#!/usr/bin/env bash
# 客服云 — 腾讯云 / 任意 Linux 一键生产部署
# 默认 HTTP_PORT=18080，避免与宿主机 Caddy(80/443) 冲突；见 deploy/caddy/Caddyfile.example
# 用法：
#   ./deploy/scripts/deploy.sh              # 构建并启动
#   ./deploy/scripts/deploy.sh --seed       # 启动后导入演示账号数据
#   ./deploy/scripts/deploy.sh --pull-only  # 仅 pull/up，不强制 rebuild（需已有镜像）
#   ./deploy/scripts/deploy.sh --down       # 停止并移除容器（保留数据卷）
#   ./deploy/scripts/deploy.sh --status     # 查看状态

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "$ROOT_DIR"

COMPOSE_FILE="docker-compose.prod.yml"
ENV_FILE="deploy/.env.prod"
ENV_EXAMPLE="deploy/.env.prod.example"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log()  { echo -e "${GREEN}[deploy]${NC} $*"; }
warn() { echo -e "${YELLOW}[warn]${NC} $*"; }
err()  { echo -e "${RED}[error]${NC} $*" >&2; }

need_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    err "缺少命令: $1"
    exit 1
  fi
}

compose() {
  docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" "$@"
}

rand_hex() {
  if command -v openssl >/dev/null 2>&1; then
    openssl rand -hex 24
  else
    head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' | head -c 48
  fi
}

# 检测宿主机 TCP 端口是否已被占用（非本 compose 的 web 容器）
port_in_use() {
  local port="$1"
  if command -v ss >/dev/null 2>&1; then
    ss -tlnH "sport = :${port}" 2>/dev/null | grep -q .
    return $?
  fi
  if command -v lsof >/dev/null 2>&1; then
    lsof -iTCP:"${port}" -sTCP:LISTEN -n -P >/dev/null 2>&1
    return $?
  fi
  # 无 ss/lsof 时用 bash /dev/tcp 探测（仅作弱检测）
  (echo >/dev/tcp/127.0.0.1/"${port}") >/dev/null 2>&1
}

# 端口是否由本项目的 web 容器占用（升级/重部署时允许）
port_held_by_our_web() {
  local port="$1"
  docker ps --format '{{.Names}} {{.Ports}}' 2>/dev/null \
    | grep -E 'kefu-cloud-web' \
    | grep -qE "0\\.0\\.0\\.0:${port}->|:::${port}->"
}

check_http_port() {
  local port="${HTTP_PORT:-18080}"
  if ! [[ "$port" =~ ^[0-9]+$ ]] || [[ "$port" -lt 1 || "$port" -gt 65535 ]]; then
    err "HTTP_PORT 无效: ${port}"
    exit 1
  fi

  if [[ "$port" == "80" ]] || [[ "$port" == "443" ]]; then
    if port_in_use "$port" && ! port_held_by_our_web "$port"; then
      err "HTTP_PORT=${port} 已被占用（常见：宿主机 Caddy/Nginx）"
      err "请将 $ENV_FILE 中 HTTP_PORT 改为 18080，并由 Caddy 反代到该端口"
      err "参考: deploy/caddy/Caddyfile.example 与 deploy/README.md「与现有 Caddy 共存」"
      exit 1
    fi
  elif port_in_use "$port" && ! port_held_by_our_web "$port"; then
    err "HTTP_PORT=${port} 已被其它进程占用，请改 $ENV_FILE 中的 HTTP_PORT"
    if command -v ss >/dev/null 2>&1; then
      ss -tlnp 2>/dev/null | grep -E ":${port}\\s" || true
    fi
    exit 1
  fi

  # 80/443 被占用但用户选了 18080 时给提示
  if [[ "$port" != "80" ]] && port_in_use 80; then
    log "检测到宿主机 :80 已被占用（多为 Caddy），将使用 HTTP_PORT=${port}"
    log "部署后请把 Caddy 反代到 127.0.0.1:${port}（见 deploy/caddy/Caddyfile.example）"
  fi
}

ensure_env() {
  if [[ ! -f "$ENV_FILE" ]]; then
    if [[ ! -f "$ENV_EXAMPLE" ]]; then
      err "找不到 $ENV_EXAMPLE"
      exit 1
    fi
    log "未找到 $ENV_FILE，从示例生成…"
    cp "$ENV_EXAMPLE" "$ENV_FILE"

    local jwt dbpass minio_pass
    jwt="$(rand_hex)"
    dbpass="$(rand_hex)"
    minio_pass="K$(rand_hex | head -c 16)"

