#!/bin/bash
# Production Deployment Script for OIDC Identity Provider

set -e  # Exit on error

echo "========================================"
echo "OIDC IdP - Production Deployment"
echo "========================================"

# Check if .env exists
if [ ! -f .env ]; then
    echo "ERROR: .env file not found!"
    echo "Please copy .env.production to .env and configure it:"
    echo "  cp .env.production .env"
    echo "  nano .env  # Edit with your production values"
    exit 1
fi

# Load environment variables
source .env

# Validate required variables
if [ -z "$SECRET_KEY" ] || [ "$SECRET_KEY" == "dev-secret-key-please-change-in-production" ]; then
    echo "ERROR: SECRET_KEY must be set to a secure value in .env"
    exit 1
fi

if [ -z "$OIDC_ISSUER" ] || [ "$OIDC_ISSUER" == "http://localhost:5000" ]; then
    echo "WARNING: OIDC_ISSUER is set to localhost. This may not work in production!"
    read -p "Continue anyway? (y/N) " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        exit 1
    fi
fi

echo ""
echo "Configuration:"
echo "  FLASK_ENV: $FLASK_ENV"
echo "  OIDC_ISSUER: $OIDC_ISSUER"
echo "  DATABASE_URL: ${DATABASE_URL%%@*}@***"  # Hide password
echo ""

# Ask for confirmation
read -p "Deploy with these settings? (y/N) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
    echo "Deployment cancelled."
    exit 1
fi

echo ""
echo "Step 1: Building Docker images..."
docker-compose -f docker-compose.prod.yml build

echo ""
echo "Step 2: Starting services..."
docker-compose -f docker-compose.prod.yml up -d

echo ""
echo "Step 3: Waiting for services to be healthy..."
sleep 5

# Check health
for i in {1..30}; do
    if curl -sf http://localhost:5000/health > /dev/null 2>&1; then
        echo "✓ Services are healthy!"
        break
    fi
    echo "  Waiting for services... ($i/30)"
    sleep 2
done

echo ""
echo "========================================"
echo "Deployment Complete!"
echo "========================================"
echo ""
echo "Service Status:"
docker-compose -f docker-compose.prod.yml ps
echo ""
echo "Access your OIDC server at:"
echo "  $OIDC_ISSUER"
echo ""
echo "Discovery endpoint:"
echo "  $OIDC_ISSUER/.well-known/openid-configuration"
echo ""
echo "Default admin credentials:"
echo "  Username: admin"
echo "  Password: admin123"
echo ""
echo "⚠️  IMPORTANT: Change the admin password immediately!"
echo "   Visit: $OIDC_ISSUER/admin/login"
echo ""
echo "View logs with:"
echo "  docker-compose -f docker-compose.prod.yml logs -f"
echo ""
echo "Stop services with:"
echo "  docker-compose -f docker-compose.prod.yml down"
echo ""