#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
readonly SCRIPT_DIR
# shellcheck source=e2e-snapshot-contract.sh
source "${SCRIPT_DIR}/e2e-snapshot-contract.sh"
readonly FIXTURE="${SCRIPT_DIR}/fixtures/acf-field-table-fixture.php"
OUTPUT="$(ipz_snapshot_dir)"
readonly OUTPUT
readonly BUILD_ID="ipz-snapshot-build-$$"
readonly NETWORK="${BUILD_ID}-network"
readonly DB="${BUILD_ID}-db"
readonly WP="${BUILD_ID}-wp"
readonly DB_VOLUME="${BUILD_ID}-db-data"
readonly WP_VOLUME="${BUILD_ID}-wp-data"
staging=''

# Buildboxes carry plain podman; deck-podman exists only on the sandboxed workstation.
if command -v deck-podman >/dev/null 2>&1; then
    PODMAN=deck-podman
else
    PODMAN=podman
fi
readonly PODMAN

cleanup() {
    local status=$?
    trap - EXIT INT TERM
    if [[ -n "${staging}" ]]; then
        rm -rf -- "${staging}"
    fi
    "${PODMAN}" rm --force "${WP}" "${DB}" >/dev/null 2>&1 || true
    "${PODMAN}" network rm "${NETWORK}" >/dev/null 2>&1 || true
    "${PODMAN}" volume rm "${DB_VOLUME}" "${WP_VOLUME}" >/dev/null 2>&1 || true
    exit "${status}"
}
trap cleanup EXIT INT TERM

for command in "${PODMAN}" sha256sum tar; do
    command -v "${command}" >/dev/null || { printf 'Required command is unavailable: %s\n' "${command}" >&2; exit 1; }
done
[[ -f "${FIXTURE}" ]] || { printf 'Fixture is missing: %s\n' "${FIXTURE}" >&2; exit 1; }

mkdir -p "$(dirname -- "${OUTPUT}")"
staging="$(mktemp -d "$(dirname -- "${OUTPUT}")/.ipz-snapshot.XXXXXX")"

require_resource() {
    local kind=$1 name=$2
    "${PODMAN}" "${kind}" exists "${name}" || {
        printf 'Expected %s was not created: %s\n' "${kind}" "${name}" >&2
        return 1
    }
}

require_archive() {
    local archive=$1
    if [[ ! -s "${archive}" ]] || ! tar -tf "${archive}" >/dev/null; then
        printf 'Expected snapshot archive is missing or invalid: %s\n' "${archive}" >&2
        return 1
    fi
}

"${PODMAN}" network create "${NETWORK}" >/dev/null
require_resource network "${NETWORK}"
"${PODMAN}" volume create "${DB_VOLUME}" >/dev/null
require_resource volume "${DB_VOLUME}"
"${PODMAN}" volume create "${WP_VOLUME}" >/dev/null
require_resource volume "${WP_VOLUME}"
"${PODMAN}" run -d --name "${DB}" --network "${NETWORK}" --volume "${DB_VOLUME}:/var/lib/mysql:Z" \
    -e MARIADB_DATABASE=wordpress -e MARIADB_USER=wordpress -e MARIADB_PASSWORD=wordpress -e MARIADB_ROOT_PASSWORD=wordpress \
    "${IPZ_MARIADB_IMAGE}" >/dev/null
require_resource container "${DB}"
for _ in $(seq 1 60); do
    "${PODMAN}" exec "${DB}" mariadb-admin ping -uwordpress -pwordpress --silent >/dev/null 2>&1 && break
    sleep 1
done
"${PODMAN}" exec "${DB}" mariadb-admin ping -uwordpress -pwordpress --silent >/dev/null
"${PODMAN}" run -d --name "${WP}" --network "${NETWORK}" --volume "${WP_VOLUME}:/var/www/html:Z" \
    -e WORDPRESS_DB_HOST="${DB}" -e WORDPRESS_DB_NAME=wordpress -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress \
    "${IPZ_WORDPRESS_IMAGE}" >/dev/null
require_resource container "${WP}"
for _ in $(seq 1 60); do "${PODMAN}" exec "${WP}" test -f /var/www/html/wp-config.php && break; sleep 1; done
wp() {
    "${PODMAN}" run --rm --network "${NETWORK}" --user 0 --volumes-from "${WP}" \
        -e WORDPRESS_DB_HOST="${DB}" -e WORDPRESS_DB_NAME=wordpress -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress \
        "${IPZ_WORDPRESS_CLI_IMAGE}" wp "$@" --allow-root
}
for _ in $(seq 1 60); do
    wp db query 'SELECT 1' >/dev/null 2>&1 && break
    sleep 1
done
wp db query 'SELECT 1' >/dev/null
wp core install --url=http://127.0.0.1:8080 --title='IPZ E2E' --admin_user=admin --admin_password=admin123 --admin_email=admin@example.test --skip-email
wp plugin install advanced-custom-fields --version="${IPZ_ACF_VERSION}" --activate
"${PODMAN}" exec "${WP}" mkdir -p /var/www/html/wp-content/mu-plugins
"${PODMAN}" cp "${FIXTURE}" "${WP}:/var/www/html/wp-content/mu-plugins/acf-field-table-fixture.php"
wp rewrite structure '/%postname%/'
wp rewrite flush
"${PODMAN}" exec "${WP}" rm -rf /var/www/html/wp-content/plugins/international-press-zone
"${PODMAN}" stop "${WP}" "${DB}" >/dev/null
"${PODMAN}" run --rm --volume "${DB_VOLUME}:/source:ro" --volume "${staging}:/out:Z" docker.io/library/alpine:3.20 tar -C /source -cf /out/database.tar .
"${PODMAN}" run --rm --volume "${WP_VOLUME}:/source:ro" --volume "${staging}:/out:Z" docker.io/library/alpine:3.20 tar -C /source -cf /out/wordpress.tar .
require_archive "${staging}/database.tar"
require_archive "${staging}/wordpress.tar"
ipz_snapshot_fingerprint >"${staging}/fingerprint"
ipz_snapshot_fingerprint_input >"${staging}/contract"
ipz_validate_snapshot "${staging}"
mkdir -p "$(dirname -- "${OUTPUT}")"
rm -rf -- "${OUTPUT}.new"
mv -- "${staging}" "${OUTPUT}.new"
rm -rf -- "${OUTPUT}"
mv -- "${OUTPUT}.new" "${OUTPUT}"
printf 'Built immutable E2E snapshot: %s\n' "${OUTPUT}"