#!/bin/bash
# IRIDE setup — funzioni comuni (sourced da bootstrap.sh e install.sh)
# Tecnotel Servizi SRL

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; CYAN='\033[0;36m'; NC='\033[0m'
info()    { echo -e "${CYAN}[INFO]${NC} $1"; }
success() { echo -e "${GREEN}[OK]${NC} $1"; }
warn()    { echo -e "${YELLOW}[WARN]${NC} $1"; }
error()   { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }
section() { echo -e "\n${BLUE}══════════════════════════════════════${NC}"; echo -e "${BLUE} $1${NC}"; echo -e "${BLUE}══════════════════════════════════════${NC}"; }

IRIDE_ROOT="/opt/iride"
IRIDE_APP="$IRIDE_ROOT/app"
IRIDE_CONFIG="$IRIDE_ROOT/config"
IRIDE_DATA="$IRIDE_ROOT/data"
IRIDE_LOGS="$IRIDE_ROOT/logs"
IRIDE_BACKUPS="$IRIDE_ROOT/backups"
IRIDE_CERTS="$IRIDE_ROOT/certs"
IRIDE_SETUP="$IRIDE_ROOT/setup"
IRIDE_USER="iride"
IRIDE_VENV="$IRIDE_APP/backend/venv"
IRIDE_SERVICES=(iride-api iride-worker iride-scheduler)

require_root() { [[ $EUID -eq 0 ]] || error "Eseguire con sudo"; }

detect_os() {
    if [[ -f /etc/os-release ]]; then
        . /etc/os-release
        case "${ID:-}:${VERSION_ID:-}" in
            ubuntu:22.04|ubuntu:24.04) success "Sistema: $PRETTY_NAME" ;;
            ubuntu:*) warn "Ubuntu ${VERSION_ID} non collaudato (riferimento: 22.04 / 24.04)" ;;
            *) warn "Distribuzione ${ID:-?} non collaudata: il riferimento è Ubuntu Server LTS" ;;
        esac
    fi
}

as_iride() { sudo -u "$IRIDE_USER" -H "$@"; }

ensure_packages() {
    export DEBIAN_FRONTEND=noninteractive
    apt-get update -qq
    apt-get install -y -qq git curl ca-certificates openssl python3 python3-venv python3-pip nginx sqlite3 >/dev/null
    success "Pacchetti di base installati"
}

ensure_user_and_dirs() {
    if ! id "$IRIDE_USER" >/dev/null 2>&1; then
        useradd --system --home-dir "$IRIDE_ROOT" --shell /usr/sbin/nologin "$IRIDE_USER"
        success "Utente di servizio $IRIDE_USER creato"
    fi
    mkdir -p "$IRIDE_APP" "$IRIDE_CONFIG" "$IRIDE_DATA" "$IRIDE_LOGS" "$IRIDE_BACKUPS" "$IRIDE_CERTS" "$IRIDE_SETUP"
    chown "$IRIDE_USER:$IRIDE_USER" "$IRIDE_ROOT" "$IRIDE_APP" "$IRIDE_CONFIG" "$IRIDE_DATA" "$IRIDE_LOGS" "$IRIDE_BACKUPS" "$IRIDE_CERTS" "$IRIDE_SETUP"
    chmod 750 "$IRIDE_ROOT"
    chmod 700 "$IRIDE_CONFIG"
}

# Credenziali git di sola lettura per le istanze: file 0600 dell'utente iride,
# usato dal credential helper "store". Mai token personali.
configure_git_credentials() {
    local gitea_host="$1" token="$2"
    local cred="$IRIDE_CONFIG/git-credentials"
    printf 'https://oauth2:%s@%s\n' "$token" "$gitea_host" > "$cred"
    chown "$IRIDE_USER:$IRIDE_USER" "$cred"; chmod 600 "$cred"
    as_iride git config --global credential.helper "store --file=$cred"
    as_iride git config --global safe.directory "$IRIDE_APP"
    as_iride git config --global safe.directory "$IRIDE_SETUP"
    success "Credenziali git salvate in $cred (0600)"
}

clone_or_update() {
    local url="$1" dest="$2" branch="$3"
    if [[ -d "$dest/.git" ]]; then
        as_iride git -C "$dest" fetch --quiet origin "$branch"
        as_iride git -C "$dest" checkout --quiet "$branch"
        as_iride git -C "$dest" merge --ff-only --quiet "origin/$branch"
        success "Aggiornato $dest ($branch)"
    else
        as_iride git clone --quiet --branch "$branch" "$url" "$dest"
        success "Clonato $url in $dest"
    fi
}