#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
MODE="check"

EDGE_HOST="${EDGE_HOST:-192.168.0.188}"
EDGE_USER="${EDGE_USER:-ollama}"
EDGE_TARGET="${EDGE_USER}@${EDGE_HOST}"
REMOTE_HELPER="/usr/local/sbin/awoooi-edge-maintenance"
REMOTE_STAGE_ROOT="${REMOTE_STAGE_ROOT:-/home/ollama/.cache/awoooi-edge-bootstrap}"
BOOTSTRAP_IMAGE="${BOOTSTRAP_IMAGE:-alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc}"

LOCAL_HELPER="${ROOT_DIR}/ops/reboot-recovery/awoooi-edge-maintenance-helper.sh"
LOCAL_SUDOERS="${ROOT_DIR}/ops/reboot-recovery/awoooi-edge-maintenance.sudoers"
LOCAL_CONF="${ROOT_DIR}/ops/nginx/awoooi.wooo.work.conf"
LOCAL_MAINT="${ROOT_DIR}/ops/maintenance/maintenance.html"

SSH_OPTS=(
  -o BatchMode=yes
  -o ConnectTimeout="${SSH_CONNECT_TIMEOUT_SECONDS:-8}"
  -o StrictHostKeyChecking=accept-new
)

usage() {
  cat <<'USAGE'
Usage:
  bootstrap-edge-maintenance-executor.sh --check
  bootstrap-edge-maintenance-executor.sh --apply

--apply is a one-time bounded bootstrap over the edge host's existing Docker
root-equivalent channel. It uses only a pinned local image with no network,
installs a fixed helper and exact-command sudoers allowlist, and never applies
the Nginx payload itself.
USAGE
}

while [ "$#" -gt 0 ]; do
  case "$1" in
    --check)
      MODE="check"
      ;;
    --apply)
      MODE="apply"
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "UNKNOWN_ARG=$1" >&2
      usage >&2
      exit 64
      ;;
  esac
  shift
done

for file in "$LOCAL_HELPER" "$LOCAL_SUDOERS" "$LOCAL_CONF" "$LOCAL_MAINT"; do
  if [ ! -f "$file" ]; then
    echo "BLOCKER bootstrap_source_missing path=$file"
    exit 66
  fi
done

remote_check() {
  echo "AWOOOI_EDGE_EXECUTOR_BOOTSTRAP=1"
  echo "MODE=check"
  if ssh "${SSH_OPTS[@]}" "$EDGE_TARGET" \
    "sudo -n '$REMOTE_HELPER' check"; then
    echo "EDGE_EXECUTOR_BOOTSTRAP_READY=1"
  else
    echo "EDGE_EXECUTOR_BOOTSTRAP_READY=0"
    echo "BLOCKER privileged_edge_apply_channel_unavailable"
    return 75
  fi
}

if [ "$MODE" = "check" ]; then
  remote_check
  exit $?
fi

RUN_ID="edge-bootstrap-$(date +%Y%m%dT%H%M%S%z)-$$"
REMOTE_STAGE="${REMOTE_STAGE_ROOT}/${RUN_ID}"

echo "AWOOOI_EDGE_EXECUTOR_BOOTSTRAP=1"
echo "MODE=apply"
echo "RUN_ID=$RUN_ID"
echo "BOOTSTRAP_IMAGE=$BOOTSTRAP_IMAGE"
echo "LOCAL_HELPER_SHA256=$(sha256sum "$LOCAL_HELPER" | awk '{print $1}')"
echo "LOCAL_SUDOERS_SHA256=$(sha256sum "$LOCAL_SUDOERS" | awk '{print $1}')"
echo "LOCAL_CONF_SHA256=$(sha256sum "$LOCAL_CONF" | awk '{print $1}')"
echo "LOCAL_MAINT_SHA256=$(sha256sum "$LOCAL_MAINT" | awk '{print $1}')"

