#!/bin/bash
# ══════════════════════════════════════════════════════════════════════════════
# IRIDE — install.sh: primo install di un'istanza (Tecnotel Servizi SRL)
# Lanciato da bootstrap.sh; rieseguibile (idempotente sui passi già fatti).
#
#   sudo bash /opt/iride/setup/install.sh --app-url URL --branch main --gitea-host host
#        [--client NOME] [--domain FQDN] [--admin-user admin] [--admin-password PWD]
#
# Passi: repo app → venv → config da esempi → wizard first_setup.py → migrazioni
#        → build frontend (se presente) → systemd → nginx + certificato → permessi
#        → avvio → health check. Gli aggiornamenti successivi: scripts/update.sh.
# ══════════════════════════════════════════════════════════════════════════════
set -euo pipefail
SETUP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "$SETUP_DIR/lib/common.sh"

APP_URL=""; BRANCH="main"; GITEA_HOST=""
CLIENT=""; DOMAIN=""; ADMIN_USER="admin"; ADMIN_PASSWORD=""
while [[ $# -gt 0 ]]; do
    case "$1" in
        --app-url) APP_URL="$2"; shift 2 ;;
        --branch) BRANCH="$2"; shift 2 ;;
        --gitea-host) GITEA_HOST="$2"; shift 2 ;;
        --client) CLIENT="$2"; shift 2 ;;
        --domain) DOMAIN="$2"; shift 2 ;;
        --admin-user) ADMIN_USER="$2"; shift 2 ;;
        --admin-password) ADMIN_PASSWORD="$2"; shift 2 ;;
        *) error "Opzione sconosciuta: $1" ;;
    esac
done
require_root
[[ -n "$APP_URL" ]] || APP_URL="https://${GITEA_HOST:-repo.argosdefense.io}/tecnotel/iride.git"

section "1. Sistema"
detect_os
ensure_packages
ensure_user_and_dirs

section "2. Repository applicativo ($BRANCH)"
clone_or_update "$APP_URL" "$IRIDE_APP" "$BRANCH"
APP_VERSION="$(cat "$IRIDE_APP/VERSION" 2>/dev/null || echo '?')"
info "IRIDE $APP_VERSION"

section "3. Virtualenv e dipendenze"
if [[ ! -x "$IRIDE_VENV/bin/python" ]]; then
    as_iride python3 -m venv "$IRIDE_VENV"
fi
as_iride "$IRIDE_VENV/bin/pip" install --quiet --upgrade pip
as_iride "$IRIDE_VENV/bin/pip" install --quiet -r "$IRIDE_APP/backend/requirements.txt"
success "Dipendenze installate in $IRIDE_VENV"

section "4. Configurazione"
for example in "$IRIDE_APP"/config/*.example; do
    target="$IRIDE_CONFIG/$(basename "${example%.example}")"
    if [[ ! -f "$target" ]]; then
        cp "$example" "$target"
        info "Creato $target da esempio"
    fi
done
chown "$IRIDE_USER:$IRIDE_USER" "$IRIDE_CONFIG"/*.json
chmod 600 "$IRIDE_CONFIG"/*.json
export IRIDE_CONFIG_DIR="$IRIDE_CONFIG" IRIDE_DATA_DIR="$IRIDE_DATA" IRIDE_LOGS_DIR="$IRIDE_LOGS" IRIDE_DB="$IRIDE_DATA/iride.db"
export IRIDE_CLIENT_NAME="$CLIENT" IRIDE_DOMAIN="$DOMAIN" IRIDE_ADMIN_USER="$ADMIN_USER" IRIDE_ADMIN_PASSWORD="$ADMIN_PASSWORD"
sudo -u "$IRIDE_USER" -H --preserve-env=IRIDE_CONFIG_DIR,IRIDE_DATA_DIR,IRIDE_LOGS_DIR,IRIDE_DB,IRIDE_CLIENT_NAME,IRIDE_DOMAIN,IRIDE_ADMIN_USER,IRIDE_ADMIN_PASSWORD \
    env PYTHONPATH="$IRIDE_APP/backend" "$IRIDE_VENV/bin/python" "$SETUP_DIR/first_setup.py"
SERVER_NAME="$("$IRIDE_VENV/bin/python" -c "import json; print(json.load(open('$IRIDE_CONFIG/iride.json'))['cliente'].get('domain') or '')")"
[[ -n "$SERVER_NAME" ]] || SERVER_NAME="$(hostname -f 2>/dev/null || hostname)"

