#!/bin/bash
set -euo pipefail

# Required environment variables:
#   APTLY_URL  - Aptly server URL (e.g. https://aptly.cloud2.payne.io)
#   APTLY_PASS - Aptly API password
# Optional:
#   APTLY_USER    - API username (default: aptly)
#   APTLY_GPG_KEY - GPG key fingerprint for signing; if unset, signing is skipped

APTLY_URL="${APTLY_URL:?APTLY_URL is required}"
APTLY_PASS="${APTLY_PASS:?APTLY_PASS is required}"
APTLY_USER="${APTLY_USER:-aptly}"
APTLY_GPG_KEY="${APTLY_GPG_KEY:-}"

VERSION=$(cat ../VERSION 2>/dev/null || echo "0.0.0-dev")
REPO_NAME="wild"
DIST="${DIST:-stable}"
COMPONENT="main"
PACKAGE_DIR="dist/packages"
SNAP_NAME="wild-central-${VERSION}"
AUTH="${APTLY_USER}:${APTLY_PASS}"
PACKAGE_GLOB="wild-central_${VERSION}_*.deb"

echo "Deploying Wild Central ${VERSION} to APT repository..."
echo "   URL: ${APTLY_URL}"

# Signing config — use server-side GPG key
# The key must exist in Aptly's GPG keyring (auto-generated by the init-gpg container)
# Get the fingerprint: curl -sf ${APTLY_URL}/public.key | gpg --with-colons --import-options show-only --import | grep fpr | cut -d: -f10
if [ -n "$APTLY_GPG_KEY" ]; then
    SIGNING="{\"GpgKey\":\"${APTLY_GPG_KEY}\",\"Batch\":true}"
else
    echo "APTLY_GPG_KEY not set — publishing without GPG signature"
    SIGNING="{\"Skip\":true}"
fi

api() {
    local METHOD="$1"
    local ENDPOINT="$2"
    local DATA="${3:-}"
    if [ -n "$DATA" ]; then
        curl -sf --http1.1 -u "$AUTH" -X "$METHOD" \
            -H 'Content-Type: application/json' \
            -d "$DATA" \
            "${APTLY_URL}/api${ENDPOINT}"
    else
        curl -sf --http1.1 -u "$AUTH" -X "$METHOD" "${APTLY_URL}/api${ENDPOINT}"
    fi
}

# 1. Ensure local repo exists
echo ""
echo "Ensuring repository '${REPO_NAME}' exists..."
if ! api GET "/repos/${REPO_NAME}" > /dev/null 2>&1; then
    api POST "/repos" \
        "{\"Name\":\"${REPO_NAME}\",\"DefaultDistribution\":\"${DIST}\",\"DefaultComponent\":\"${COMPONENT}\"}" \
        > /dev/null
    echo "   Created '${REPO_NAME}'"
else
    echo "   '${REPO_NAME}' already exists"
fi

# 2. Upload .deb files
echo ""
echo "Uploading packages..."
UPLOAD_DIR="${REPO_NAME}-${VERSION}"
FOUND=0
for DEB in "${PACKAGE_DIR}"/${PACKAGE_GLOB}; do
    [ -f "$DEB" ] || continue
    FOUND=1
    FILENAME=$(basename "$DEB")
    echo "   ${FILENAME}..."
    curl -sf --http1.1 -u "$AUTH" -X POST \
        -F "file=@${DEB}" \
        "${APTLY_URL}/api/files/${UPLOAD_DIR}" > /dev/null
done
if [ "$FOUND" -eq 0 ]; then
    echo "No .deb files found for version ${VERSION} in ${PACKAGE_DIR}"
    exit 1
fi
echo "   Uploaded"

# 3. Add packages to repo
echo ""
echo "Adding packages to '${REPO_NAME}'..."
api POST "/repos/${REPO_NAME}/file/${UPLOAD_DIR}" > /dev/null
echo "   Added"

# 4. Clean up uploaded files from aptly's staging area
api DELETE "/files/${UPLOAD_DIR}" > /dev/null 2>&1 || true

# 5. Create snapshot for this version
echo ""
echo "Snapshotting as '${SNAP_NAME}'..."
if api GET "/snapshots/${SNAP_NAME}" > /dev/null 2>&1; then
    echo "   Snapshot '${SNAP_NAME}' already exists, using as-is"
else
    api POST "/repos/${REPO_NAME}/snapshots" \
        "{\"Name\":\"${SNAP_NAME}\",\"Description\":\"Wild Central ${VERSION}\"}" \
        > /dev/null
    echo "   Snapshot '${SNAP_NAME}' created"
fi

# 6. Publish or update
echo ""
PUBLISH_PREFIX=$(api GET "/publish" \
    | jq -r ".[] | select(.Distribution == \"${DIST}\") | .Prefix" 2>/dev/null \
    | head -1)

UPDATE_BODY="{\"Snapshots\":[{\"Component\":\"${COMPONENT}\",\"Name\":\"${SNAP_NAME}\"}],\"Signing\":${SIGNING},\"ForceOverwrite\":true}"

if [ -z "$PUBLISH_PREFIX" ]; then
    echo "Publishing '${DIST}' for the first time..."
    api POST "/publish" \
        "{\"SourceKind\":\"snapshot\",\"Sources\":[{\"Component\":\"${COMPONENT}\",\"Name\":\"${SNAP_NAME}\"}],\"Distribution\":\"${DIST}\",\"Architectures\":[\"amd64\",\"arm64\"],\"Signing\":${SIGNING}}" \
        > /dev/null
else
    echo "Updating published '${DIST}'..."
    URL_PREFIX=$(echo "$PUBLISH_PREFIX" | sed 's/^\.$/_/')
    api PUT "/publish/${URL_PREFIX}/${DIST}" "$UPDATE_BODY" > /dev/null
fi
echo "   Published"

echo ""
echo "Wild Central ${VERSION} is live."
echo ""
echo "To install on a new device:"
echo ""
echo "   curl -fsSL ${APTLY_URL}/public.key \\"
echo "       | gpg --dearmor | sudo tee /usr/share/keyrings/wild.gpg > /dev/null"
echo ""
echo "   sudo tee /etc/apt/sources.list.d/wild.sources <<EOF"
echo "   Types: deb"
echo "   URIs: ${APTLY_URL}"
echo "   Suites: ${DIST}"
echo "   Components: ${COMPONENT}"
echo "   Signed-By: /usr/share/keyrings/wild.gpg"
echo "   EOF"
echo ""
echo "   sudo apt update && sudo apt install wild-central"