    # macOS / GNU sed 兼容
    if sed --version >/dev/null 2>&1; then
      sed -i "s|^JWT_SECRET=.*|JWT_SECRET=${jwt}|" "$ENV_FILE"
      sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=${dbpass}|" "$ENV_FILE"
      sed -i "s|^STORAGE_SECRET_KEY=.*|STORAGE_SECRET_KEY=${minio_pass}|" "$ENV_FILE"
    else
      sed -i '' "s|^JWT_SECRET=.*|JWT_SECRET=${jwt}|" "$ENV_FILE"
      sed -i '' "s|^DB_PASSWORD=.*|DB_PASSWORD=${dbpass}|" "$ENV_FILE"
      sed -i '' "s|^STORAGE_SECRET_KEY=.*|STORAGE_SECRET_KEY=${minio_pass}|" "$ENV_FILE"
    fi

    warn "已生成随机 JWT_SECRET / DB_PASSWORD / STORAGE_SECRET_KEY"
    warn "请编辑 $ENV_FILE，至少设置："
    warn "  APP_BASE_URL=https://你的域名   # 经 Caddy 时用 https 域名，勿写 :18080"
    warn "  STORAGE_PUBLIC_BASE_URL=https://你的域名/files"
    warn "  HTTP_PORT=18080               # 已有 Caddy 占 80 时保持默认；独占机可改 80"
    echo
    read -r -p "设置完成后按回车继续（或 Ctrl+C 退出先改配置）: " _
  fi

  # shellcheck disable=SC1090
  set -a
  # 去除 Windows CRLF
  source <(sed 's/\r$//' "$ENV_FILE" | grep -v '^\s*#' | grep -v '^\s*$' || true)
  set +a

  # 未显式设置时与 compose 默认一致
  HTTP_PORT="${HTTP_PORT:-18080}"

  if [[ -z "${JWT_SECRET:-}" || "${JWT_SECRET}" == *"请改"* ]]; then
    err "请在 $ENV_FILE 中设置有效的 JWT_SECRET"
    exit 1
  fi
  if [[ -z "${DB_PASSWORD:-}" || "${DB_PASSWORD}" == *"请改"* ]]; then
    err "请在 $ENV_FILE 中设置有效的 DB_PASSWORD"
    exit 1
  fi
  if [[ -z "${STORAGE_PUBLIC_BASE_URL:-}" || "${STORAGE_PUBLIC_BASE_URL}" == *"你的"* ]]; then
    err "请在 $ENV_FILE 中设置 STORAGE_PUBLIC_BASE_URL（如 https://域名/files）"
    exit 1
  fi
  if [[ -z "${STORAGE_ACCESS_KEY:-}" || -z "${STORAGE_SECRET_KEY:-}" ]]; then
    err "请设置 STORAGE_ACCESS_KEY / STORAGE_SECRET_KEY"
    exit 1
  fi
  if [[ ${#STORAGE_SECRET_KEY} -lt 8 ]]; then
    err "STORAGE_SECRET_KEY 长度至少 8 位（MinIO 要求）"
    exit 1
  fi

  check_http_port
}

wait_healthy() {
  local url="${1:-http://127.0.0.1:${HTTP_PORT:-18080}/health}"
  local i
  log "等待服务就绪: $url"
  for i in $(seq 1 60); do
    if curl -fsS "$url" >/dev/null 2>&1; then
      log "健康检查通过"
      return 0
    fi
    sleep 2
  done
  err "健康检查超时，请执行: docker compose -f $COMPOSE_FILE --env-file $ENV_FILE logs"
  return 1
}

