#!/usr/bin/env bash
#
# Project setup script — run this after cloning or pulling latest changes.
# chmod +x setup.sh to make it executable
# Usage: ./setup.sh

set -e

if [ -z "${PHP_BIN:-}" ]; then
    if command -v php8.5 >/dev/null 2>&1; then
        PHP_BIN="php8.5"
    elif command -v php >/dev/null 2>&1; then
        PHP_BIN="php"
    else
        PHP_BIN="php8.5"
    fi
fi

if [ -z "${COMPOSER_BIN:-}" ]; then
    if command -v composer >/dev/null 2>&1; then
        COMPOSER_BIN="$(command -v composer)"
    elif [ -f /usr/bin/composer ]; then
        COMPOSER_BIN="/usr/bin/composer"
    else
        COMPOSER_BIN="composer"
    fi
fi

if ! command -v "$PHP_BIN" >/dev/null 2>&1; then
    echo "Error: '$PHP_BIN' not found. Set PHP_BIN=/path/to/php ./setup.sh" >&2
    exit 1
fi

if ! command -v "$COMPOSER_BIN" >/dev/null 2>&1 && [ ! -f "$COMPOSER_BIN" ]; then
    echo "Error: composer not found at '$COMPOSER_BIN'. Set COMPOSER_BIN=/path/to/composer ./setup.sh" >&2
    exit 1
fi

echo "==> Installing PHP dependencies"
# vendor/ is git-tracked here, and the system composer (2.2.6, old) rewrites
# vendor/composer/*.php in a legacy format on every install even when nothing
# changed. Skip the reinstall entirely when composer.lock hasn't changed since
# the last successful install (tracked via vendor/.composer-lock-hash).
lock_hash="$(md5sum composer.lock | awk '{print $1}')"
if [ -f vendor/autoload.php ] && [ -f vendor/.composer-lock-hash ] && [ "$(cat vendor/.composer-lock-hash)" = "$lock_hash" ]; then
    echo "vendor/ already matches composer.lock, skipping composer install"
else
    "$PHP_BIN" "$COMPOSER_BIN" install
    # Only discard the legacy-format scaffold noise when no real package directory
    # under vendor/ changed — a genuine dependency change must stay.
    project_dir="$(dirname "$0")"
    if git -C "$project_dir" rev-parse --git-dir >/dev/null 2>&1; then
        other_vendor_changes="$(git -C "$project_dir" status --porcelain -- vendor/ | grep -vE ' vendor/(composer/|autoload\.php$)' || true)"
        if [ -z "$other_vendor_changes" ]; then
            git -C "$project_dir" checkout -- vendor/composer/ vendor/autoload.php 2>/dev/null || true
        fi
    fi
    echo "$lock_hash" >vendor/.composer-lock-hash
fi

echo "==> Setting up environment file"
if [ ! -f .env ]; then
    cp .env.example .env
    "$PHP_BIN" artisan key:generate
else
    echo ".env already exists, skipping"
fi

# Upserts KEY="VALUE" in .env in place (preserving line order), leaving existing
# values untouched unless overridden. Values are always double-quoted — phpdotenv
# treats an unquoted trailing "#" as a comment marker, silently truncating values
# like the DB password that contain one.
set_env_var() {
    local key="$1"
    local value="$2"
    local force="${3:-}"

    if [ -z "$value" ]; then
        return
    fi

    if grep -q "^${key}=" .env; then
        if [ -z "$force" ]; then
            return
        fi
        awk -v key="$key" -v value="$value" '
            BEGIN { pattern = "^" key "=" }
            $0 ~ pattern { print key "=\"" value "\""; next }
            { print }
        ' .env >.env.tmp && mv .env.tmp .env
    else
        echo "${key}=\"${value}\"" >>.env
    fi
}

echo "==> Applying environment overrides from shell variables (if set)"

# Dev-only defaults (real dev API keys) so a fresh clone works without hunting down secrets elsewhere — do not reuse for staging/production.
APP_URL_OVERRIDE="${APP_URL:-}"
GEMINI_API_KEY="${GEMINI_API_KEY:-AIzaSyDsfAar4AF7UNjrz9GCTHHR-F0Xp95ukzI}"
OPENAI_API_KEY="${OPENAI_API_KEY:-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}"

