#!/usr/bin/env bash
set -euo pipefail

SOURCE_ROOT="${SOURCE_ROOT:-/opt/apps/linkedsign/source}"
RUNTIME_ROOT="${RUNTIME_ROOT:-/opt/apps/linkedsign}"

FRONTEND_SOURCE="$SOURCE_ROOT/frontend"
BACKEND_SOURCE="$SOURCE_ROOT/backend"
FRONTEND_RUNTIME="$RUNTIME_ROOT/frontend"
BACKEND_RUNTIME="$RUNTIME_ROOT/backend"

echo "[deploy] Building frontend from $FRONTEND_SOURCE"
cd "$FRONTEND_SOURCE"
npm ci
npm run build

echo "[deploy] Publishing frontend runtime to $FRONTEND_RUNTIME"
mkdir -p "$FRONTEND_RUNTIME"
find "$FRONTEND_RUNTIME" -mindepth 1 ! -name 'dist' ! -name 'server.js' -exec rm -rf {} +
rm -rf "$FRONTEND_RUNTIME/dist"
cp -r dist "$FRONTEND_RUNTIME/"
cp server.js "$FRONTEND_RUNTIME/"

echo "[deploy] Publishing backend runtime to $BACKEND_RUNTIME"
mkdir -p "$BACKEND_RUNTIME"
find "$BACKEND_RUNTIME" -mindepth 1 ! -name '.env' -exec rm -rf {} +
cp -r "$BACKEND_SOURCE"/* "$BACKEND_RUNTIME/"

cd "$BACKEND_RUNTIME"
npm ci --omit=dev

echo "[deploy] Removing markdown files from production runtime"
find "$RUNTIME_ROOT" -type f -iname '*.md' -delete

echo "[deploy] Re-applying hardened permissions"
chmod 750 "$RUNTIME_ROOT" "$RUNTIME_ROOT/backend" "$RUNTIME_ROOT/storage" "$RUNTIME_ROOT/logs" "$RUNTIME_ROOT/android" "$RUNTIME_ROOT/android/apk" 2>/dev/null || true
chmod 640 "$BACKEND_RUNTIME/.env" 2>/dev/null || true

echo "[deploy] Done. Restart services manually:"
echo "  sudo systemctl restart linkedsign-frontend"
echo "  sudo systemctl restart linkedsign-backend"