#!/usr/bin/env bash
#
# AI Space Fleet — Ubuntu Fleet Command installer (self-contained web download).
#
# Run on Ubuntu / Xubuntu (NOT as root):
#   bash aispacefleet-fleet-command-ubuntu.sh
#
set -euo pipefail

if [[ "$(id -u)" -eq 0 ]]; then
  printf '[aispacefleet] ERROR: Do not run as root or with sudo.\n' >&2
  exit 1
fi

if grep -q $'\r' "${BASH_SOURCE[0]}" 2>/dev/null; then
  _tmp="$(mktemp /tmp/aispacefleet-web-install.XXXXXX)"
  sed 's/\r$//' "${BASH_SOURCE[0]}" >"$_tmp"
  chmod +x "$_tmp"
  exec bash "$_tmp" "$@"
fi

log() { printf '[aispacefleet] %s\n' "$*"; }
log_step() { printf '\n=== %s ===\n' "$*"; }
die() { printf '[aispacefleet] ERROR: %s\n' "$*" >&2; exit 1; }

AISPACEFLEET_CANONICAL_REPO="${HOME}/aispacefleet"
AISPACEFLEET_STATE_DIR="${HOME}/.aispacefleet"
mkdir -p "${AISPACEFLEET_STATE_DIR}/logs"
chmod 700 "${AISPACEFLEET_STATE_DIR}"

# --- BEGIN WEB PAYLOAD (replaced by API) ---
AISPACEFLEET_WEB_PAYLOAD_B64="eyJkYXRhYmFzZVVybCI6InBvc3RncmVzcWw6Ly9uZW9uZGJfb3duZXI6bnBnXzVOdE9TNE1IbGNBZEBlcC1yZXN0bGVzcy1zYWxhZC1hZmtkamYyYS1wb29sZXIuYy0yLnVzLXdlc3QtMi5hd3MubmVvbi50ZWNoL25lb25kYj9jaGFubmVsX2JpbmRpbmc9cmVxdWlyZSZzc2xtb2RlPXJlcXVpcmUiLCJzaWduaW5nS2V5IjoiMmMyMjM0Nzc0MTExYzQyYTYzMmQzMmE1YmQ5MzZkN2NmMzJmYmZiNGEyZGE2ZDE3MDY5YzcxMmZhYTJjZWQyZSIsInNpZ25pbmdLZXlzIjoie1wicHJvZHVjdGlvblwiOlwiMmMyMjM0Nzc0MTExYzQyYTYzMmQzMmE1YmQ5MzZkN2NmMzJmYmZiNGEyZGE2ZDE3MDY5YzcxMmZhYTJjZWQyZVwiLFwicHJldmlld1wiOlwiMmMyMjM0Nzc0MTExYzQyYTYzMmQzMmE1YmQ5MzZkN2NmMzJmYmZiNGEyZGE2ZDE3MDY5YzcxMmZhYTJjZWQyZVwifSIsImJ1bmRsZVVybCI6Imh0dHBzOi8vYWlzcGFjZWZsZWV0LmNvbS9pbnN0YWxsL2Fpc3BhY2VmbGVldC1mbGVldC1jb21tYW5kLnRhci5neiIsImp3dElzc3VlciI6ImFpc3BhY2VmbGVldC13ZWIiLCJqd3RBdWRpZW5jZSI6ImFpc3BhY2VmbGVldC1mbGVldC1jb21tYW5kIiwicmVnaXN0ZXJVcmwiOiJodHRwczovL2Fpc3BhY2VmbGVldC5jb20vYXBpL2ZsZWV0L2luc3RhbGwvcmVnaXN0ZXIiLCJpbnN0YWxsVG9rZW4iOiIxNzg5ODEwNjg0NDk2LjZmY2YxYmRlNzkwZWNhZWIzNTBmNTdiZTRmZTA4NThhLjMxN2ZlODNjMTczMTdmZDg1NjI2NTY4NjA3MTAzZDhiNDgzZmE2YzBjN2RhNjQ1NDRhOGM0NGVjZTUwNzJkN2IiLCJwZ1Bhc3N3b3JkIjoiODNlYjZiMzgwOTE1MjA3MzFhNjJkODlkYmI2MGUyOTgiLCJ1c2VMb2NhbFBvc3RncmVzIjpmYWxzZX0="
# --- END WEB PAYLOAD ---