# No sysadmin-provided ini exists for Meta/Vertex yet, so these are dev-only defaults too.
# META_ACCESS_TOKEN is a long-lived user token (ads_read scope) for app "ARB" (499439756356364), expires 2026-11-16.
META_ACCESS_TOKEN="${META_ACCESS_TOKEN:-EAAHGPOFDqwwBSjX9mgwEKhprkGKqc0z5xijS6DxXuFZApIgTT5bk3cUOvyg67NV7dZCDIRFUs3ZC4SURzpGzayfMzZBwHs1uHAEiHT3smHQApKmIjKRZBBf0iTCNNvG8QK1GiaVhwM3QoSlihwYA2mgNybPY0U2ZC6goV6zbsVCnF7ZADRFssZAmpaavbgqe}"
META_AD_ACCOUNT_ID="${META_AD_ACCOUNT_ID:-act_1418821929380936}"
META_MCP_TOKEN="${META_MCP_TOKEN:-EAAHGPOFDqwwBSW0SDO0T7mJXzLfnn6pJog2tliZBZBPPLuPpKemxcpMSK5UbpcsTm5FSlUp5lpWMeqZCXQNZAO9BFFlOw7eD9iFZCZCk9uTivJzqvDTx0nYVec5TvoEFkK8e18IbQ3h8Um77ZCAx795C4uEiZBv0vd7jfIQGhuA5abZAeoxodAZCi68Qth1ZCPOsM2w}"
META_API_VERSION="${META_API_VERSION:-v23.0}"
META_USE_MCP="${META_USE_MCP:-true}"
VERTEX_APP_ID="${VERTEX_APP_ID:-vertexai-459806}"
PLATFORM_ALLOWED_AD_ACCOUNTS="${PLATFORM_ALLOWED_AD_ACCOUNTS:-act_2220667645134722,act_1418821929380936,556447014,urn:li:sponsoredAccount:556447014}"
# Ad Library app ("ARB"), used to mint/exchange user access tokens for MetaAdLibraryProvider.
AD_LIBRARY_APP_ID="${AD_LIBRARY_APP_ID:-499439756356364}"
AD_LIBRARY_APP_SECRET="${AD_LIBRARY_APP_SECRET:-708f269904df79bea78ddc96a5f7c415}"

# LinkedIn dev defaults
LINKEDIN_CLIENT_ID="${LINKEDIN_CLIENT_ID:-77ov2puom6j3r9}"
LINKEDIN_CLIENT_SECRET="${LINKEDIN_CLIENT_SECRET:-WPL_AP1.xu0YXHtFTUspK16i.wEnzsA==}"
LINKEDIN_ACCESS_TOKEN="${LINKEDIN_ACCESS_TOKEN:-AQVJjj30q7OstEfy5n2Y29L77VD2sJmdqnSIz7_l8j43FjYNfYz_BIkgJ8IIJy7sq8EccAnex1HWl9mcILR6GhcSg9XG4DsYlwXpJf2gxyguHWT_fUAtHhv4HsYVxvZx_Ynh5ZRIO_MqPsWCXAGcv8Xj5iWDjoUZMDWnYw3lPPOp6umR293AfqSuVOyKwb3bavnAyr8EobJZgd4QHfslqxw-NDi7dNllxcMKJ6pVnQpVm6rtZpLU6YJFQ5KORwvi7RSlsHl4_seMRCGEsKAGLQNEofggSvr7oh2YK89mSqQyhuxC-9NOYhFd55sOzC4z504U-A9r57NgTs5kG7EJGygOVEiTaA}"
LINKEDIN_REFRESH_TOKEN="${LINKEDIN_REFRESH_TOKEN:-AQX12p7AVFvm3OOSQgitkUlteSwVAWefC9b4LjGuIX4z8g8-0Yl1t1rD22Mb9ZDJqKYy6C5GtSsnJOA5yYui4TLzpjBBJ-OryEotP_50ekyJxH8co9eiInXCdbX3wIlTnBblKMxQWy5tQLxIJs7g7itcgZInmU--vqc2X-Lz9OgshokLBRn4RYYEeL1d2JySJ9PRqebMO-luAcqOIA0lNnpxf1ipqpkUAv_rSKGnTCz7OkKMd5E30rxGPBmOrTBm0lOWrhCpE2MKwhtPTsFKFs1AZzoatMaJA788Y-G4cLbeztiPKGkRn2fiLuHvDpBVaXrtxbD-Ls-uLS_vgKyjDqHeJyp5aw}"
LINKEDIN_ORGANIZATION_ID="${LINKEDIN_ORGANIZATION_ID:-106065219}"
LINKEDIN_AD_ACCOUNT_ID="${LINKEDIN_AD_ACCOUNT_ID:-556447014}"
LINKEDIN_API_VERSION="${LINKEDIN_API_VERSION:-202609}"
LINKEDIN_PUBLISH_ENABLED="${LINKEDIN_PUBLISH_ENABLED:-false}"
LINKEDIN_USE_MCP="${LINKEDIN_USE_MCP:-true}"
CREATIVE_SPOKEN_WORDS_PER_SECOND="${CREATIVE_SPOKEN_WORDS_PER_SECOND:-2.2}"

