#!/usr/bin/env bash
# Full-replace koopa Caddyfile with live snapshot + FP @wdGet (GOA Android withdraw).
#
# Replaces BOTH:
#   /home/hernani/koopa-caddy/Caddyfile   (runtime SoT for ~/bin/caddy-apply)
#   /etc/caddy/Caddyfile                 (active config)
# then validates + systemctl reload caddy.
#
# On koopa (root):
#   sudo bash /path/to/apply-goa-wdGet-full-replace.sh
#   # or with explicit file:
#   sudo bash …/apply-goa-wdGet-full-replace.sh /path/to/Caddyfile.koopa-live-wdGet
#
# FP pattern: francpaysan-admin-log files/caddy/Caddyfile @wdGet
# Ship file: scripts/caddy/Caddyfile.koopa-live-wdGet (live koopa + @wdGet only)
set -euo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SRC="${1:-$HERE/Caddyfile.koopa-live-wdGet}"
USER_CADDY="/home/hernani/koopa-caddy/Caddyfile"
ETC_CADDY="/etc/caddy/Caddyfile"
BACKUP_DIR="/etc/caddy"

if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: run as root:  sudo bash $0${1:+ $1}" >&2
  exit 1
fi

[[ -f "$SRC" ]] || { echo "ERROR: missing source: $SRC" >&2; exit 1; }
[[ -d "$(dirname "$USER_CADDY")" ]] || { echo "ERROR: missing dir: $(dirname "$USER_CADDY")" >&2; exit 1; }
[[ -f "$ETC_CADDY" ]] || { echo "ERROR: missing $ETC_CADDY" >&2; exit 1; }
command -v caddy >/dev/null || { echo "ERROR: caddy not in PATH" >&2; exit 1; }

if ! grep -q '@wdGet' "$SRC"; then
  echo "ERROR: source lacks @wdGet — refusing replace: $SRC" >&2
  exit 1
fi
if ! grep -q 'path /taler-integration/withdrawal-operation/\*' "$SRC"; then
  echo "ERROR: source lacks Integration @wdGet path — refusing: $SRC" >&2
  exit 1
fi

ts=$(date +%Y%m%d-%H%M%S)
bak_etc="${BACKUP_DIR}/Caddyfile.bak-goa-wdGet-${ts}"
bak_user="${USER_CADDY}.bak-goa-wdGet-${ts}"

cp -a "$ETC_CADDY" "$bak_etc"
echo "backup etc:  $bak_etc"
if [[ -f "$USER_CADDY" ]]; then
  cp -a "$USER_CADDY" "$bak_user"
  echo "backup user: $bak_user"
fi

install -o hernani -g hernani -m 644 "$SRC" "$USER_CADDY"
echo "wrote: $USER_CADDY"

install -o root -g caddy -m 644 "$SRC" "$ETC_CADDY" 2>/dev/null \
  || install -o root -g root -m 644 "$SRC" "$ETC_CADDY"
echo "wrote: $ETC_CADDY"

echo "validate..."
caddy validate --config "$ETC_CADDY"

echo "reload..."
systemctl reload caddy
systemctl is-active caddy

echo "spot-check @wdGet:"
grep -n '@wdGet\|withdrawal-operation\|reverse_proxy 127.0.0.1:9013\|reverse_proxy 127.0.0.1:9012' "$ETC_CADDY" | head -20

echo "smoke public Integration (expect suggested_exchange + required_exchange):"
smoke="$(curl -sS --max-time 10 \
  'https://bank.hacktivism.ch/taler-integration/withdrawal-operation/00000000-0000-0000-0000-000000000001' || true)"
echo "$smoke"
if echo "$smoke" | grep -q 'suggested_exchange' && echo "$smoke" | grep -q 'required_exchange'; then
  echo "OK: public Integration injects exchange fields"
else
  echo "WARN: public smoke missing exchange fields — check nginx Integration + demo-api :19096" >&2
  exit 1
fi