#!/usr/bin/env bash
set -euo pipefail

# Run from an operator machine that can SSH to both hw.imruyi.top and aihost.
# No secrets are embedded; the script uses existing server-side Docker/env state.

HW_HOST="${HW_HOST:-hw.imruyi.top}"
AIHOST_HOST="${AIHOST_HOST:-aihost}"
PRIMARY_AUTH="${PRIMARY_AUTH:-https://auth.cnnetmkt.top}"
PRIMARY_ENTRY="${PRIMARY_ENTRY:-https://cnnetmkt.top}"
UCC_DEPLOY_DIR="${UCC_DEPLOY_DIR:-/data/aios/aios_r13_v18_runtime_portable_silent_20260704/components/user-control-center/deploy}"

printf '== update Casdoor application on %s ==\n' "$AIHOST_HOST"
ssh "$AIHOST_HOST" bash -s <<'AIHOST'
set -euo pipefail
TS=$(date -u +%Y%m%dT%H%M%SZ)
BACKUP_DIR="/data/aios/backups/casdoor-cnnetmkt-primary-$TS"
sudo mkdir -p "$BACKUP_DIR"
sudo chown "$USER":"$USER" "$BACKUP_DIR"
docker exec casdoor-postgres pg_dump -U casdoor -d casdoor -t application > "$BACKUP_DIR/application-before.sql"
docker exec -i casdoor-postgres psql -U casdoor -d casdoor -v ON_ERROR_STOP=1 <<'SQL'
UPDATE application
SET
  homepage_url = 'https://cnnetmkt.top/',
  signin_url = 'https://cnnetmkt.top/portal/login/',
  signup_url = 'https://cnnetmkt.top/portal/register/',
  redirect_uris = '["https://cnnetmkt.top/api/auth/callback/casdoor", "https://cnnetmkt.top/casdoor/callback/", "https://portal.cnnetmkt.top/api/auth/callback/casdoor", "https://portal.cnnetmkt.top/casdoor/callback/", "https://user.cnnetmkt.top/api/auth/callback/casdoor", "https://user.cnnetmkt.top/casdoor/callback/", "https://portal.h.imruyi.top:8443/api/auth/callback/casdoor", "https://portal.h.imruyi.top:8443/casdoor/callback/"]'
WHERE owner = 'admin' AND name = 'aios-portal';
SQL
docker exec casdoor-postgres psql -U casdoor -d casdoor -P pager=off -c "select owner,name,homepage_url,signin_url,signup_url,redirect_uris from application where owner='admin' and name='aios-portal';" > "$BACKUP_DIR/application-after.txt"
cat "$BACKUP_DIR/application-after.txt"
printf 'casdoor_backup_dir=%s\n' "$BACKUP_DIR"
AIHOST

printf '\n== update HW ingress and UCC runtime on %s ==\n' "$HW_HOST"
ssh "$HW_HOST" bash -s <<HW
set -euo pipefail
TS=\$(date -u +%Y%m%dT%H%M%SZ)
BACKUP_DIR="/data/aios-gitops/backups/auth-cnnetmkt-primary-\$TS"
ENV_FILE="$UCC_DEPLOY_DIR/.env"
NGINX_AUTH="/etc/nginx/sites-available/auth-cnnetmkt-casdoor.conf"
sudo mkdir -p "\$BACKUP_DIR"
sudo cp -a "\$ENV_FILE" "\$BACKUP_DIR/user-control.env.before"
sudo cp -a /etc/nginx/sites-available "\$BACKUP_DIR/nginx-sites-available.before"

set_env() {
  local key="\$1" value="\$2"
  if sudo grep -q "^\${key}=" "\$ENV_FILE"; then
    sudo sed -i "s#^\${key}=.*#\${key}=\${value}#" "\$ENV_FILE"
  else
    printf '%s=%s\n' "\$key" "\$value" | sudo tee -a "\$ENV_FILE" >/dev/null
  fi
}

set_env ALLOWED_HOSTS 'cnnetmkt.top,portal.cnnetmkt.top,user.cnnetmkt.top,auth.cnnetmkt.top,127.0.0.1,localhost,hw.imruyi.top,1.95.164.183,portal.h.imruyi.top'
set_env CSRF_TRUSTED_ORIGINS 'https://cnnetmkt.top,https://portal.cnnetmkt.top,https://user.cnnetmkt.top,https://auth.cnnetmkt.top,http://portal.cnnetmkt.top,http://hw.imruyi.top,http://1.95.164.183,https://portal.h.imruyi.top:8443,http://portal.h.imruyi.top,http://user.cnnetmkt.top'
set_env UCC_PUBLIC_BASE_URL '$PRIMARY_ENTRY'
set_env CASDOOR_PUBLIC_BASE_URL '$PRIMARY_AUTH'
set_env CASDOOR_INTERNAL_BASE_URL '$PRIMARY_AUTH'
set_env CASDOOR_INVITE_SYNC_BASE_URL '$PRIMARY_AUTH'

sudo tee "\$NGINX_AUTH" >/dev/null <<'NGINX'
# AIOS primary public Casdoor entry for cnnetmkt.top.
# The upstream remains the existing backup/home Casdoor service; public clients should see auth.cnnetmkt.top only.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name auth.cnnetmkt.top;

    access_log /var/log/nginx/aios-auth-cnnetmkt.access.log;
    error_log /var/log/nginx/aios-auth-cnnetmkt.error.log;

    ssl_certificate /etc/letsencrypt/live/cnnetmkt-wildcard/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cnnetmkt-wildcard/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass https://auth.h.imruyi.top:8443;
        proxy_http_version 1.1;
        proxy_ssl_server_name on;
        proxy_ssl_name auth.h.imruyi.top;
        proxy_ssl_verify off;
        proxy_set_header Host auth.h.imruyi.top;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host \$host;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection \$connection_upgrade;
        proxy_redirect https://auth.h.imruyi.top:8443/ https://auth.cnnetmkt.top/;
        proxy_redirect https://auth.h.imruyi.top/ https://auth.cnnetmkt.top/;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name auth.cnnetmkt.top;
    return 301 https://\$host\$request_uri;
}
NGINX

sudo ln -sf "\$NGINX_AUTH" /etc/nginx/sites-enabled/auth-cnnetmkt-casdoor.conf
sudo nginx -t
sudo systemctl reload nginx
cd "$UCC_DEPLOY_DIR"
sudo docker compose up -d --force-recreate user-control-web user-control-worker user-control-beat
printf 'hw_backup_dir=%s\n' "\$BACKUP_DIR"
HW

"$(dirname "$0")/check_cnnetmkt_auth_primary.sh"