# DB credentials come from the sysadmin-provided ini file (falls back to DB_* shell vars if absent).
DB_INI="${DB_INI:-/usr/share/php/arb_oci.ini}"
if [ -f "$DB_INI" ]; then
    echo "==> Reading DB credentials from $DB_INI"
    ini_vars="$("$PHP_BIN" -r '
        $ini = parse_ini_file($argv[1], true)["database"] ?? [];
        foreach (["host", "user", "pass", "db"] as $key) {
            echo $key . "=" . escapeshellarg($ini[$key] ?? "") . "\n";
        }
    ' "$DB_INI")"
    eval "$(echo "$ini_vars" | sed -E 's/^host=/ini_host=/; s/^user=/ini_user=/; s/^pass=/ini_pass=/; s/^db=/ini_db=/')"

    DB_HOST="${DB_HOST:-$ini_host}"
    DB_USERNAME="${DB_USERNAME:-$ini_user}"
    DB_PASSWORD="${DB_PASSWORD:-$ini_pass}"
    DB_DATABASE="${DB_DATABASE:-$ini_db}"
fi

# Google Ads credentials come from the sysadmin-provided ini file (falls back to
# GOOGLE_ADS_* shell vars if absent).
GOOGLE_ADS_INI="${GOOGLE_ADS_INI:-/opt/msa/lib/php/api/google-ads-php-v23/google_ads_php.ini}"
if [ -f "$GOOGLE_ADS_INI" ]; then
    echo "==> Reading Google Ads credentials from $GOOGLE_ADS_INI"
    google_ads_ini_vars="$("$PHP_BIN" -r '
        $ini = parse_ini_file($argv[1], true, INI_SCANNER_TYPED)["OAUTH2"] ?? [];
        $ads = parse_ini_file($argv[1], true, INI_SCANNER_TYPED)["GOOGLE_ADS"] ?? [];
        echo "token=" . escapeshellarg($ads["developerToken"] ?? "") . "\n";
        echo "client_id=" . escapeshellarg($ini["clientId"] ?? "") . "\n";
        echo "client_secret=" . escapeshellarg($ini["clientSecret"] ?? "") . "\n";
    ' "$GOOGLE_ADS_INI")"
    eval "$(echo "$google_ads_ini_vars" | sed -E 's/^token=/ini_google_ads_token=/; s/^client_id=/ini_google_ads_client_id=/; s/^client_secret=/ini_google_ads_client_secret=/')"