if [[ -z "$AISPACEFLEET_WEB_PAYLOAD_B64" || "$AISPACEFLEET_WEB_PAYLOAD_B64" == "UNCONFIGURED" ]]; then
  die "This installer has no bootstrap payload. Re-download from the Fleet Command page."
fi

command -v base64 >/dev/null 2>&1 || die "base64 is required"
command -v curl >/dev/null 2>&1 || die "curl is required"
command -v tar >/dev/null 2>&1 || die "tar is required"

PAYLOAD_JSON="$(printf '%s' "$AISPACEFLEET_WEB_PAYLOAD_B64" | base64 -d 2>/dev/null || printf '%s' "$AISPACEFLEET_WEB_PAYLOAD_B64" | base64 --decode)"
[[ -n "$PAYLOAD_JSON" ]] || die "Failed to decode installer payload"

extract_json_string() {
  local key="$1"
  if command -v python3 >/dev/null 2>&1; then
    python3 -c 'import json,sys; d=json.load(sys.stdin); v=d.get(sys.argv[1]); print(v if isinstance(v,str) else "")' "$key" <<<"$PAYLOAD_JSON"
  else
    printf '%s' "$PAYLOAD_JSON" | sed -n "s/.*\"${key}\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" | head -1
  fi
}

extract_json_bool() {
  local key="$1"
  if command -v python3 >/dev/null 2>&1; then
    python3 -c 'import json,sys; d=json.load(sys.stdin); print("true" if d.get(sys.argv[1]) is True else "false")' "$key" <<<"$PAYLOAD_JSON"
  else
    echo "false"
  fi
}

DATABASE_URL="$(extract_json_string databaseUrl)"
SIGNING_KEY="$(extract_json_string signingKey)"
SIGNING_KEYS="$(extract_json_string signingKeys)"
BUNDLE_URL="$(extract_json_string bundleUrl)"
ISSUER="$(extract_json_string jwtIssuer)"
AUDIENCE="$(extract_json_string jwtAudience)"
REGISTER_URL="$(extract_json_string registerUrl)"
INSTALL_TOKEN="$(extract_json_string installToken)"
PG_PASSWORD="$(extract_json_string pgPassword)"
USE_LOCAL_PG="$(extract_json_bool useLocalPostgres)"
ISSUER="${ISSUER:-aispacefleet-web}"
AUDIENCE="${AUDIENCE:-aispacefleet-fleet-command}"

[[ -n "$SIGNING_KEY" ]] || die "Installer payload missing signingKey"
[[ -n "$BUNDLE_URL" ]] || die "Installer payload missing bundleUrl"
if [[ -z "$SIGNING_KEYS" ]]; then
  SIGNING_KEYS="{\"production\":\"${SIGNING_KEY}\",\"preview\":\"${SIGNING_KEY}\"}"
fi

if [[ -z "$DATABASE_URL" || "$USE_LOCAL_PG" == "true" ]]; then
  PG_PASSWORD="${PG_PASSWORD:-$(openssl rand -hex 16 2>/dev/null || tr -dc a-f0-9 </dev/urandom | head -c 32)}"
  DATABASE_URL="postgresql://aispacefleet:${PG_PASSWORD}@localhost:5432/aispacefleet_dev"
  log "Using Fleet Command local Postgres (created during setup)"
fi

