#!/usr/bin/env bash
set -euo pipefail

cd "$(dirname "$0")/.."

compose_file="${1:-docker-compose.yml}"
env_file="${2:-.env}"
app_port="${APP_PORT:-1226}"

if ! command -v docker >/dev/null 2>&1; then
  echo "docker niet gevonden. Installeer Docker en probeer opnieuw."
  exit 1
fi

if ! command -v python >/dev/null 2>&1; then
  echo "python niet gevonden. docker-deploy vereist python voor secrets."
  exit 1
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "curl niet gevonden; healthcheck wordt overgeslagen."
  export SKIP_HEALTHCHECK=1
fi

if [[ ! -f "$env_file" ]]; then
  : > "$env_file"
  chmod 600 "$env_file"
  echo "Aangemaakte $env_file"
fi

generate_secret() {
  if command -v python >/dev/null 2>&1; then
    python scripts/generate_secret.py
  else
    date +%s | sha256sum | cut -d' ' -f1
  fi
}

ensure_env() {
  local key="$1"
  local value="$2"
  local existing_line
  local existing_value

  existing_line="$(grep -m1 "^${key}=" "$env_file" || true)"
  if [[ -z "$existing_line" ]]; then
    printf '%s=%s\n' "$key" "$value" >> "$env_file"
    return
  fi

  existing_value="${existing_line#*=}"
  if [[ -n "$existing_value" && \
    "$existing_value" != CHANGE_ME* && \
    "$existing_value" != dev-only-change-me && \
    "$existing_value" != codex-local-only ]]; then
    return 0
  fi

  local temp_env
  temp_env="$(mktemp)"
  while IFS= read -r env_line; do
    if [[ "$env_line" == "${key}="* ]]; then
      printf '%s=%s\n' "$key" "$value" >> "$temp_env"
    else
      printf '%s\n' "$env_line" >> "$temp_env"
    fi
  done < "$env_file"
  mv "$temp_env" "$env_file"
}

app_host="${APP_HOST:-${HOSTNAME:-localhost}}"
app_scheme="${APP_SCHEME:-http}"
app_hostnames="${APP_HOSTS:-$app_host}"
app_origin="${APP_ORIGINS:-}"

if [[ -z "$app_origin" ]]; then
  if [[ "$app_scheme" == "https" ]]; then
    if [[ "$app_port" == "443" ]]; then
      app_origin="https://$app_host"
    else
      app_origin="https://$app_host:$app_port"
    fi
  else
    app_origin="http://$app_host:$app_port"
  fi
fi

secret_key="$(generate_secret)"
postgres_password="${POSTGRES_PASSWORD:-$(generate_secret)}"
admin_password="${VACATURERADAR_ADMIN_PASSWORD:-$(generate_secret | cut -c 1-24)}"
db_url="postgresql://vacatureradar:${postgres_password}@postgres:5432/vacatureradar"

debug="${DJANGO_DEBUG:-1}"
if [[ "$debug" == "0" ]]; then
  session_secure="${SESSION_COOKIE_SECURE:-1}"
  csrf_secure="${CSRF_COOKIE_SECURE:-1}"
  ssl_redirect="${SECURE_SSL_REDIRECT:-1}"
  hsts_seconds="${SECURE_HSTS_SECONDS:-31536000}"
else
  session_secure="${SESSION_COOKIE_SECURE:-0}"
  csrf_secure="${CSRF_COOKIE_SECURE:-0}"
  ssl_redirect="${SECURE_SSL_REDIRECT:-0}"
  hsts_seconds="${SECURE_HSTS_SECONDS:-0}"
fi

ensure_env "DJANGO_SECRET_KEY" "$secret_key"
ensure_env "DJANGO_DEBUG" "$debug"
ensure_env "DJANGO_ALLOWED_HOSTS" "$app_hostnames"
ensure_env "DJANGO_CSRF_TRUSTED_ORIGINS" "$app_origin"
ensure_env "DJANGO_TIME_ZONE" "Europe/Brussels"
ensure_env "POSTGRES_DB" "vacatureradar"
ensure_env "POSTGRES_USER" "vacatureradar"
ensure_env "POSTGRES_PASSWORD" "$postgres_password"
ensure_env "POSTGRES_HOST" "postgres"
ensure_env "POSTGRES_PORT" "5432"
ensure_env "DATABASE_URL" "$db_url"
ensure_env "REDIS_URL" "redis://redis:6379/0"
ensure_env "CELERY_TASK_ALWAYS_EAGER" "0"
ensure_env "VACATURERADAR_ADMIN_USERNAME" "admin"
ensure_env "VACATURERADAR_ADMIN_PASSWORD" "$admin_password"
ensure_env "VACATURERADAR_AUTO_BOOTSTRAP" "1"
ensure_env "SESSION_COOKIE_SECURE" "$session_secure"
ensure_env "CSRF_COOKIE_SECURE" "$csrf_secure"
ensure_env "SECURE_SSL_REDIRECT" "$ssl_redirect"
ensure_env "SECURE_HSTS_SECONDS" "$hsts_seconds"
ensure_env "EMAIL_BACKEND" "django.core.mail.backends.console.EmailBackend"
ensure_env "DEFAULT_FROM_EMAIL" "VacatureRadar <vacatureradar@localhost>"
ensure_env "SOURCE_POLICY_MODE" "strict"
ensure_env "AUTH_LOGIN_RATE_LIMIT_MAX_ATTEMPTS" "8"
ensure_env "AUTH_LOGIN_RATE_LIMIT_WINDOW_SECONDS" "300"
ensure_env "AUTH_LOGIN_RATE_LIMIT_BLOCK_SECONDS" "300"
ensure_env "MANUAL_IMPORT_RATE_LIMIT_MAX_ATTEMPTS" "12"
ensure_env "MANUAL_IMPORT_RATE_LIMIT_WINDOW_SECONDS" "120"
ensure_env "MANUAL_IMPORT_RATE_LIMIT_BLOCK_SECONDS" "300"

docker compose -f "$compose_file" up -d --build

if [[ "${SKIP_HEALTHCHECK:-0}" != "1" ]]; then
  for i in {1..30}; do
    if curl -fsS "http://127.0.0.1:${app_port}/health/ready/" >/dev/null; then
      echo "Healthcheck geslaagd op poort ${app_port}."
      break
    fi
    if [[ "$i" == "30" ]]; then
      echo "Healthcheck niet geslaagd binnen 60 seconden."
      exit 1
    fi
    sleep 2
  done
fi

docker compose -f "$compose_file" exec -T web python manage.py collectstatic --noinput

cat <<"EOF"
Deploy klaargezet.

Applicatie:
- open http://127.0.0.1:1226/
- admin: admin / waarde uit $env_file

Volgende stappen:
- Zet APP_HOST en APP_SCHEME=HTTPS voor publieke domeinstandaard.
- Zet APP_ORIGINS en DJANGO_DEBUG=0 voor echte productie.
EOF