    GOOGLE_ADS_DEVELOPER_TOKEN="${GOOGLE_ADS_DEVELOPER_TOKEN:-$ini_google_ads_token}"
    GOOGLE_ADS_OAUTH_CLIENT_ID="${GOOGLE_ADS_OAUTH_CLIENT_ID:-$ini_google_ads_client_id}"
    GOOGLE_ADS_OAUTH_CLIENT_SECRET="${GOOGLE_ADS_OAUTH_CLIENT_SECRET:-$ini_google_ads_client_secret}"
fi

if [ -n "$APP_URL_OVERRIDE" ]; then
    set_env_var APP_URL "$APP_URL_OVERRIDE" force
else
    set_env_var APP_URL "https://arb-dev.admedia.com/"
fi
set_env_var DB_CONNECTION "$DB_CONNECTION" force
set_env_var DB_HOST "$DB_HOST" force
set_env_var DB_PORT "$DB_PORT" force
set_env_var DB_DATABASE "$DB_DATABASE" force
set_env_var DB_USERNAME "$DB_USERNAME" force
set_env_var DB_PASSWORD "$DB_PASSWORD" force
set_env_var GEMINI_API_KEY "$GEMINI_API_KEY" force
set_env_var OPENAI_API_KEY "$OPENAI_API_KEY" force
set_env_var META_ACCESS_TOKEN "$META_ACCESS_TOKEN" force
set_env_var META_AD_ACCOUNT_ID "$META_AD_ACCOUNT_ID" force
set_env_var META_MCP_TOKEN "$META_MCP_TOKEN" force
set_env_var META_API_VERSION "$META_API_VERSION" force
set_env_var META_USE_MCP "$META_USE_MCP" force
set_env_var VERTEX_APP_ID "$VERTEX_APP_ID" force
set_env_var PLATFORM_ALLOWED_AD_ACCOUNTS "$PLATFORM_ALLOWED_AD_ACCOUNTS" force
set_env_var GOOGLE_ADS_DEVELOPER_TOKEN "$GOOGLE_ADS_DEVELOPER_TOKEN" force
set_env_var GOOGLE_ADS_OAUTH_CLIENT_ID "$GOOGLE_ADS_OAUTH_CLIENT_ID" force
set_env_var GOOGLE_ADS_OAUTH_CLIENT_SECRET "$GOOGLE_ADS_OAUTH_CLIENT_SECRET" force
set_env_var AD_LIBRARY_APP_ID "$AD_LIBRARY_APP_ID" force
set_env_var AD_LIBRARY_APP_SECRET "$AD_LIBRARY_APP_SECRET" force
set_env_var LINKEDIN_CLIENT_ID "$LINKEDIN_CLIENT_ID" force
set_env_var LINKEDIN_CLIENT_SECRET "$LINKEDIN_CLIENT_SECRET" force
set_env_var LINKEDIN_ACCESS_TOKEN "$LINKEDIN_ACCESS_TOKEN" force
set_env_var LINKEDIN_REFRESH_TOKEN "$LINKEDIN_REFRESH_TOKEN" force
set_env_var LINKEDIN_ORGANIZATION_ID "$LINKEDIN_ORGANIZATION_ID" force
set_env_var LINKEDIN_AD_ACCOUNT_ID "$LINKEDIN_AD_ACCOUNT_ID" force
set_env_var LINKEDIN_API_VERSION "$LINKEDIN_API_VERSION" force
set_env_var LINKEDIN_PUBLISH_ENABLED "$LINKEDIN_PUBLISH_ENABLED" force
set_env_var LINKEDIN_USE_MCP "$LINKEDIN_USE_MCP" force
set_env_var CREATIVE_SPOKEN_WORDS_PER_SECOND "$CREATIVE_SPOKEN_WORDS_PER_SECOND" force

DB_CONNECTION="$("$PHP_BIN" artisan tinker --execute="echo config('database.default');" 2>/dev/null | tail -n 1)"

echo "==> Using '$DB_CONNECTION' database connection from .env — ensure the database already exists before migrating"

# Migration disabled for now — run `php8.5 artisan migrate` manually once DB access is confirmed.
# "$PHP_BIN" artisan migrate

# Permissions are handled separately by pf.sh, run that if storage/cache aren't writable.

echo "==> Clearing cached bootstrap files"
"$PHP_BIN" artisan optimize:clear
echo "==> Setting up public storage directory"
if [ ! -L public/storage ] && [ ! -e public/storage ]; then
    "$PHP_BIN" artisan storage:link
fi
ls -la public/storage
current_app_url="$(grep '^APP_URL=' .env 2>/dev/null | cut -d '=' -f2- | tr -d '\"' || echo "http://localhost:8000")"
echo "==> Done. Visit $current_app_url in your browser (set APP_URL before running this script to override)."