#!/usr/bin/env bash
# fk installer — Linux/macOS. Self-contained: safe to run piped, e.g.
#
#   curl -fsSL https://install.filiokit.com | bash
#
# Interactive bootstrap for a fresh org deployment. Downloads the compose stack
# + Caddyfile from the install host, generates .env, brings the stack up,
# applies migrations, seeds defaults, and registers the first admin user.
#
# Re-runnable: when an existing $INSTALL_DIR/.env is found you can pick
# "refresh" to pull images + migrate while leaving secrets alone.
set -euo pipefail

INSTALL_DIR="${INSTALL_DIR:-/opt/fk}"
# Where to fetch the stack files from. Override for self-hosting/testing.
FK_ASSET_BASE="${FK_ASSET_BASE:-https://install.filiokit.com}"

bold()  { printf "\033[1m%s\033[0m\n" "$*"; }
green() { printf "\033[1;32m%s\033[0m\n" "$*"; }
red()   { printf "\033[1;31m%s\033[0m\n" "$*"; }
yel()   { printf "\033[1;33m%s\033[0m\n" "$*"; }

# When piped through `bash`, stdin is the script — read prompts from the TTY.
TTY=/dev/tty
ask() { # ask <var> <label> <default>
  local __var="$1" label="$2" default="${3:-}" val
  if [[ -n "$default" ]]; then
    read -r -p "$label [$default]: " val <"$TTY" || true
    printf -v "$__var" '%s' "${val:-$default}"
  else
    read -r -p "$label: " val <"$TTY" || true
    while [[ -z "$val" ]]; do yel "  required."; read -r -p "$label: " val <"$TTY" || true; done
    printf -v "$__var" '%s' "$val"
  fi
}
ask_secret() { # ask_secret <var> <label>
  local __var="$1" label="$2" val
  read -r -s -p "$label: " val <"$TTY" || true; echo
  printf -v "$__var" '%s' "$val"
}
confirm() { # confirm <label> <default>
  local label="$1" default="${2:-y}" val
  read -r -p "$label [$default]: " val <"$TTY" || true
  val="${val:-$default}"; [[ "$val" =~ ^[yY] ]]
}
require_cmd() { command -v "$1" >/dev/null 2>&1 || { red "missing required command: $1"; exit 1; }; }
gen_secret() {
  local n="${1:-32}"
  if command -v openssl >/dev/null 2>&1; then openssl rand -base64 "$n" | tr -d '\n=' | head -c "$n"
  else head -c "$n" /dev/urandom | base64 | tr -d '\n=' | head -c "$n"; fi
}
fetch() { # fetch <url> <dest>
  curl -fsSL "$1" -o "$2" || { red "failed to download $1"; exit 1; }
}

bold "fk installer"
echo "Install dir: $INSTALL_DIR"
echo "Assets from: $FK_ASSET_BASE"
echo

require_cmd docker
require_cmd curl
docker compose version >/dev/null 2>&1 || { red "docker compose plugin missing"; exit 1; }

if [[ -f "$INSTALL_DIR/.env" ]]; then
  yel "An existing install was found at $INSTALL_DIR."
  if confirm "Refresh stack only (pull images + migrate, keep secrets)" y; then
    cd "$INSTALL_DIR"
    yel "Pull uses your existing registry login. If it fails with a 401, run: docker login ghcr.io"
    fetch "$FK_ASSET_BASE/docker-compose.yml" "$INSTALL_DIR/docker-compose.yml"
    fetch "$FK_ASSET_BASE/Caddyfile" "$INSTALL_DIR/Caddyfile"
    docker compose pull
    docker compose up -d
    docker compose exec -T web sh -c 'pnpm --filter @fk/db migrate:deploy'
    green "✓ refresh done"
    exit 0
  fi
  red "Aborting to avoid clobbering existing secrets."
  echo "Move $INSTALL_DIR aside if you really want a clean install."
  exit 1
fi

mkdir -p "$INSTALL_DIR/storage"

bold "1) Domains"
ask CRM_DOMAIN "CRM hostname (where your team logs in)" "crm.example.com"
ask CLIENT_DOMAIN "Client portal hostname" "client.example.com"

bold "2) Licensing (from your fk Superadmin contact)"
ask SUPERADMIN_URL "Superadmin URL" "https://superadmin.filiokit.com"
ask ORG_ID "Org ID"
ask LICENSE_KEY "License key"
ask_secret LICENSE_SHARED_SECRET "License shared secret (HMAC)"

