#!/usr/bin/env bash
set -Eeuo pipefail

readonly DASHBOARD_APP_DIR="${DASHBOARD_APP_DIR:-/opt/manus-deploy/apps/manus-dashboard}"
readonly DASHBOARD_ENV_FILE="${DASHBOARD_ENV_FILE:-${DASHBOARD_APP_DIR}/.env}"
readonly REFERENTIEL_CONTAINER="${REFERENTIEL_CONTAINER:-referentiel-ia}"
readonly REFERENTIEL_URL="${IA_REFERENTIEL_URL:-https://referentiel-ia.recette.santinova-soft.org}"

backup="$(mktemp /tmp/manus-dashboard-env-backup.XXXXXX)"
temporary="$(mktemp /tmp/manus-dashboard-env-next.XXXXXX)"
chmod 0600 "${backup}" "${temporary}"
cp "${DASHBOARD_ENV_FILE}" "${backup}"

cleanup() {
  rm -f "${backup}" "${temporary}"
  unset token result
}
trap cleanup EXIT

result="$(docker exec "${REFERENTIEL_CONTAINER}" sh -lc 'cd /app && corepack pnpm exec tsx scripts/dashboard-alert-token.ts prepare')"
token="${result%%$'\t'*}"
token_id="${result##*$'\t'}"
[[ -n "${token}" && "${token_id}" =~ ^[0-9]+$ ]] || { echo "Le Référentiel IA n’a pas retourné un jeton exploitable." >&2; exit 1; }

awk -v value="${token}" '
  BEGIN { replaced = 0 }
  /^IA_REFERENTIEL_TOKEN=/ { print "IA_REFERENTIEL_TOKEN=" value; replaced = 1; next }
  { print }
  END { if (!replaced) print "IA_REFERENTIEL_TOKEN=" value }
' "${DASHBOARD_ENV_FILE}" > "${temporary}"
mv "${temporary}" "${DASHBOARD_ENV_FILE}"
chmod 0600 "${DASHBOARD_ENV_FILE}"

if ! (cd "${DASHBOARD_APP_DIR}" && docker compose up -d --force-recreate dashboard >/dev/null); then
  cp "${backup}" "${DASHBOARD_ENV_FILE}"
  exit 1
fi
sleep 8
health="$(curl -sS -o /dev/null -w '%{http_code}' -H "Authorization: Bearer ${token}" "${REFERENTIEL_URL}/api/integration/v1/alerts/ci/health")"
if [[ "${health}" != "204" ]]; then
  cp "${backup}" "${DASHBOARD_ENV_FILE}"
  (cd "${DASHBOARD_APP_DIR}" && docker compose up -d --force-recreate dashboard >/dev/null) || true
  echo "Le nouveau jeton d’alerte a échoué au contrôle HTTP (${health}); rollback effectué." >&2
  exit 1
fi

docker exec "${REFERENTIEL_CONTAINER}" sh -lc "cd /app && corepack pnpm exec tsx scripts/dashboard-alert-token.ts finalize ${token_id}" >/dev/null
echo "DASHBOARD_ALERT_TOKEN_PROVISIONED"