#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
OUTPUT="$SCRIPT_DIR/.env.prod"

echo "=============================================="
echo "  巡樓 Prod 環境設定"
echo "=============================================="
echo ""

# --- Mongo ---
read -p "Mongo root password (留空自動產生): " MONGO_ROOT_PASSWORD
if [ -z "$MONGO_ROOT_PASSWORD" ]; then
  MONGO_ROOT_PASSWORD=$(openssl rand -base64 32)
  echo "  自動產生: $MONGO_ROOT_PASSWORD"
fi
MONGO_ROOT_PASSWORD_ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$MONGO_ROOT_PASSWORD', safe=''))")

# --- Redis ---
read -p "Redis password (留空自動產生): " REDIS_PASSWORD
if [ -z "$REDIS_PASSWORD" ]; then
  REDIS_PASSWORD=$(openssl rand -base64 32)
  echo "  自動產生: $REDIS_PASSWORD"
fi

# --- Admin ---
read -p "Admin email [admin@example.com]: " ADMIN_EMAIL
ADMIN_EMAIL=${ADMIN_EMAIL:-admin@example.com}

while true; do
  read -sp "Admin password (至少 8 字): " ADMIN_PASSWORD
  echo ""
  if [ ${#ADMIN_PASSWORD} -ge 8 ]; then
    break
  fi
  echo "  密碼太短，再試一次"
done

# --- Secrets (auto-generate) ---
JWT_ACCESS_SECRET=$(openssl rand -base64 48)
JWT_REFRESH_SECRET=$(openssl rand -base64 48)
WORKER_SECRET=$(openssl rand -base64 48)
SECRETS_KEY=$(openssl rand -base64 32)

# --- Write .env.prod ---
cat > "$OUTPUT" << ENDOFFILE
# 巡樓 Prod 環境（由 deploy/setup.sh 自動產生，請勿手動編輯）
# infra compose（Mongo / Redis 容器，與下方 HAIXUN_MONGO_URI / HAIXUN_REDIS_PASSWORD 密碼一致）
MONGO_PORT=27017
MONGO_ROOT_USER=haixun
MONGO_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD}
MONGO_DATABASE=haixun

REDIS_PORT=6379
REDIS_PASSWORD=${REDIS_PASSWORD}

# app compose
WEB_IMAGE=ghcr.io/kupi-cat/haixun-web
WEB_TAG=v0.0.1
BACKEND_IMAGE=ghcr.io/kupi-cat/haixun-backend
BACKEND_TAG=v0.0.1
NODE_WORKER_IMAGE=ghcr.io/kupi-cat/haixun-node-worker
NODE_WORKER_TAG=v0.0.1

WEB_PORT=80

HAIXUN_MONGO_URI=mongodb://haixun:${MONGO_ROOT_PASSWORD_ENCODED}@mongo:27017/?authSource=admin
HAIXUN_MONGO_DB=haixun
HAIXUN_REDIS_ADDR=redis:6379
HAIXUN_REDIS_PASSWORD=${REDIS_PASSWORD}

HAIXUN_JWT_ACCESS_SECRET=${JWT_ACCESS_SECRET}
HAIXUN_JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET}
HAIXUN_WORKER_SECRET=${WORKER_SECRET}
HAIXUN_SECRETS_KEY=${SECRETS_KEY}

THREADS_APP_ID=
THREADS_APP_SECRET=
THREADS_REDIRECT_URI=http://your-domain.example/api/v1/threads-accounts/oauth/callback
THREADS_OAUTH_SUCCESS_REDIRECT=http://your-domain.example

INIT_TENANT_ID=default
INIT_ADMIN_EMAIL=${ADMIN_EMAIL}
INIT_ADMIN_PASSWORD=${ADMIN_PASSWORD}
INIT_ADMIN_DISPLAY_NAME=Admin

HAIXUN_WORKER_POLL_MS=3000
HAIXUN_8D_TARGET_SAMPLES=4

# Worker / sweeper 行為
HAIXUN_JOB_SCHEDULER_ENABLED=false
HAIXUN_JOB_SCHEDULER_INTERVAL_SECONDS=60
HAIXUN_JOB_REAPER_ENABLED=false
HAIXUN_JOB_REAPER_INTERVAL_SECONDS=30
HAIXUN_THREADS_TOKEN_REFRESH_ENABLED=false
HAIXUN_THREADS_TOKEN_REFRESH_INTERVAL_SECONDS=3600
HAIXUN_THREADS_TOKEN_REFRESH_LEAD_DAYS=7
HAIXUN_THREADS_PUBLISH_QUEUE_ENABLED=false
HAIXUN_THREADS_PUBLISH_QUEUE_INTERVAL_SECONDS=60
HAIXUN_THREADS_PUBLISH_QUEUE_BATCH_SIZE=20
ENDOFFILE

echo ""
echo "=============================================="
echo "  已完成！產出: $OUTPUT"
echo "  接著執行: make prod-infra && make prod-install"
echo "=============================================="