#!/usr/bin/env bash
# publish.sh — put a built release on sl0ppi.sl0p.foo.
#
#   packaging/publish.sh [--host root@sl0p.foo] [--dry-run]
#
# Publishing is deliberately dumb: rsync a rendered site plus the artifact, then
# ask the live site whether it agrees. There is no CI and no build on the box —
# the tarball must already exist (`make package`).
#
# The vhost lives in the sl0pday repo (nginx/sl0p.conf, deployed with its own
# ./deploy.sh). This script only ships content into /opt/sl0ppi/www.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
HOST="${SL0PPI_PUBLISH_HOST:-root@sl0p.foo}"
REMOTE_DIR="/opt/sl0ppi/www"
BASE_URL="https://sl0ppi.sl0p.foo"
dry_run=0

while [ $# -gt 0 ]; do
    case "$1" in
        --host) HOST="$2"; shift 2 ;;
        --host=*) HOST="${1#*=}"; shift ;;
        -n|--dry-run) dry_run=1; shift ;;
        -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
        *) echo "publish.sh: unknown argument '$1'" >&2; exit 2 ;;
    esac
done

log()  { printf '\033[36m==>\033[0m %s\n' "$*"; }
die()  { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }
run()  { if [ "$dry_run" = 1 ]; then echo "  would: $*"; else "$@"; fi; }

VERSION="$(cat "$ROOT/VERSION")"
STEM="sl0ppi-$VERSION-x86_64-linux"
ARTIFACT="$STEM.tar.gz"
OUT="$ROOT/packaging/out"

[ -f "$OUT/$ARTIFACT" ] || die "no $OUT/$ARTIFACT — run 'make package' first"
[ -f "$OUT/$ARTIFACT.sha256" ] || die "no checksum beside the artifact"

# Trust nothing: recompute rather than believing the sidecar we are about to
# publish as authoritative.
SHA="$(sha256sum "$OUT/$ARTIFACT" | cut -d' ' -f1)"
SIDECAR="$(cut -d' ' -f1 < "$OUT/$ARTIFACT.sha256")"
[ "$SHA" = "$SIDECAR" ] || die "artifact does not match its .sha256 sidecar"

# Refuse to overwrite a published version with different bytes: released URLs are
# immutable (nginx caches /releases/ for a year), so republishing a changed file
# under the same name would serve two different things to different people.
remote_sha="$(ssh -o BatchMode=yes "$HOST" \
    "sha256sum $REMOTE_DIR/releases/$ARTIFACT 2>/dev/null | cut -d' ' -f1" || true)"
if [ -n "$remote_sha" ] && [ "$remote_sha" != "$SHA" ]; then
    die "$ARTIFACT is already published with a DIFFERENT checksum
  published $remote_sha
  local     $SHA
Bump VERSION instead of rewriting a release."
fi

# --- render the site -------------------------------------------------------
STAGE="$(mktemp -d "${TMPDIR:-/tmp}/sl0ppi-publish.XXXXXX")"
trap 'rm -rf "$STAGE"' EXIT
mkdir -p "$STAGE/releases"

DATE="$(date -u +%Y-%m-%d)"
MANIFEST="$ROOT/packaging/stage/$STEM/MANIFEST"
components=""
if [ -f "$MANIFEST" ]; then
    while read -r name version; do
        [ -n "$name" ] || continue
        components+="  <tr><td>$name</td><td>$version</td><td class=\"dim\"></td></tr>"$'\n'
    done < "$MANIFEST"
else
    components="  <tr><td colspan=\"3\" class=\"dim\">see MANIFEST inside the tarball</td></tr>"
fi

python3 - "$ROOT/site/index.html.in" "$STAGE/index.html" <<PYEOF
import sys
src, dst = sys.argv[1], sys.argv[2]
html = open(src, encoding="utf-8").read()
for key, value in {
    "@VERSION@": """$VERSION""",
    "@DATE@": """$DATE""",
    "@ARTIFACT@": """$ARTIFACT""",
    "@STEM@": """$STEM""",
    "@SHA256@": """$SHA""",
    "@COMPONENTS@": """$components""",
}.items():
    html = html.replace(key, value)
leftover = [line for line in html.splitlines() if "@" in line and "@media" not in line
            and any(t in line for t in ("@VERSION@", "@DATE@", "@ARTIFACT@", "@STEM@", "@SHA256@", "@COMPONENTS@"))]
if leftover:
    raise SystemExit("unsubstituted placeholders: %r" % leftover[:3])
open(dst, "w", encoding="utf-8").write(html)
PYEOF

install -m644 "$OUT/$ARTIFACT" "$STAGE/releases/$ARTIFACT"
install -m644 "$OUT/$ARTIFACT.sha256" "$STAGE/releases/$ARTIFACT.sha256"
install -m755 "$ROOT/site/install.sh" "$STAGE/install.sh"

cat > "$STAGE/latest.json" <<EOF
{
  "version": "$VERSION",
  "artifact": "$ARTIFACT",
  "sha256": "$SHA",
  "url": "$BASE_URL/releases/$ARTIFACT",
  "published": "$DATE"
}
EOF

log "publishing sl0ppi $VERSION to $HOST:$REMOTE_DIR"

# Artifacts first, pointers second: latest.json must never name a file that is
# not downloadable yet. Same reasoning as the SPA's two-pass deploy.
run rsync -a --chmod=D755,F644 "$STAGE/releases/" "$HOST:$REMOTE_DIR/releases/"
run rsync -a --chmod=F644 "$STAGE/index.html" "$HOST:$REMOTE_DIR/index.html"
run rsync -a --chmod=F755 "$STAGE/install.sh" "$HOST:$REMOTE_DIR/install.sh"
run rsync -a --chmod=F644 "$STAGE/latest.json" "$HOST:$REMOTE_DIR/latest.json"

[ "$dry_run" = 1 ] && { log "dry run: nothing was uploaded"; exit 0; }

# --- verify against the live site ------------------------------------------
log "verifying $BASE_URL"
fail=0
check() {
    local url="$1" want="$2"
    local code
    code="$(curl -sS -o /dev/null -w '%{http_code}' "$url")"
    if [ "$code" = "$want" ]; then
        printf '   ok   %-58s %s\n' "$url" "$code"
    else
        printf '   FAIL %-58s %s (want %s)\n' "$url" "$code" "$want"; fail=1
    fi
}
check "$BASE_URL/" 200
check "$BASE_URL/install.sh" 200
check "$BASE_URL/latest.json" 200
check "$BASE_URL/releases/$ARTIFACT" 200
check "$BASE_URL/releases/$ARTIFACT.sha256" 200

published_sha="$(curl -fsSL "$BASE_URL/releases/$ARTIFACT" | sha256sum | cut -d' ' -f1)"
if [ "$published_sha" = "$SHA" ]; then
    printf '   ok   %-58s %s\n' "downloaded artifact checksum" "matches"
else
    printf '   FAIL %-58s %s\n' "downloaded artifact checksum" "MISMATCH"; fail=1
fi

[ "$fail" = 0 ] || die "the live site does not agree with what we published"
log "published: $BASE_URL"