print_summary() {
  local port="${HTTP_PORT:-18080}"
  local base="${APP_BASE_URL:-http://127.0.0.1:${port}}"
  echo
  log "========== 部署完成 =========="
  echo "  访问地址:     ${base}"
  echo "  登录页:       ${base}/login"
  echo "  健康检查:     ${base}/health"
  echo "  Widget 预览:  ${base}/widget/preview"
  echo "  图片前缀:     ${STORAGE_PUBLIC_BASE_URL}"
  echo "  本机探测:     http://127.0.0.1:${port}/healthz  （web 容器映射端口）"
  echo
  if [[ "$port" != "80" && "$port" != "443" ]]; then
    echo "  Caddy 共存:"
    echo "    1) 确认本机: curl -fsS http://127.0.0.1:${port}/healthz"
    echo "    2) 合并 deploy/caddy/Caddyfile.example 到现有 Caddy，反代 127.0.0.1:${port}"
    echo "    3) APP_BASE_URL / STORAGE_PUBLIC_BASE_URL 使用 https 域名（不要写 :${port}）"
    echo
  fi
  echo "  常用命令:"
  echo "    查看状态  ./deploy/scripts/deploy.sh --status"
  echo "    查看日志  docker compose -f $COMPOSE_FILE --env-file $ENV_FILE logs -f"
  echo "    导入种子  ./deploy/scripts/deploy.sh --seed-only"
  echo "    停止服务  ./deploy/scripts/deploy.sh --down"
  echo
  echo "  安全提示: 安全组仅放行 22/80/443（不必公网放行 ${port}）；改默认密码；生产用 HTTPS。"
  echo "=============================="
}

cmd_up() {
  local seed=0 rebuild=1
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --seed) seed=1 ;;
      --pull-only) rebuild=0 ;;
      *) ;;
    esac
    shift
  done

  need_cmd docker
  need_cmd curl
  if ! docker compose version >/dev/null 2>&1; then
    err "需要 Docker Compose V2（docker compose）"
    exit 1
  fi

  ensure_env

  log "拉取基础镜像…"
  compose pull postgres minio minio-init || true

  if [[ "$rebuild" -eq 1 ]]; then
    log "构建并启动全部服务（api + web + db + minio）…"
    compose up -d --build --remove-orphans
  else
    log "启动服务（不强制 rebuild）…"
    compose up -d --remove-orphans
  fi

  wait_healthy "http://127.0.0.1:${HTTP_PORT:-18080}/health" || true
  wait_healthy "http://127.0.0.1:${HTTP_PORT:-18080}/healthz" || true

  if [[ "$seed" -eq 1 ]]; then
    log "导入演示种子数据…"
    compose --profile seed run --rm seed || warn "种子导入失败（可能已存在数据）"
  fi

  compose ps
  print_summary
}

cmd_seed_only() {
  need_cmd docker
  ensure_env
  log "运行 seed…"
  compose --profile seed run --rm seed
  log "种子完成。默认租户管理员 kefu_admin / kefu_admin123 （若 seed 成功）"
}

cmd_down() {
  need_cmd docker
  ensure_env
  log "停止容器（保留数据卷）…"
  compose down
  log "已停止。删除数据卷请手动: docker volume rm kefu-cloud_kefu_cloud_pgdata kefu-cloud_kefu_cloud_miniodata"
}

cmd_status() {
  need_cmd docker
  if [[ -f "$ENV_FILE" ]]; then
    compose ps
    echo
    curl -fsS "http://127.0.0.1:${HTTP_PORT:-18080}/health" && echo || warn "health 不可达"
  else
    err "缺少 $ENV_FILE"
    exit 1
  fi
}

main() {
  local action="${1:-up}"
  case "$action" in
    up|--up|"")
      shift || true
      cmd_up "$@"
      ;;
    --seed)
      # 兼容：./deploy.sh --seed
      cmd_up --seed
      ;;
    --seed-only)
      cmd_seed_only
      ;;
    --down|down)
      cmd_down
      ;;
    --status|status)
      # 尝试读 HTTP_PORT
      if [[ -f "$ENV_FILE" ]]; then
        # shellcheck disable=SC1090
        set -a; source <(sed 's/\r$//' "$ENV_FILE" | grep -v '^\s*#' | grep -v '^\s*$' || true); set +a
      fi
      cmd_status
      ;;
    --pull-only)
      cmd_up --pull-only
      ;;
    -h|--help|help)
      sed -n '2,12p' "$0"
      ;;
    *)
      err "未知参数: $action （见 --help）"
      exit 1
      ;;
  esac
}

main "$@"