#!/usr/bin/env sh
set -eu

if [ "$#" -ne 5 ]; then
  echo "用法: $0 <环境> <镜像仓库> <镜像标签> <服务> <环境文件>" >&2
  exit 2
fi

DEPLOY_ENV="$1"
IMAGE_REPOSITORY="$2"
IMAGE_TAG="$3"
SERVICE="$4"
ENV_FILE="$5"
COMPOSE_FILE="deploy/docker-compose.yml"
IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG"
REGISTRY_HOST="${IMAGE_REPOSITORY%%/*}"
PROJECT_NAME="firstleg-$DEPLOY_ENV"

case "$DEPLOY_ENV" in
  development|test) ;;
  *)
    echo "直接镜像传输仅支持 development/test，当前: $DEPLOY_ENV" >&2
    exit 2
    ;;
esac

case "$SERVICE" in
  *[!A-Za-z0-9_-]*|'')
    echo "非法服务名: $SERVICE" >&2
    exit 2
    ;;
esac

if [ ! -f "$ENV_FILE" ]; then
  echo "必需文件不存在: $ENV_FILE" >&2
  exit 2
fi

env_file_has_key() {
  grep -q "^$1=" "$ENV_FILE"
}

env_file_value() {
  sed -n "s/^$1=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r'
}

case "$SERVICE" in
  gateway-overseas|lastleg-service|warehouse-overseas-service)
    COMPOSE_FILE="deploy/docker-compose.overseas.yml"
    PROJECT_NAME="firstleg-$DEPLOY_ENV-overseas"
    ;;
  event-bridge-service)
    BRIDGE_REGION="${EVENT_BRIDGE_REGION_OVERRIDE:-}"
    if [ -z "$BRIDGE_REGION" ] && env_file_has_key REGION_CODE; then
      BRIDGE_REGION="$(env_file_value REGION_CODE)"
    fi
    if [ -z "$BRIDGE_REGION" ]; then
      echo "部署 event-bridge-service 时，环境文件必须显式包含 REGION_CODE=CN 或 REGION_CODE=OVERSEAS" >&2
      exit 2
    fi
    case "$BRIDGE_REGION" in
      CN) ;;
      OVERSEAS)
        COMPOSE_FILE="deploy/docker-compose.overseas.yml"
        PROJECT_NAME="firstleg-$DEPLOY_ENV-overseas"
        ;;
      *)
        echo "部署 event-bridge-service 时，REGION_CODE 只能为 CN 或 OVERSEAS" >&2
        exit 2
        ;;
    esac
    ;;
esac

for file in "$ENV_FILE" "$COMPOSE_FILE"; do
  if [ ! -f "$file" ]; then
    echo "必需文件不存在: $file" >&2
    exit 2
  fi
done

if [ "$SERVICE" = "finance" ]; then
  for key in FINANCE_DB_URL FINANCE_DB_USERNAME FINANCE_DB_PASSWORD; do
    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
      echo "部署 finance 服务时，环境文件必须包含非空 $key" >&2
      exit 2
    fi
  done
fi

case "$SERVICE" in
  gateway-overseas|lastleg-service|warehouse-overseas-service)
    for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
      if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
        echo "部署海外服务时，环境文件必须包含非空 $key" >&2
        exit 2
      fi
    done
    ;;
esac

if [ "$SERVICE" = "firstleg" ]; then
  if ! env_file_has_key LASTLEG_EVENT_BRIDGE_URL || [ -z "$(env_file_value LASTLEG_EVENT_BRIDGE_URL)" ]; then
    echo "部署 firstleg 时，环境文件必须包含非空 LASTLEG_EVENT_BRIDGE_URL" >&2
    exit 2
  fi
fi

if [ "$SERVICE" = "lastleg-service" ]; then
  for key in LASTLEG_DB_URL LASTLEG_DB_USERNAME LASTLEG_DB_PASSWORD FIRSTLEG_EVENT_BRIDGE_URL DOMESTIC_WAREHOUSE_URL; do
    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
      echo "部署 lastleg-service 时，环境文件必须包含非空 $key" >&2
      exit 2
    fi
  done
fi