log_step "Write bootstrap secrets (embedded by web UI — no prompts)"
BOOTSTRAP="${AISPACEFLEET_STATE_DIR}/web-bootstrap.env"
umask 077
# Quote every value — Neon URLs contain &/? which break bash `source` if unquoted.
_esc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/\\$/g' -e 's/`/\\`/g'; }
{
  printf '# Generated by AI Space Fleet web installer — %s\n' "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
  printf 'DATABASE_URL="%s"\n' "$(_esc "$DATABASE_URL")"
  printf 'AISPACEFLEET_PG_PASSWORD="%s"\n' "$(_esc "${PG_PASSWORD:-}")"
  printf 'WEB_TO_COORDINATOR_SIGNING_KEY="%s"\n' "$(_esc "$SIGNING_KEY")"
  printf 'COORDINATOR_SIGNING_KEYS="%s"\n' "$(_esc "$SIGNING_KEYS")"
  printf 'COORDINATOR_SIGNING_KEY_ID="production"\n'
  printf 'COORDINATOR_KEY_ID="production"\n'
  printf 'COORDINATOR_JWT_ISSUER="%s"\n' "$(_esc "$ISSUER")"
  printf 'COORDINATOR_JWT_AUDIENCE="%s"\n' "$(_esc "$AUDIENCE")"
  printf 'AISPACEFLEET_INSTALL_TOKEN="%s"\n' "$(_esc "$INSTALL_TOKEN")"
  printf 'AISPACEFLEET_REGISTER_URL="%s"\n' "$(_esc "$REGISTER_URL")"
  printf 'AISPACEFLEET_SKIP_GITHUB="true"\n'
  printf 'AISPACEFLEET_BUNDLE_URL="%s"\n' "$(_esc "$BUNDLE_URL")"
} >"$BOOTSTRAP"
chmod 600 "$BOOTSTRAP"
log "Wrote ${BOOTSTRAP}"
if [[ -z "$DATABASE_URL" ]]; then
  die "Internal error: bootstrap DATABASE_URL empty after write"
fi
log "Bootstrap DATABASE_URL host: $(printf '%s' "$DATABASE_URL" | sed -E 's#.*@([^/?]+).*#\1#')"

log_step "Download Fleet Command package (no GitHub login)"
BUNDLE_TMP="$(mktemp /tmp/aispacefleet-fc-bundle.XXXXXX.tar.gz)"
curl -fsSL --retry 3 --retry-delay 2 "$BUNDLE_URL" -o "$BUNDLE_TMP" \
  || die "Failed to download Fleet Command package from ${BUNDLE_URL}"
[[ -s "$BUNDLE_TMP" ]] || die "Downloaded package is empty"

log_step "Install package → ${AISPACEFLEET_CANONICAL_REPO}"
rm -rf "${AISPACEFLEET_CANONICAL_REPO}"
mkdir -p "${AISPACEFLEET_CANONICAL_REPO}"
tar -xzf "$BUNDLE_TMP" -C "${AISPACEFLEET_CANONICAL_REPO}"
rm -f "$BUNDLE_TMP"
printf 'web-bundle\ninstalledAt=%s\n' "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  >"${AISPACEFLEET_CANONICAL_REPO}/.aispacefleet-bundle-source"
chmod -R u+rwX "${AISPACEFLEET_CANONICAL_REPO}"

[[ -f "${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/setup-fleet-command.sh" ]] \
  || die "Package missing setup-fleet-command.sh — re-download from the web UI"
[[ -d "${AISPACEFLEET_CANONICAL_REPO}/apps/coordinator" ]] \
  || die "Package missing apps/coordinator"

# Make scripts executable (tar may not preserve +x from git archive)
find "${AISPACEFLEET_CANONICAL_REPO}/scripts" -type f -name '*.sh' -exec chmod +x {} +
find "${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/bin" -type f -exec chmod +x {} + 2>/dev/null || true

if [[ -n "${PG_PASSWORD:-}" ]]; then
  export AISPACEFLEET_PG_PASSWORD="$PG_PASSWORD"
fi
export AISPACEFLEET_WEB_BOOTSTRAP_FILE="$BOOTSTRAP"
export AISPACEFLEET_SKIP_GITHUB=true
export AISPACEFLEET_REPO_ROOT="${AISPACEFLEET_CANONICAL_REPO}"

