set -euo pipefail

NEW="$HOME/srs-api.new"
LIVE="$HOME/srs-api"
DATA="$HOME/srs-data"
ENV_FILE="$DATA/.env"
BACKUPS="$DATA/backups"

fail() { echo "ERROR: $*" >&2; exit 1; }
env_value() { grep -E "^$1=" "$ENV_FILE" | tail -n1 | cut -d= -f2- | tr -d '"' || true; }

echo "== checks"
[ -d "$NEW" ] || fail "missing $NEW"
[ -f "$ENV_FILE" ] || fail "missing $ENV_FILE: create it once by hand (first deploy)"
chmod 600 "$ENV_FILE"

DB_PATH="$(env_value DB_PATH)"
case "$DB_PATH" in
  "$LIVE"|"$LIVE"/*|"$NEW"|"$NEW"/*) fail "DB_PATH must be outside $LIVE" ;;
  /*) ;;
  *) fail "DB_PATH must be an absolute path under $DATA (got '${DB_PATH:-unset}')" ;;
esac

PORT="$(env_value PORT)"; PORT="${PORT:-8080}"

if ! pm2 describe srs-api >/dev/null 2>&1 && ss -tln | grep -q "127.0.0.1:$PORT "; then
  fail "port $PORT is already in use and srs-api is not running: close the SSH tunnel"
fi

sudo -n -H -u hermes true || fail "srs cannot act as hermes: add the sudoers line (first deploy)"

echo "== build"
cd "$NEW"
ln -sfn "$ENV_FILE" .env
npm ci
npm run build

echo "== database backup"
if [ -f "$DB_PATH" ]; then
  mkdir -p "$BACKUPS"
  sqlite3 "$DB_PATH" ".backup '$BACKUPS/srs-$(date +%Y%m%d-%H%M%S).db'"
  ls -1t "$BACKUPS"/srs-*.db | tail -n +15 | xargs -r rm -f
else
  echo "no database yet: skipped"
fi

echo "== migrate"
node dist/db/migrate.js

echo "== swap and restart"
cd "$HOME"
rm -rf "$LIVE"
mv "$NEW" "$LIVE"
cd "$LIVE"
pm2 startOrRestart ecosystem.config.cjs --update-env
pm2 save

echo "== health"
ok=0
for _ in $(seq 1 30); do
  if curl -fsS "http://127.0.0.1:$PORT/api/health" >/dev/null 2>&1; then ok=1; break; fi
  sleep 2
done
[ "$ok" = 1 ] || fail "srs-api did not answer /api/health: check 'pm2 logs srs-api'"
echo "srs-api is healthy"

echo "== plugin"
SRC="$LIVE/hermes-plugin/srs-gate"
version_of() { sed -n 's/^version:[[:space:]]*"\{0,1\}\([^" ]*\)"\{0,1\}.*/\1/p' | head -n1; }
NEW_VER="$(version_of < "$SRC/plugin.yaml")"
# Runs from "/" because hermes cannot enter srs's folders.
OLD_VER="$(cd / && sudo -n -H -u hermes bash -c 'cat "$HOME/.hermes/plugins/srs-gate/plugin.yaml" 2>/dev/null' | version_of || true)"

[ -n "$NEW_VER" ] || fail "no version in the repo's plugin.yaml"
if [ -z "$OLD_VER" ]; then
  fail "srs-gate is not installed on this server: install and enable it by hand first (HERMES-PLUGIN-PLAN section 6)"
fi
if [ "$NEW_VER" = "$OLD_VER" ]; then echo "plugin $OLD_VER is current: nothing to do"; exit 0; fi
HIGHEST="$(printf '%s\n%s\n' "$OLD_VER" "$NEW_VER" | sort -V | tail -n1)"
if [ "$HIGHEST" != "$NEW_VER" ]; then
  echo "WARNING: repo plugin $NEW_VER is older than installed $OLD_VER: plugin skipped (rollback is manual)"
  exit 0
fi

echo "updating plugin $OLD_VER -> $NEW_VER"
INSTALLER="$(cat "$LIVE/deploy/install-plugin.sh")"
tar -c -C "$SRC" __init__.py plugin.yaml \
  | (cd / && sudo -n -H -u hermes bash -c "$INSTALLER" install-plugin "$OLD_VER" "$NEW_VER")
echo "plugin updated: send a test WhatsApp message and look for 'srs-gate: id=... status=200' in agent.log"