section "5. Migrazioni DB"
cd "$IRIDE_APP/backend"
sudo -u "$IRIDE_USER" -H --preserve-env=IRIDE_CONFIG_DIR,IRIDE_DATA_DIR,IRIDE_LOGS_DIR,IRIDE_DB "$IRIDE_VENV/bin/python" db.py
success "Schema allineato"

section "6. Frontend"
if [[ -f "$IRIDE_APP/frontend/package.json" ]]; then
    command -v npm >/dev/null || error "npm assente: installare Node LTS (NodeSource) e rilanciare"
    cd "$IRIDE_APP/frontend"
    as_iride npm ci --silent
    as_iride npm run build
    success "Frontend compilato"
else
    warn "Nessun frontend/package.json: nginx servirà solo l'API (B-067)"
fi

section "7. systemd"
for svc in "${IRIDE_SERVICES[@]}"; do
    cp "$IRIDE_APP/deploy/systemd/$svc.service" "/etc/systemd/system/$svc.service"
done
systemctl daemon-reload
for svc in "${IRIDE_SERVICES[@]}"; do systemctl enable --quiet "$svc"; done
cp "$IRIDE_APP/deploy/logrotate/iride" /etc/logrotate.d/iride
cp "$IRIDE_APP/deploy/sudoers/iride-systemctl" /etc/sudoers.d/iride-systemctl
chmod 440 /etc/sudoers.d/iride-systemctl
visudo -cf /etc/sudoers.d/iride-systemctl >/dev/null || error "sudoers non valido"
success "Unit installate e abilitate: ${IRIDE_SERVICES[*]}"

section "8. nginx e certificato ($SERVER_NAME)"
if [[ ! -f "$IRIDE_CERTS/fullchain.pem" ]]; then
    openssl req -x509 -nodes -newkey rsa:2048 -days 825 -subj "/CN=$SERVER_NAME" \
        -keyout "$IRIDE_CERTS/privkey.pem" -out "$IRIDE_CERTS/fullchain.pem" >/dev/null 2>&1
    chown "$IRIDE_USER:$IRIDE_USER" "$IRIDE_CERTS"/*.pem; chmod 600 "$IRIDE_CERTS/privkey.pem"
    warn "Certificato self-signed generato: per WhatsApp serve un certificato valido in $IRIDE_CERTS"
fi
sed "s/IRIDE_SERVER_NAME/$SERVER_NAME/g" "$IRIDE_APP/deploy/nginx/iride.conf" > /etc/nginx/sites-available/iride
ln -sf /etc/nginx/sites-available/iride /etc/nginx/sites-enabled/iride
rm -f /etc/nginx/sites-enabled/default
nginx -t >/dev/null 2>&1 || error "Configurazione nginx non valida: nginx -t"
systemctl enable --quiet nginx
systemctl reload nginx || systemctl restart nginx
success "nginx configurato"

section "9. Permessi"
chown -R "$IRIDE_USER:$IRIDE_USER" "$IRIDE_ROOT"
chmod 700 "$IRIDE_CONFIG"
chmod 600 "$IRIDE_CONFIG"/*.json "$IRIDE_CONFIG/git-credentials" 2>/dev/null || true
success "Proprietario $IRIDE_USER, config 0600"

section "10. Avvio e verifica"
for svc in "${IRIDE_SERVICES[@]}"; do systemctl restart "$svc"; done
sleep 2
bash "$SETUP_DIR/checks/health.sh" || error "Health check fallito: vedere $IRIDE_LOGS"

echo
success "IRIDE $APP_VERSION installato"
echo "   Portale:      https://$SERVER_NAME/   (API: /api/health, /api/docs)"
echo "   Utente admin: $ADMIN_USER"
echo "   Prossimi passi: canali in $IRIDE_CONFIG/channels.json e credenziali in credentials.json,"
echo "                   poi: sudo systemctl restart iride-api"
echo "   Aggiornamenti: sudo bash $IRIDE_APP/scripts/update.sh"