#!/bin/bash
# Deploy FINALIZE CMS Kevin Victor
# Ejecutar desde VPS (después de haber corrido los pasos previos de npm ci + .env)
#
# Lee VPS_PASS de env var. Si no está, aborta.
set -euo pipefail

if [ -z "${VPS_PASS:-}" ]; then
  echo "ERROR: exporta VPS_PASS='tu_password' antes de correr este script"
  exit 1
fi

export SSHPASS="$VPS_PASS"
APP_DIR=/home/wwkevi/cms.kevinvictorrealestate.com
VPS="root@162.240.232.251"

# Helper para SSH
ssh_vps() { sshpass -e ssh -o StrictHostKeyChecking=no -p 22022 "$VPS" "$@"; }

echo "==============================================="
echo "[1] prisma migrate deploy"
echo "==============================================="
ssh_vps "cd $APP_DIR && npx prisma migrate deploy 2>&1 | grep -vE 'Update available|major|┌|│|└|Run|cli|Prisma'" | tail -10

echo ""
echo "==============================================="
echo "[2] Crear .env.production (sin password)"
echo "==============================================="
ssh_vps "cd $APP_DIR && bash -s" <<'REMOTE'
set -e
AUTH_SECRET=$(openssl rand -base64 32)
cat > .env.production <<ENVEOF
DATABASE_URL="file:./cms.db"
NEXTAUTH_URL="https://cms.kevinvictorrealestate.com"
AUTH_URL="https://cms.kevinvictorrealestate.com"
AUTH_SECRET="$AUTH_SECRET"
RESEND_API_KEY="re_PLACEHOLDER_REPLACE_BEFORE_DEPLOY"
NEXT_PUBLIC_UPLOADS_BASE="https://cms.kevinvictorrealestate.com/uploads"
UPLOADS_DIR="/home/wwkevi/cms.kevinvictorrealestate.com/public/uploads"
ADMIN_EMAIL="kevin@kevinvictorrealestate.com"
EMAIL_FROM="noreply@kevinvictorrealestate.com"
EMAIL_FROM_NAME="Kevin Victor Real Estate"
PORT=3002
NODE_ENV=production
ENVEOF
chmod 600 .env.production
chown wwkevi:wwkevi .env.production
echo ".env.production listo"
echo "⚠️  RECORDÁ reemplazar RESEND_API_KEY antes de continuar (re_G8fHdgrr_4eB3TRTCXSoZeBQRcQEvJqFT)"
REMOTE

echo ""
echo "==============================================="
echo "[3] Seed (admin Kevin con password random)"
echo "==============================================="
ssh_vps "cd $APP_DIR && npx tsx prisma/seed.ts 2>&1" | tee /tmp/seed-output.log
PASSWORD=$(grep -A 1 "Password" /tmp/seed-output.log | tail -1 | tr -d ' ')
echo ""
echo "*** PASSWORD DEL ADMIN: $PASSWORD ***"
echo "*** COPIÁ ESTE PASSWORD — no se guarda en claro en ningún lado ***"
rm -f /tmp/seed-output.log

echo ""
echo "==============================================="
echo "[4] PM2 start kv-cms (puerto 3002)"
echo "==============================================="
ssh_vps "cd $APP_DIR && PORT=3002 pm2 start npm --name kv-cms -- start 2>&1 | tail -5 && pm2 save 2>&1 | tail -3 && pm2 list 2>&1 | head -10"

echo ""
echo "==============================================="
echo "[5] Verificar Node en :3002"
echo "==============================================="
sleep 5
ssh_vps "ss -tlnp 2>&1 | grep ':3002' | head -3 && curl -sk -o /dev/null -w 'Login Node :3002: %{http_code}\n' http://127.0.0.1:3002/login 2>&1"

echo ""
echo "==============================================="
echo "[6] Reemplazar vhost Apache"
echo "==============================================="
ssh_vps bash <<'REMOTE'
set -e
TS=$(date +%Y%m%d-%H%M%S)
# Backup
cp /etc/apache2/conf/httpd.conf /etc/apache2/conf/httpd.conf.bak-cms-$TS
echo "Backup: /etc/apache2/conf/httpd.conf.bak-cms-$TS"

# Crear nuevo archivo de vhost para cms (incluido via conf.d)
cat > /etc/apache2/conf.d/cms-cms-vhost.conf <<'VHOST'
<VirtualHost *:443>
    ServerName cms.kevinvictorrealestate.com
    ServerAlias www.cms.kevinvictorrealestate.com

    # Proxy TODO a Node.js en :3002 (Next.js prod)
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:3002/ retry=0 timeout=60
    ProxyPassReverse / http://127.0.0.1:3002/

    # Solo servir /uploads desde disco (Apache bypass a Node)
    Alias /uploads /home/wwkevi/cms.kevinvictorrealestate.com/public/uploads
    <Directory /home/wwkevi/cms.kevinvictorrealestate.com/public/uploads>
        Options -Indexes +FollowSymLinks
        Require all granted
        Header set Cache-Control "public, max-age=31536000, immutable"
    </Directory>

    # Document root ficticio (no se usa, todo va a ProxyPass arriba)
    DocumentRoot /home/wwkevi/cms.kevinvictorrealestate.com

    SSLEngine on
    SSLCertificateFile /var/cpanel/certs/cpanel/cms.kevinvictorrealestate.com/cert.pem
    SSLCertificateKeyFile /var/cpanel/certs/cpanel/cms.kevinvictorrealestate.com/key.pem
    SSLCertificateChainFile /var/cpanel/certs/cpanel/cms.kevinvictorrealestate.com/fullchain.pem

    ErrorLog /var/log/apache2/cms.kevinvictorrealestate.com-error.log
    CustomLog /var/log/apache2/cms.kevinvictorrealestate.com-access.log combined
</VirtualHost>
VHOST
echo "vhost creado"
REMOTE

echo ""
echo "==============================================="
echo "[7] apachectl configtest + reload"
echo "==============================================="
ssh_vps "apachectl configtest 2>&1 && systemctl reload httpd 2>&1 && echo 'Apache reloaded OK'"

echo ""
echo "==============================================="
echo "[8] Smoke test"
echo "==============================================="
sleep 3
ssh_vps "curl -sk -o /dev/null -w 'Login: %{http_code}\n' https://cms.kevinvictorrealestate.com/login && curl -sk -o /dev/null -w 'Admin: %{http_code}\n' https://cms.kevinvictorrealestate.com/admin && curl -sk -o /dev/null -w 'Agent: %{http_code}\n' https://cms.kevinvictorrealestate.com/agent && curl -sk -o /dev/null -w 'API listings: %{http_code}\n' https://cms.kevinvictorrealestate.com/api/listings"

echo ""
echo "==============================================="
echo "[9] Cleanup .htaccess (ya no necesario)"
echo "==============================================="
ssh_vps "rm -f $APP_DIR/.htaccess && echo '.htaccess removido'"

echo ""
echo "✅ Deploy completo!"
echo "URL: https://cms.kevinvictorrealestate.com/login"
echo "Email: kevin@kevinvictorrealestate.com"
echo "Password: $PASSWORD (el que se imprimió arriba)"