if [ "$SERVICE" = "warehouse-overseas-service" ]; then
  for key in WAREHOUSE_OVERSEAS_DB_URL WAREHOUSE_OVERSEAS_DB_USERNAME WAREHOUSE_OVERSEAS_DB_PASSWORD; do
    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
      echo "部署 warehouse-overseas-service 时，环境文件必须包含非空 $key" >&2
      exit 2
    fi
  done
fi

if [ "$SERVICE" = "event-bridge-service" ]; then
  if [ "$PROJECT_NAME" = "firstleg-$DEPLOY_ENV-overseas" ]; then
    EVENT_BRIDGE_KEYS="EVENT_BRIDGE_OVERSEAS_DB_URL EVENT_BRIDGE_OVERSEAS_DB_USERNAME EVENT_BRIDGE_OVERSEAS_DB_PASSWORD EVENT_CONSUMER_URL"
  else
    EVENT_BRIDGE_KEYS="EVENT_BRIDGE_DB_URL EVENT_BRIDGE_DB_USERNAME EVENT_BRIDGE_DB_PASSWORD FIRSTLEG_CONTAINER_EVENT_CONSUMER_URL"
  fi
  for key in $EVENT_BRIDGE_KEYS; do
    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
      echo "部署 event-bridge-service 时，环境文件必须包含非空 $key" >&2
      exit 2
    fi
  done
fi

if [ "$SERVICE" = "file" ]; then
  if ! env_file_has_key ROCKETMQ_NAME_SERVER || [ -z "$(env_file_value ROCKETMQ_NAME_SERVER)" ]; then
    echo "部署 file 服务时，环境文件必须包含非空 ROCKETMQ_NAME_SERVER" >&2
    exit 2
  fi
  if ! env_file_has_key MQ_TOPIC_PREFIX; then
    echo "部署 file 服务时，环境文件必须显式包含 MQ_TOPIC_PREFIX" >&2
    exit 2
  fi
  MQ_PREFIX=$(env_file_value MQ_TOPIC_PREFIX)
  if [ "$DEPLOY_ENV" = "test" ] && [ "$MQ_PREFIX" != "test-" ]; then
    echo "测试环境部署 file 服务时 MQ_TOPIC_PREFIX 必须为 test-" >&2
    exit 2
  fi
  if [ "$DEPLOY_ENV" = "development" ] && { [ -z "$MQ_PREFIX" ] || [ "$MQ_PREFIX" = "test-" ]; }; then
    echo "开发环境部署 file 服务时 MQ_TOPIC_PREFIX 必须非空且不能使用 test-" >&2
    exit 2
  fi
fi

: "${REGISTRY_USER:?REGISTRY_USER 未设置}"
: "${REGISTRY_PASSWORD:?REGISTRY_PASSWORD 未设置}"

local_registry_logout() {
  docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
}

deploy_local() {
  printf '%s' "$REGISTRY_PASSWORD" | docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
  trap local_registry_logout EXIT HUP INT TERM
  docker pull "$IMAGE"
  export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
  docker compose \
    --project-name "$PROJECT_NAME" \
    --env-file "$ENV_FILE" \
    -f "$COMPOSE_FILE" \
    up -d --remove-orphans --pull never "$SERVICE"
  docker compose \
    --project-name "$PROJECT_NAME" \
    --env-file "$ENV_FILE" \
    -f "$COMPOSE_FILE" \
    ps "$SERVICE"
  local_registry_logout
  trap - EXIT HUP INT TERM
}

if [ "${TARGET_IS_LOCAL:-false}" = "true" ]; then
  echo "镜像已在目标服务器本机，直接部署: $IMAGE"
  deploy_local
  exit 0
fi