ssh "${SSH_OPTS[@]}" "$EDGE_TARGET" \
  "install -d -m 0700 '$REMOTE_STAGE'"
scp -q "${SSH_OPTS[@]}" \
  "$LOCAL_HELPER" "$LOCAL_SUDOERS" "$LOCAL_CONF" "$LOCAL_MAINT" \
  "${EDGE_TARGET}:${REMOTE_STAGE}/"

ssh "${SSH_OPTS[@]}" "$EDGE_TARGET" \
  "docker image inspect --format '{{.Id}}' '$BOOTSTRAP_IMAGE'"

ssh "${SSH_OPTS[@]}" "$EDGE_TARGET" \
  "docker run -i --rm --pull=never --network=none --userns=host -e RUN_ID='$RUN_ID' -v /:/host -v '$REMOTE_STAGE':/payload:ro '$BOOTSTRAP_IMAGE' /bin/sh -s" <<'CONTAINER'
set -eu

HELPER=/host/usr/local/sbin/awoooi-edge-maintenance
SUDOERS=/host/etc/sudoers.d/awoooi-edge-maintenance
CANONICAL_DIR=/host/usr/local/share/awoooi-edge-maintenance
CANONICAL_CONF=$CANONICAL_DIR/awoooi.wooo.work.conf
CANONICAL_MAINT=$CANONICAL_DIR/maintenance.html
BACKUP_ROOT=/host/var/lib/awoooi-edge-maintenance/bootstrap-backups
BACKUP_DIR=$BACKUP_ROOT/$RUN_ID

mkdir -p /host/usr/local/sbin /host/etc/sudoers.d "$CANONICAL_DIR" "$BACKUP_DIR"
chmod 0700 "$BACKUP_ROOT" "$BACKUP_DIR"

backup_file() {
  src=$1
  name=$2
  if [ -e "$src" ]; then
    cp -a "$src" "$BACKUP_DIR/$name"
  else
    : >"$BACKUP_DIR/$name.missing"
  fi
}

restore_file() {
  dst=$1
  name=$2
  if [ -e "$BACKUP_DIR/$name" ]; then
    cp -a "$BACKUP_DIR/$name" "$dst"
  elif [ -e "$BACKUP_DIR/$name.missing" ]; then
    rm -f "$dst"
  fi
}

backup_file "$HELPER" helper
backup_file "$SUDOERS" sudoers
backup_file "$CANONICAL_CONF" canonical-conf
backup_file "$CANONICAL_MAINT" canonical-maint

committed=0
rollback_on_error() {
  rc=$?
  if [ "$rc" -ne 0 ] && [ "$committed" -eq 0 ]; then
    restore_file "$HELPER" helper
    restore_file "$SUDOERS" sudoers
    restore_file "$CANONICAL_CONF" canonical-conf
    restore_file "$CANONICAL_MAINT" canonical-maint
    echo "BOOTSTRAP_ROLLBACK_DONE=1"
  fi
  exit "$rc"
}
trap rollback_on_error EXIT

cp /payload/awoooi-edge-maintenance-helper.sh "$HELPER"
cp /payload/awoooi-edge-maintenance.sudoers "$SUDOERS"
cp /payload/awoooi.wooo.work.conf "$CANONICAL_CONF"
cp /payload/maintenance.html "$CANONICAL_MAINT"
chown 0:0 "$HELPER" "$SUDOERS" "$CANONICAL_CONF" "$CANONICAL_MAINT"
chmod 0755 "$HELPER"
chmod 0440 "$SUDOERS"
chmod 0644 "$CANONICAL_CONF" "$CANONICAL_MAINT"

chroot /host /bin/bash -n /usr/local/sbin/awoooi-edge-maintenance
chroot /host /usr/sbin/visudo -cf /etc/sudoers.d/awoooi-edge-maintenance

committed=1
trap - EXIT
echo "BOOTSTRAP_BACKUP_DIR=${BACKUP_DIR#/host}"
echo "BOOTSTRAP_INSTALL_DONE=1"
CONTAINER

ssh "${SSH_OPTS[@]}" "$EDGE_TARGET" "rm -rf '$REMOTE_STAGE'"
remote_check