#!/usr/bin/env bash
# Inside CTR (as root): wire path after empty→restore.
# - /etc/hosts *.goa.local
# - nginx bank proxy → libeufin :9012 (empty image still has :8080)
# - taler-exchange-dbconfig -p -s (schema + grants for wire role)
# - systemd -a drop-ins (dual exchange-account-1 + exchange-account-default)
# - start wirewatch + transfer; require wirewatch active
set -euo pipefail

echo "==== WIRE POST-RESTORE ===="

if ! grep -q 'bank.goa.local' /etc/hosts 2>/dev/null; then
  echo '127.0.0.1 bank.goa.local exchange.goa.local backend.goa.local' >> /etc/hosts
fi
grep -E 'goa\.local' /etc/hosts || true

SNIP=/etc/nginx/snippets/regional-currency-bank-proxy.conf
if [ -f "$SNIP" ] && grep -q '127.0.0.1:8080' "$SNIP"; then
  sed -i 's|proxy_pass http://127.0.0.1:8080;|proxy_pass http://127.0.0.1:9012;|' "$SNIP"
  echo "NGINX_PROXY_9012=patched"
fi
if command -v nginx >/dev/null 2>&1; then
  nginx -t
  systemctl reload nginx 2>/dev/null || systemctl restart nginx || true
fi

taler-exchange-dbconfig -p -s
echo "DBCONFIG_OK"

ACCT=exchange-account-default
for unit in taler-exchange-wirewatch taler-exchange-transfer; do
  bin="/usr/bin/${unit}"
  d="/etc/systemd/system/${unit}.service.d"
  mkdir -p "$d"
  cat > "${d}/account.conf" <<EOF
[Service]
ExecStart=
ExecStart=${bin} -c /etc/taler-exchange/taler-exchange.conf -L INFO -a ${ACCT}
EOF
done
systemctl daemon-reload
systemctl reset-failed taler-exchange-wirewatch.service taler-exchange-transfer.service 2>/dev/null || true
systemctl restart taler-exchange-wirewatch.service
systemctl start taler-exchange-transfer.service 2>/dev/null || true

# wait wirewatch
ok=0
for i in $(seq 1 30); do
  st=$(systemctl is-active taler-exchange-wirewatch.service 2>/dev/null || echo missing)
  if [ "$st" = "active" ]; then
    ok=1
    break
  fi
  sleep 1
done
echo "WIREWATCH=$(systemctl is-active taler-exchange-wirewatch.service 2>/dev/null || echo missing)"
echo "TRANSFER=$(systemctl is-active taler-exchange-transfer.service 2>/dev/null || echo missing)"
if [ "$ok" -ne 1 ]; then
  journalctl -u taler-exchange-wirewatch.service -n 40 --no-pager || true
  echo "FAIL wirewatch not active"
  exit 1
fi

TOKEN=$(awk -F= '/^TOKEN=/{print $2; exit}' \
  /etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf 2>/dev/null || true)
if [ -n "${TOKEN:-}" ]; then
  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 \
    -H "Authorization: Bearer ${TOKEN}" \
    http://bank.goa.local/accounts/exchange/taler-wire-gateway/config 2>/dev/null || echo ERR)
  echo "WIRE_GATEWAY_VIA_NGINX=${code}"
  case "$code" in 200|204) ;; *)
    echo "FAIL wire gateway via bank.goa.local"
    exit 1
    ;;
  esac
fi

echo "WIRE_POST_RESTORE_OK"