAME=.*|DB_USERNAME=${DB_USER}|' \
    -e 's|^DB_PASSWORD=.*|DB_PASSWORD=${DB_PASSWORD}|' \
    -e 's|^RUN_PROJECT_SEEDER=.*|RUN_PROJECT_SEEDER=true|' \
    .env
" >&2

su - "${USERNAME}" -c "
  COMPOSER_CACHE_DIR=${COMPOSER_CACHE_DIR}
  cd public_html/git-files/${PROJECT_DIR_NAME} &&
  COMPOSER_CACHE_DIR=${COMPOSER_CACHE_DIR} \
  ${COMPOSER_BIN} install --no-scripts --no-interaction --ignore-platform-reqs
" >&2

su - "${USERNAME}" -c "
  cd public_html/git-files/${PROJECT_DIR_NAME} &&
  ${PHP_BIN} artisan package:discover --ansi
" >&2 || true

########################################
# 7. Provisionar (BD fuente o bewpro:new)
########################################

if [[ -n "${SOURCE_DB}" ]]; then
  echo "[7/10] Importando BD '${SOURCE_DB}' → '${DB_NAME}'..." >&2

  DB_EXISTS=$(mysql -Nse "SELECT COUNT(*) FROM information_schema.SCHEMATA WHERE SCHEMA_NAME='${SOURCE_DB}'" 2>/dev/null || echo 0)
  if [[ "${DB_EXISTS}" != "1" ]]; then
    echo "ERROR: La BD fuente '${SOURCE_DB}' no existe en el MySQL de este servidor." >&2
    echo "       Pasos 1 y 2 de project-setup deben ejecutarse en el MISMO servidor donde corre este script." >&2
    echo "       Ahí verás la base en phpMyAdmin de la cuenta del panel (no dentro del cPanel del cliente nuevo)." >&2
    exit 1
  fi

  mysqldump --single-transaction --no-tablespaces "${SOURCE_DB}" | mysql "${DB_NAME}"

  echo "[7/10] BD importada. Ejecutando artisan setup..." >&2

  # CD-System deshabilita config:cache (multitenant); usar config:clear tras importar BD
  su - "${USERNAME}" -c "
    cd public_html/git-files/${PROJECT_DIR_NAME} &&
    ${PHP_BIN} artisan config:clear --no-interaction &&
    ${PHP_BIN} artisan storage:link
  " >&2

else
  echo "[7/10] Provisionando proyecto con bewpro:new..." >&2

  su - "${USERNAME}" -c "
    cd public_html/git-files/${PROJECT_DIR_NAME} &&
    ${PHP_BIN} artisan bewpro:new \
      '${EMAIL}' \
      '${TITLE}' \
      '${PRODUCT}' \
      --db='${DB_NAME}' \
      --url='${APP_URL}' \
      --password='${PASSWORD}' \
      --skip-assets \
      --no-email \
      --no-interaction
  " >&2

  su - "${USERNAME}" -c "
    cd public_html/git-files/${PROJECT_DIR_NAME} &&
    ${PHP_BIN} artisan storage:link
  " >&2
fi

echo "[7/10] Provisionado." >&2

########################################
# 8. Crear .htaccess
########################################

echo "[8/10] Generando .htaccess..." >&2

cat > "/home/${USERNAME}/public_html/.htaccess" <<EOF
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^\.well-known/acme-challenge/ - [L,NC]
  RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ [NC]
  RewriteCond %{REQUEST_URI} !^/git-files/${PROJECT_DIR_NAME}/public/ [NC]
  RewriteRule ^(.*)$ git-files/${PROJECT_DIR_NAME}/public/\$1 [L]
</IfModule>
EOF

chown "${USERNAME}:${USERNAME}" "/home/${USERNAME}/public_html/.htaccess"

echo "[8/10] .htaccess creado." >&2

########################################
# 9. DNS en Hostinger
########################################

echo "[9/10] Creando registro DNS..." >&2

if [[ "${APP_URL}" == *".bewpro.com"* ]] && [[ -n "${HOSTINGER_TOKEN}" ]]; then
  DNS_RESULT=$(curl -s -X PUT \
    -H "Authorization: Bearer ${HOSTINGER_TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{\"overwrite\": false, \"zone\": [{\"name\": \"${BASE_NAME}\", \"type\": \"A\", \"ttl\": 3600, \"records\": [{\"content\": \"${HOSTINGER_SERVER_IP}\"}]}]}" \
    "https://developers.hostinger.com/api/dns/v1/zones/${HOSTINGER_DNS_ZONE}")

  if echo "${DNS_RESULT}" | grep -q "accepted\|success"; then
    echo "[9/10] DNS creado: ${BASE_NAME}.${HOSTINGER_DNS_ZONE} → ${HOSTINGER_SERVER_IP}" >&2
  else
    echo "[9/10] WARN: DNS no pudo crearse. Crear manualmente: ${DOMAIN_NAME} → ${HOSTINGER_SERVER_IP}" >&2
  fi
else
  echo "[9/10] DNS manual requerido: ${DOMAIN_NAME} → ${HOSTINGER_SERVER_IP}" >&2
fi

########################################
# 10. AutoSSL
########################################

echo "[10/10] Iniciando AutoSSL..." >&2
sleep 30
whmapi1 start_autossl_check_for_one_user username="${USERNAME}" >/dev/null 2>&1 || true

SSL_OK=false
for i in $(seq 1 18); do
  CERT_INFO=$(whmapi1 fetch_ssl_vhosts 2>/dev/null | grep -A5 "${DOMAIN_NAME}" || true)
  if echo "${CERT_INFO}" | grep -q "certificate"; then
    SSL_OK=true; break
  fi
  sleep 5
done

$SSL_OK && echo "[10/10] SSL emitido." >&2 || echo "[10/10] WARN: SSL pendiente (puede tardar unos minutos más)." >&2

########################################
# FIN — stdout solo para captura
########################################

echo "=========================================" >&2
echo " PROYECTO LISTO: ${APP_URL}"               >&2
echo " cPanel: ${USERNAME} | DB: ${DB_NAME}"     >&2
echo "=========================================" >&2

echo "${APP_URL}"