#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
EVIDENCE_DIR="${DOCS_PORTAL_DEPLOY_EVIDENCE_DIR:-$ROOT_DIR/dist/docs-portal-static-deploy-preflight}"
TRACK="${DOCS_PORTAL_PUBLICATION_TRACK:-internal}"
CREDS_FILE="${DOCS_PORTAL_CLOUDFLARE_CREDS_FILE:-}"
if [[ -n "$CREDS_FILE" ]]; then
  if [[ ! -f "$CREDS_FILE" ]]; then
    echo "FAIL: DOCS_PORTAL_CLOUDFLARE_CREDS_FILE not found: $CREDS_FILE" >&2
    exit 2
  fi
  set -a
  # shellcheck disable=SC1090
  source "$CREDS_FILE"
  set +a
fi
export CLOUDFLARE_ACCOUNT_ID="${CLOUDFLARE_ACCOUNT_ID:-${AccountID:-}}"
export CLOUDFLARE_API_TOKEN="${CLOUDFLARE_API_TOKEN:-${APIToken:-}}"
HOSTNAME="${DOCS_PORTAL_HOSTNAME:-}"
PAGES_PROJECT="${CLOUDFLARE_PAGES_PROJECT:-}"
ACCOUNT_ID_PRESENT="false"
TOKEN_PRESENT="false"

case "$TRACK" in
  public|customer|partner|internal|ops|governance) ;;
  *)
    echo "FAIL: DOCS_PORTAL_PUBLICATION_TRACK must be one of public, customer, partner, internal, ops, governance" >&2
    exit 2
    ;;
esac

if [[ -n "${CLOUDFLARE_ACCOUNT_ID:-}" ]]; then
  ACCOUNT_ID_PRESENT="true"
fi
if [[ -n "${CLOUDFLARE_API_TOKEN:-}" ]]; then
  TOKEN_PRESENT="true"
fi

mkdir -p "$EVIDENCE_DIR"

echo "==> running docs portal check"
make -C "$ROOT_DIR" docs-portal-check

BUILD_DIR="$ROOT_DIR/packages/docs/build"
INDEX_HTML="$BUILD_DIR/index.html"
SOURCE_INVENTORY="$ROOT_DIR/packages/docs/static/portal/source-doc-inventory.json"
OPENAPI_ARTIFACT="$ROOT_DIR/packages/docs/static/api/openapi.draft.yaml"
ASYNCAPI_ARTIFACT="$ROOT_DIR/packages/docs/static/api/asyncapi.draft.yaml"

if [[ ! -s "$INDEX_HTML" ]]; then
  echo "FAIL: missing Docusaurus build output: $INDEX_HTML" >&2
  exit 1
fi
if [[ ! -s "$SOURCE_INVENTORY" ]]; then
  echo "FAIL: missing source-doc inventory: $SOURCE_INVENTORY" >&2
  exit 1
fi
if [[ ! -s "$OPENAPI_ARTIFACT" || ! -s "$ASYNCAPI_ARTIFACT" ]]; then
  echo "FAIL: missing synced API contract artifacts" >&2
  exit 1
fi

GIT_SHA="$(git -C "$ROOT_DIR" rev-parse HEAD)"
GIT_STATUS="$(git -C "$ROOT_DIR" status --short)"
BUILD_FILE_COUNT="$(find "$BUILD_DIR" -type f | wc -l | tr -d ' ')"

export TRACK HOSTNAME PAGES_PROJECT ACCOUNT_ID_PRESENT TOKEN_PRESENT
export GIT_SHA GIT_STATUS BUILD_FILE_COUNT

SUMMARY_JSON="$EVIDENCE_DIR/summary.json"
SUMMARY_MD="$EVIDENCE_DIR/summary.md"

python3 - "$SUMMARY_JSON" <<'PY'
import json
import os
import sys

out = sys.argv[1]
payload = {
    "schema_version": "docs-portal-static-deploy-preflight.v1",
    "result": "pass",
    "publication_track": os.environ["TRACK"],
    "hostname_configured": bool(os.environ["HOSTNAME"]),
    "hostname": os.environ["HOSTNAME"] or None,
    "cloudflare_account_id_present": os.environ["ACCOUNT_ID_PRESENT"] == "true",
    "cloudflare_pages_project_configured": bool(os.environ["PAGES_PROJECT"]),
    "cloudflare_pages_project": os.environ["PAGES_PROJECT"] or None,
    "cloudflare_api_token_present": os.environ["TOKEN_PRESENT"] == "true",
    "git_sha": os.environ["GIT_SHA"],
    "git_dirty": bool(os.environ["GIT_STATUS"]),
    "build_dir": "packages/docs/build",
    "build_file_count": int(os.environ["BUILD_FILE_COUNT"]),
    "source_inventory": "packages/docs/static/portal/source-doc-inventory.json",
    "openapi_artifact": "packages/docs/static/api/openapi.draft.yaml",
    "asyncapi_artifact": "packages/docs/static/api/asyncapi.draft.yaml",
    "upload_performed": False,
    "notes": [
        "Preflight validates build and publication gates only.",
        "Upload requires an explicit Cloudflare Pages deploy step with external credentials.",
        "Token values are not recorded."
    ],
}
with open(out, "w", encoding="utf-8") as fh:
    json.dump(payload, fh, indent=2)
    fh.write("\n")
PY

cat > "$SUMMARY_MD" <<EOF
# Docs Portal Static Deploy Preflight

- result: pass
- publication_track: ${TRACK}
- hostname_configured: $([[ -n "$HOSTNAME" ]] && echo true || echo false)
- cloudflare_account_id_present: ${ACCOUNT_ID_PRESENT}
- cloudflare_pages_project_configured: $([[ -n "$PAGES_PROJECT" ]] && echo true || echo false)
- cloudflare_api_token_present: ${TOKEN_PRESENT}
- git_sha: ${GIT_SHA}
- git_dirty: $([[ -n "$GIT_STATUS" ]] && echo true || echo false)
- build_dir: packages/docs/build
- build_file_count: ${BUILD_FILE_COUNT}
- upload_performed: false

Preflight completed without uploading to Cloudflare.
EOF

echo "OK: docs portal static deploy preflight evidence=$SUMMARY_JSON"