#!/usr/bin/env bash
set -euo pipefail

SOURCE_ROOT="${SOURCE_ROOT:-/opt/apps/linkedsign/source}"
RUNTIME_ROOT="${RUNTIME_ROOT:-/opt/apps/linkedsign}"

FRONTEND_SOURCE="$SOURCE_ROOT/frontend"
BACKEND_SOURCE="$SOURCE_ROOT/backend"
FRONTEND_RUNTIME="$RUNTIME_ROOT/frontend"
BACKEND_RUNTIME="$RUNTIME_ROOT/backend"

echo "[deploy] Building frontend from $FRONTEND_SOURCE"
cd "$FRONTEND_SOURCE"
npm ci
npm run build

echo "[deploy] Publishing frontend runtime to $FRONTEND_RUNTIME"
mkdir -p "$FRONTEND_RUNTIME"
shopt -s dotglob nullglob
for item in "$FRONTEND_RUNTIME"/*; do
  base="$(basename "$item")"
  if [[ "$base" != "dist" && "$base" != "server.js" ]]; then
    rm -rf "$item"
  fi
done
rm -rf "$FRONTEND_RUNTIME/dist"
cp -r dist "$FRONTEND_RUNTIME/"
cp server.js "$FRONTEND_RUNTIME/"

echo "[deploy] Publishing backend runtime to $BACKEND_RUNTIME"
mkdir -p "$BACKEND_RUNTIME"
for item in "$BACKEND_RUNTIME"/*; do
  base="$(basename "$item")"
  if [[ "$base" != ".env" ]]; then
    rm -rf "$item"
  fi
done
cp -a "$BACKEND_SOURCE"/. "$BACKEND_RUNTIME/"
rm -f "$BACKEND_RUNTIME/.env.example"
shopt -u dotglob nullglob

cd "$BACKEND_RUNTIME"
npm ci --omit=dev

echo "[deploy] Removing markdown files from production runtime"
find "$RUNTIME_ROOT" -type f -iname '*.md' -delete

echo "[deploy] Re-applying hardened permissions"
chmod 750 "$RUNTIME_ROOT" "$RUNTIME_ROOT/backend" "$RUNTIME_ROOT/storage" "$RUNTIME_ROOT/logs" "$RUNTIME_ROOT/android" "$RUNTIME_ROOT/android/apk" 2>/dev/null || true
chmod 640 "$BACKEND_RUNTIME/.env" 2>/dev/null || true

echo "[deploy] Done. Restart services manually:"
echo "  sudo systemctl restart linkedsign-frontend"
echo "  sudo systemctl restart linkedsign-backend"