# Public verification keys are public — fetch the bundle straight from the
# superadmin so there's nothing to paste. Falls back to a manual PEM paste.
LICENSE_PUBLIC_KEYS_JSON=""
LICENSE_PUBLIC_KEY_PEM=""
echo "Fetching the license public-key bundle from $SUPERADMIN_URL …"
if FETCHED=$(curl -fsS "${SUPERADMIN_URL%/}/v1/license/public-keys" 2>/dev/null) && [[ "$FETCHED" == \[*\] ]]; then
  LICENSE_PUBLIC_KEYS_JSON="$FETCHED"
  green "  ✓ fetched public-key bundle automatically"
else
  yel "  ⚠ couldn't fetch — paste the Ed25519 public key PEM (end with a blank line):"
  while IFS= read -r line <"$TTY"; do [[ -z "$line" ]] && break; LICENSE_PUBLIC_KEY_PEM+="$line"$'\n'; done
fi

bold "3) Database (Postgres)"
ask PG_USER "Postgres user" "fk"
ask_secret PG_PASSWORD "Postgres password (blank = auto-generate)"
[[ -z "$PG_PASSWORD" ]] && PG_PASSWORD=$(gen_secret 24)
ask PG_DB "Postgres database name" "fk"

bold "4) Crypto"
echo "KEY_VAULT_MASTER_KEY encrypts SMTP passwords + API keys at rest."
ask_secret KEY_VAULT_MASTER_KEY "Master key (blank = auto-generate)"
[[ -z "$KEY_VAULT_MASTER_KEY" ]] && KEY_VAULT_MASTER_KEY=$(gen_secret 48)
AUTH_SECRET=$(gen_secret 48)

bold "5) First admin user"
ask ADMIN_EMAIL "Admin email"
ask ADMIN_NAME "Admin full name" "Admin"
ask_secret ADMIN_PASSWORD "Admin password (min 12 chars)"

bold "6) Optional: SMTP for outgoing email (blank host to skip)"
ask SMTP_HOST "SMTP host" ""
ask SMTP_PORT "SMTP port" "587"
ask SMTP_USER "SMTP username" ""
ask_secret SMTP_PASSWORD "SMTP password"
ask SMTP_FROM "From address" ""

bold "7) Image registry (images are private on GHCR)"
echo "Provide a GitHub token with the read:packages scope so this server can pull the images."
ask IMAGE_REGISTRY "Image registry" "ghcr.io/iodex99"
ask REGISTRY_USERNAME "GitHub username (for image pulls)"
ask_secret REGISTRY_TOKEN "GitHub token (read:packages)"

bold "Writing .env"
PEM_ESCAPED="$(printf '%s' "$LICENSE_PUBLIC_KEY_PEM" | awk 'BEGIN{ORS="\\n"} {print}')"
APP_URL="https://$CRM_DOMAIN"
CLIENT_APP_URL="https://$CLIENT_DOMAIN"
cat > "$INSTALL_DIR/.env" <<EOF
# Generated by install.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)
NODE_ENV=production

CRM_DOMAIN=$CRM_DOMAIN
CLIENT_DOMAIN=$CLIENT_DOMAIN
APP_URL=$APP_URL
NEXT_PUBLIC_APP_URL=$APP_URL
# Base URL of the client portal — used in client-facing emails (document-request login link).
CLIENT_APP_URL=$CLIENT_APP_URL

