#!/usr/bin/env bash
# One-shot provisioning for a fresh XAMXAM clone (local dev).
#
# Steps:
#   1. Ensure app/.env exists with a valid APP_KEY (NEVER overwrites an existing key).
#   2. Install dependencies: composer install + npm ci.
#   3. Create/update the SQLite DB from schema + migrations (just migrate).
#   4. Report the first-admin status (and how to set a password, if unset).
#
# Idempotent: safe to re-run on an already-provisioned clone.
# Run via: just provision

set -euo pipefail

GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
ok()   { printf "${GREEN}✓${NC} %s\n" "$*"; }
warn() { printf "${YELLOW}!${NC} %s\n" "$*"; }
info() { printf "${CYAN}→${NC} %s\n" "$*"; }
die()  { printf "${RED}✗${NC} %s\n" "$*" >&2; exit 1; }

cd "$(cd "$(dirname "$0")/.." && pwd)"

ENV_FILE="app/.env"

# ── 1. APP_KEY / .env ──────────────────────────────────────────────────────────
info "Checking $ENV_FILE for APP_KEY…"
key_exists() {
    [ -f "$ENV_FILE" ] && grep -qE '^\s*APP_KEY=\S+' "$ENV_FILE"
}

if [ -f "$ENV_FILE" ] && key_exists; then
    ok "APP_KEY already present in $ENV_FILE — NOT overwriting it."
    warn "Keeping the existing key so encrypted credentials stay decryptable."
elif [ -f "$ENV_FILE" ]; then
    warn "$ENV_FILE exists but has no APP_KEY — appending one (existing lines untouched)."
    printf '\nAPP_KEY=%s\n' "$(php -r 'echo base64_encode(random_bytes(32));')" >> "$ENV_FILE"
    chmod 600 "$ENV_FILE"
    ok "APP_KEY appended to $ENV_FILE."
elif command -v php >/dev/null 2>&1; then
    printf 'APP_KEY=%s\n' "$(php -r 'echo base64_encode(random_bytes(32));')" > "$ENV_FILE"
    chmod 600 "$ENV_FILE"
    ok "Created $ENV_FILE with a new APP_KEY."
else
    warn "PHP not found — skipping automatic .env creation."
    warn "Create $ENV_FILE manually with: APP_KEY=<base64-encoded 32 random bytes>"
fi

# ── 2. Dependencies ─────────────────────────────────────────────────────────────
info "Installing Composer dependencies…"
command -v composer >/dev/null 2>&1 || die "composer not found on PATH. Install it first."
composer install

info "Installing npm dependencies…"
command -v npm >/dev/null 2>&1 || die "npm not found on PATH. Install it first."
npm ci

# ── 3. Database ─────────────────────────────────────────────────────────────────
info "Creating/updating the SQLite database…"
command -v just >/dev/null 2>&1 || die "just not found on PATH. Install it first (or run scripts/migrate.sh)."
just migrate

# ── 4. First admin password ─────────────────────────────────────────────────────
DB="app/storage/xamxam.db"
if [ -f "$DB" ] && command -v sqlite3 >/dev/null 2>&1; then
    HASH_LEN="$(sqlite3 "$DB" "SELECT length(value) FROM site_settings WHERE key='admin_password_hash';" 2>/dev/null || true)"
    if [ "$HASH_LEN" = "0" ] || [ -z "$HASH_LEN" ]; then
        warn "No admin password is set yet — /admin/ is currently UNAUTHENTICATED (open)."
        info "Set one now at http://127.0.0.1:8000/admin/account (or the production admin) to secure it."
    else
        ok "Admin password is already set."
    fi
fi

echo ""
printf "${GREEN}✓${NC} Provisioning complete. Start the dev server with: ${CYAN}just dev${NC}\n"
echo "  Public: http://127.0.0.1:8000/   Admin: http://127.0.0.1:8000/admin/"