log_step "Full Fleet Command setup (systemd + tunnel + always-on)"
bash "${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/setup-fleet-command.sh" --force-env

if [[ -f "${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/apply-web-bootstrap.sh" ]]; then
  bash "${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/apply-web-bootstrap.sh" || true
fi

log_step "Wait for coordinator health"
# Progress heartbeats — first boot can take 1–3 minutes; do not assume hang.
_attempts=90
_interval=2
for _i in $(seq 1 "$_attempts"); do
  if curl -fsS --max-time 2 "http://127.0.0.1:8080/health" 2>/dev/null | grep -qE '"ok"[[:space:]]*:[[:space:]]*true'; then
    log "Coordinator healthy (~$((_i * _interval))s)"
    break
  fi
  if [[ "$_i" -eq 1 || $((_i % 5)) -eq 0 ]]; then
    _active="$(systemctl --user is-active aispacefleet-fleet-command.service 2>/dev/null || echo unknown)"
    log "  … $((_i * _interval))s / $((_attempts * _interval))s — service=${_active} — still starting"
    if [[ -f "${AISPACEFLEET_STATE_DIR}/logs/coordinator.err" ]]; then
      _line="$(tail -n 1 "${AISPACEFLEET_STATE_DIR}/logs/coordinator.err" 2>/dev/null | tr -d '\r' || true)"
      [[ -n "$_line" ]] && log "  last err: ${_line:0:180}"
    fi
  fi
  sleep "$_interval"
done

log_step "Wait for public tunnel"
TUNNEL_URL=""
_attempts=45
for _i in $(seq 1 "$_attempts"); do
  if [[ -f "${AISPACEFLEET_STATE_DIR}/tunnel.url" ]]; then
    TUNNEL_URL="$(tr -d '[:space:]' < "${AISPACEFLEET_STATE_DIR}/tunnel.url")"
    [[ -n "$TUNNEL_URL" ]] && break
  fi
  if [[ "$_i" -eq 1 || $((_i % 5)) -eq 0 ]]; then
    _active="$(systemctl --user is-active aispacefleet-tunnel.service 2>/dev/null || echo unknown)"
    log "  … $((_i * _interval))s / $((_attempts * _interval))s — tunnel=${_active}"
  fi
  sleep "$_interval"
done
[[ -n "$TUNNEL_URL" ]] && log "Tunnel ready $TUNNEL_URL"

if [[ -n "$TUNNEL_URL" ]]; then
  log "Public URL: ${TUNNEL_URL}"
  if [[ -n "$REGISTER_URL" && -n "$INSTALL_TOKEN" ]]; then
    log_step "Register with AI Space Fleet web UI"
    curl -fsS -X POST "$REGISTER_URL" \
      -H "content-type: application/json" \
      -H "x-aispacefleet-install-token: ${INSTALL_TOKEN}" \
      -d "{\"url\":\"${TUNNEL_URL}\",\"token\":\"${INSTALL_TOKEN}\"}" \
      && log "Registered — refresh the web UI; Fleet Command should show always on." \
      || log "WARN: registration POST failed — open Connect and paste the tunnel URL"
  fi
  if [[ -f "${AISPACEFLEET_CANONICAL_REPO}/scripts/fleet/publish-coordinator-url.mjs" ]]; then
    (cd "${AISPACEFLEET_CANONICAL_REPO}" && DATABASE_URL="$DATABASE_URL" node scripts/fleet/publish-coordinator-url.mjs "$TUNNEL_URL") || true
  fi
else
  log "Tunnel not ready yet. Later: bash ${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/fleet-command-ctl.sh tunnel-url"
fi

log_step "Installer complete"
echo ""
echo "  Repo:    ${AISPACEFLEET_CANONICAL_REPO}"
echo "  Health:  http://127.0.0.1:8080/health"
echo "  Control: bash ${AISPACEFLEET_CANONICAL_REPO}/scripts/ubuntu/fleet-command-ctl.sh status"
echo "  Reboot-safe systemd user services are enabled."
echo ""