DATABASE_URL=postgresql://$PG_USER:$PG_PASSWORD@postgres:5432/$PG_DB?schema=public
PG_USER=$PG_USER
PG_PASSWORD=$PG_PASSWORD
PG_DB=$PG_DB

REDIS_URL=redis://redis:6379

KEY_VAULT_MASTER_KEY=$KEY_VAULT_MASTER_KEY
AUTH_SECRET=$AUTH_SECRET

SUPERADMIN_URL=$SUPERADMIN_URL
ORG_ID=$ORG_ID
LICENSE_KEY=$LICENSE_KEY
LICENSE_SHARED_SECRET=$LICENSE_SHARED_SECRET

STORAGE_ROOT=/storage

IMAGE_REGISTRY=$IMAGE_REGISTRY
IMAGE_TAG=latest
COMPOSE_PROJECT_NAME=fk

BOOTSTRAP_ADMIN_EMAIL=$ADMIN_EMAIL
BOOTSTRAP_ADMIN_NAME=$ADMIN_NAME
BOOTSTRAP_ADMIN_PASSWORD=$ADMIN_PASSWORD
EOF
if [[ -n "$SMTP_HOST" ]]; then
  cat >> "$INSTALL_DIR/.env" <<EOF
BOOTSTRAP_SMTP_HOST=$SMTP_HOST
BOOTSTRAP_SMTP_PORT=$SMTP_PORT
BOOTSTRAP_SMTP_USER=$SMTP_USER
BOOTSTRAP_SMTP_PASSWORD=$SMTP_PASSWORD
BOOTSTRAP_SMTP_FROM=$SMTP_FROM
EOF
fi
if [[ -n "$LICENSE_PUBLIC_KEYS_JSON" ]]; then
  printf "LICENSE_PUBLIC_KEYS_JSON='%s'\n" "$LICENSE_PUBLIC_KEYS_JSON" >> "$INSTALL_DIR/.env"
else
  printf 'LICENSE_PUBLIC_KEY_PEM="%s"\n' "$PEM_ESCAPED" >> "$INSTALL_DIR/.env"
fi
chmod 600 "$INSTALL_DIR/.env"
green "  → $INSTALL_DIR/.env (600)"

bold "Downloading stack files"
fetch "$FK_ASSET_BASE/docker-compose.yml" "$INSTALL_DIR/docker-compose.yml"
fetch "$FK_ASSET_BASE/Caddyfile" "$INSTALL_DIR/Caddyfile"
green "  → $INSTALL_DIR/docker-compose.yml"
green "  → $INSTALL_DIR/Caddyfile"

bold "Pulling images + starting stack"
cd "$INSTALL_DIR"
if [[ -n "$REGISTRY_TOKEN" ]]; then
  echo "$REGISTRY_TOKEN" | docker login "${IMAGE_REGISTRY%%/*}" -u "$REGISTRY_USERNAME" --password-stdin
fi
docker compose pull
docker compose up -d
echo "Waiting for postgres to accept connections…"
for _ in $(seq 1 30); do
  if docker compose exec -T postgres pg_isready -U "$PG_USER" >/dev/null 2>&1; then break; fi
  sleep 1
done

bold "Applying migrations + seeding"
docker compose exec -T web sh -c 'pnpm --filter @fk/db migrate:deploy'
docker compose exec -T web sh -c 'pnpm --filter @fk/db bootstrap'

bold "First license check"
if docker compose exec -T web sh -c 'curl -fsS -X POST http://localhost:3000/api/license/check'; then
  green "  ✓ license check OK"
else
  yel "  ⚠  license check failed — verify superadmin connectivity from inside the container"
fi

green ""
green "✓ fk is up"
echo "  CRM:           https://$CRM_DOMAIN"
echo "  Client portal: https://$CLIENT_DOMAIN"
echo "  Logs:          docker compose -f $INSTALL_DIR/docker-compose.yml logs -f"
echo "  Stop:          docker compose -f $INSTALL_DIR/docker-compose.yml down"