SSH_TARGET="${TARGET_SSH_TARGET:?TARGET_SSH_TARGET 未设置}"
SSH_KEY="${TARGET_SSH_KEY:?TARGET_SSH_KEY 未设置}"
SSH_KNOWN_HOSTS="${TARGET_SSH_KNOWN_HOSTS:?TARGET_SSH_KNOWN_HOSTS 未设置}"
REMOTE_DIR="${TARGET_DEPLOY_DIR:?TARGET_DEPLOY_DIR 未设置}"

for file in "$SSH_KEY" "$SSH_KNOWN_HOSTS"; do
  if [ ! -f "$file" ]; then
    echo "SSH 文件不存在: $file" >&2
    exit 2
  fi
done

run_ssh() {
  ssh -i "$SSH_KEY" \
    -o BatchMode=yes \
    -o Compression=no \
    -o StrictHostKeyChecking=yes \
    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \
    -o ConnectTimeout=10 \
    "$SSH_TARGET" "$@"
}

run_scp() {
  scp -i "$SSH_KEY" \
    -o BatchMode=yes \
    -o Compression=no \
    -o StrictHostKeyChecking=yes \
    -o UserKnownHostsFile="$SSH_KNOWN_HOSTS" \
    -o ConnectTimeout=10 \
    "$@"
}

run_ssh install -d -m 750 "$REMOTE_DIR"

SUFFIX="${IMAGE_TAG}.$$.${SERVICE}"
REMOTE_ENV_NAME=".env.$PROJECT_NAME"
REMOTE_COMPOSE_NAME="docker-compose.$PROJECT_NAME.yml"
REMOTE_ENV_TMP="$REMOTE_DIR/$REMOTE_ENV_NAME.$SUFFIX.tmp"
REMOTE_COMPOSE_TMP="$REMOTE_DIR/$REMOTE_COMPOSE_NAME.$SUFFIX.tmp"
run_scp "$ENV_FILE" "$SSH_TARGET:$REMOTE_ENV_TMP"
run_scp "$COMPOSE_FILE" "$SSH_TARGET:$REMOTE_COMPOSE_TMP"
run_ssh sh -s -- "$REMOTE_ENV_TMP" "$REMOTE_COMPOSE_TMP" "$REMOTE_DIR/$REMOTE_ENV_NAME" "$REMOTE_DIR/$REMOTE_COMPOSE_NAME" <<'REMOTE_PREPARE'
set -eu
env_tmp="$1"
compose_tmp="$2"
env_target="$3"
compose_target="$4"
chmod 600 "$env_tmp"
chmod 644 "$compose_tmp"
mv -f "$env_tmp" "$env_target"
mv -f "$compose_tmp" "$compose_target"
REMOTE_PREPARE

remote_registry_logout() {
  run_ssh docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true
}

echo "目标服务器从共享仓库拉取增量镜像: $IMAGE"
printf '%s' "$REGISTRY_PASSWORD" | run_ssh docker login -u "$REGISTRY_USER" --password-stdin "$REGISTRY_HOST"
trap remote_registry_logout EXIT HUP INT TERM
run_ssh docker pull "$IMAGE"

run_ssh sh -s -- "$REMOTE_DIR" "$DEPLOY_ENV" "$IMAGE_REPOSITORY" "$IMAGE_TAG" "$SERVICE" "$PROJECT_NAME" "$REMOTE_ENV_NAME" "$REMOTE_COMPOSE_NAME" <<'REMOTE_DEPLOY'
set -eu
remote_dir="$1"
deploy_env="$2"
image_repository="$3"
image_tag="$4"
service="$5"
project_name="$6"
env_file="$7"
compose_file="$8"
cd "$remote_dir"
export DEPLOY_ENV="$deploy_env"
export IMAGE_REPOSITORY="$image_repository"
export IMAGE_TAG="$image_tag"
docker compose \
  --project-name "$project_name" \
  --env-file "$env_file" \
  -f "$compose_file" \
  up -d --remove-orphans --pull never "$service"
docker compose \
  --project-name "$project_name" \
  --env-file "$env_file" \
  -f "$compose_file" \
  ps "$service"
REMOTE_DEPLOY

remote_registry_logout
trap - EXIT HUP INT TERM