#!/usr/bin/env bash
# Bring up / refresh the pms1 STAGING instance with the latest master, for smoke
# testing before tagging a release. Runs the app as pm2 process `ppms-staging` on
# port 3200, against the prod-mirror test DB (pelagia_test), in safe dev mode
# (no real emails/uploads). Separate from ~/pms (prod) and ~/pelagia-autofix.
#
# Usage on pms1:  ~/issue-watcher/staging-up.sh
# Re-run any time to pull latest master and restart staging.

set -euo pipefail
export NVM_DIR="$HOME/.nvm"; . "$NVM_DIR/nvm.sh"

DIR="$HOME/pelagia-staging"
PORT=3200
NAME="ppms-staging"
REPO_URL="http://127.0.0.1:3001/shad0w/pelagia-portal.git"

if [ ! -d "$DIR/.git" ]; then
    echo "Cloning into $DIR ..."
    git clone -q "$REPO_URL" "$DIR"
fi

cd "$DIR"
git fetch origin -q
git checkout -f master -q 2>/dev/null || git checkout -fB master origin/master -q
git reset --hard origin/master
echo "Staging checkout: $(git log --oneline -1)"

# One-time env: test DB, dev mode, port 3200.
if [ ! -f "$DIR/App/.env" ]; then
    PROD_URL=$(grep -E '^DATABASE_URL' "$HOME/pms/App/.env" | sed -E 's/^DATABASE_URL=//; s/^"//; s/"$//')
    TEST_URL=$(printf '%s' "$PROD_URL" | sed -E "s#(@[^/]+/)pelagia([?]|\$)#\1pelagia_test\2#")
    INV=$(grep -E '^NEXT_PUBLIC_INVENTORY_ENABLED' "$HOME/pms/App/.env" || echo 'NEXT_PUBLIC_INVENTORY_ENABLED=true')
    SECRET=$(openssl rand -base64 32)
    cat > "$DIR/App/.env" <<EOF
# pms1 STAGING -- latest master against the prod-mirror test DB, safe dev mode.
$INV
NEXTAUTH_SECRET="$SECRET"
NEXTAUTH_URL="http://localhost:$PORT"
AZURE_AD_CLIENT_ID="dev-placeholder"
AZURE_AD_CLIENT_SECRET="dev-placeholder"
AZURE_AD_TENANT_ID="dev-placeholder"
DATABASE_URL="$TEST_URL"
GST_SERVICE_URL="http://localhost:3003"
NEXT_PUBLIC_ENV_LABEL="INTERNAL DEV / STAGING - NOT PRODUCTION"
PORT=$PORT
EOF
    chmod 600 "$DIR/App/.env"
fi

# pm2-run wrapper so the dev server always gets nvm on PATH and the right port.
# Bind to 127.0.0.1 only -- staging is reachable solely via SSH tunnel
# (ssh -L 3200:localhost:3200 ...), never directly from the public internet.
cat > "$DIR/App/run-staging.sh" <<EOF
#!/usr/bin/env bash
export NVM_DIR="\$HOME/.nvm"; . "\$NVM_DIR/nvm.sh"
cd "$DIR/App"
exec pnpm dev -p $PORT -H 127.0.0.1
EOF
chmod +x "$DIR/App/run-staging.sh"

cd "$DIR/App"
echo "Installing deps..."; pnpm install --frozen-lockfile
echo "Generating Prisma client..."; pnpm db:generate
# Bring the test DB schema up to the code under test. The test DB mirrors prod,
# which may be behind master, so master's unreleased migrations (e.g. poDate)
# must be applied or the new code 500s on the missing columns.
echo "Applying pending migrations to the test DB..."; pnpm db:migrate:deploy

# Drop any FORGEJO_* the caller may carry (e.g. when invoked from the Forgejo
# Actions runner, whose ephemeral FORGEJO_TOKEN would otherwise be injected into
# the staging process). NOT --update-env on restart, for the same reason.
for v in $(env | grep -oE '^FORGEJO_[A-Z_]+' || true); do unset "$v"; done
if pm2 describe "$NAME" >/dev/null 2>&1; then
    pm2 restart "$NAME"
else
    pm2 start "$DIR/App/run-staging.sh" --name "$NAME" --interpreter bash
fi
pm2 save
echo "Staging '$NAME' is up on port $PORT ($(git -C "$DIR" log --oneline -1))"
