#!/bin/bash
# Installazione VTE-Axess SENZA root (extract, DB, schema, upgrade, morphsuit).
# Per Apache/cron/hosts: sudo bash install-vteaxess-root-finish.sh
#
#   bash /var/www/html/server-ops/mypantarei/install-vteaxess.sh

set -euo pipefail

VTE_ROOT=/var/www/html/vteaxess
TGZ=/var/www/html/VTENEXT2604GA.tgz
TGZ_DIR=vte2604_3367
DB_NAME=vteaxess
DB_USER=vteaxess
HOST=vte-axess.mypantarei.net
SITE_URL="http://${HOST}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
UPDATER_SRC=/var/www/html/vte2472
ADMIN_EMAIL='axess@mypantarei.net'
# Non deve contenere "admin" (policy VTE: niente riferimenti a user_name/first_name/last_name)
ADMIN_PASS='AxessVte#2026!Kq7'
STD_EMAIL='user@vte-axess.mypantarei.net'
STD_PASS='AxessUser2026!'
MYSQL_ADMIN_USER=gabry
MYSQL_ADMIN_PASS='PantAdmin@9'

FILES_DONE="${VTE_ROOT}/.install-vteaxess-done"
INSTALL_DONE="${VTE_ROOT}/.install-vteaxess-schema-done"
UPGRADE_DONE="${VTE_ROOT}/.install-vteaxess-upgrade-done"
ENV_FILE="${SCRIPT_DIR}/vteaxess-install.env"

if [[ -f "$ENV_FILE" ]]; then
	# shellcheck disable=SC1090
	source "$ENV_FILE"
fi
if [[ -z "${DB_PASS:-}" ]]; then
	DB_PASS="$(openssl rand -base64 18 | tr -d '/+=' | head -c 24)"
fi
if [[ -z "${APP_KEY:-}" ]]; then
	APP_KEY="$(openssl rand -hex 16)"
fi
if [[ -z "${CSRF_SECRET:-}" ]]; then
	CSRF_SECRET="$(openssl rand -hex 32)"
fi

mysql_admin() {
	mysql -u "$MYSQL_ADMIN_USER" -p"$MYSQL_ADMIN_PASS" "$@"
}

if [[ -f "$FILES_DONE" ]]; then
	echo "Istanza già completata (${FILES_DONE}). Uscita."
	exit 0
fi

echo "=== 1) Estrazione VTENEXT 26.04 GA ==="
if [[ ! -f "${VTE_ROOT}/vteversion.php" ]]; then
	mkdir -p "$VTE_ROOT"
	rm -rf "/tmp/${TGZ_DIR}"
	tar -xzf "$TGZ" -C /tmp
	rsync -a "/tmp/${TGZ_DIR}/" "${VTE_ROOT}/"
	rm -rf "/tmp/${TGZ_DIR}"
	mkdir -p "${VTE_ROOT}/cache/upload" "${VTE_ROOT}/cache/images" "${VTE_ROOT}/cache/vtlib" \
		"${VTE_ROOT}/storage" "${VTE_ROOT}/logs/cron" \
		"${VTE_ROOT}/Smarty/templates_c" "${VTE_ROOT}/cache_local/smarty" \
		"${VTE_ROOT}/user_privileges" "${VTE_ROOT}/custom_sdk"
else
	echo "File già presenti, skip extract."
fi

echo "=== 2) MySQL database e utente dedicato ==="
mysql_admin -e "CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
mysql_admin -e "CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';" 2>/dev/null || \
	mysql_admin -e "CREATE USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';"
mysql_admin -e "ALTER USER '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';" 2>/dev/null || true
mysql_admin -e "GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';"
mysql_admin -e "FLUSH PRIVILEGES;"

echo "=== 3) config.db.php ==="
cat >"${VTE_ROOT}/config.db.php" <<EOF
<?php
\$dbconfig['db_server'] = 'localhost';
\$dbconfig['db_port'] = ':3306';
\$dbconfig['db_sockpath'] = '';
\$dbconfig['db_username'] = '${DB_USER}';
\$dbconfig['db_password'] = '${DB_PASS}';
\$dbconfig['db_name'] = '${DB_NAME}';
\$dbconfig['db_type'] = 'mysqli';
\$dbconfig['db_bundled'] = 'false';
\$vtconfig['adminPwd'] = '${ADMIN_PASS}';
\$vtconfig['standarduserPwd'] = '${STD_PASS}';
\$vtconfig['adminEmail'] = '${ADMIN_EMAIL}';
\$vtconfig['standarduserEmail'] = '${STD_EMAIL}';
\$vtconfig['demoData'] = '0';
\$vtconfig['currencyName'] = 'Euro';
\$vtconfig['quickbuild'] = 'true';
EOF

echo "=== 4) Permessi (group www-data) ==="
chgrp -R www-data "$VTE_ROOT" 2>/dev/null || true
find "$VTE_ROOT" -type d -exec chmod 775 {} \;
find "$VTE_ROOT" -type f -exec chmod 664 {} \;
chmod +x "${VTE_ROOT}/cron/"*.sh 2>/dev/null || true

echo "=== 5) Schema VTE (CLI) ==="
if [[ -f "$INSTALL_DONE" ]]; then
	echo "Schema già installato, skip."
else
	php8.3 "${SCRIPT_DIR}/cli-install-vte-schema.php" "$VTE_ROOT" "$HOST"
	touch "$INSTALL_DONE"
fi

echo "=== 6) Patch config.inc.php ==="
CONFIG="${VTE_ROOT}/config.inc.php"
php8.3 -r "
\$f = file_get_contents('${CONFIG}');
\$f = preg_replace(\"/\\\$dbconfig\\['db_username'\\] = '[^']*';/\", \"\\\$dbconfig['db_username'] = '${DB_USER}';\", \$f);
\$f = preg_replace(\"/\\\$dbconfig\\['db_password'\\] = '[^']*';/\", \"\\\$dbconfig['db_password'] = '${DB_PASS}';\", \$f);
\$f = preg_replace(\"/\\\$dbconfig\\['db_name'\\] = '[^']*';/\", \"\\\$dbconfig['db_name'] = '${DB_NAME}';\", \$f);
\$f = preg_replace(\"#\\\$site_URL = '[^']*';#\", \"\\\$site_URL = '${SITE_URL}';\", \$f);
\$f = preg_replace(\"#\\\$root_directory = '[^']*';#\", \"\\\$root_directory = '${VTE_ROOT}/';\", \$f);
\$f = preg_replace(\"#\\\$PORTAL_URL = '[^']*';#\", \"\\\$PORTAL_URL = '${SITE_URL}/portal/v2';\", \$f);
\$f = preg_replace(\"#\\\$gdpr_URL = '[^']*';#\", \"\\\$gdpr_URL = '${SITE_URL}/gdpr';\", \$f);
\$f = preg_replace(\"/\\\$HELPDESK_SUPPORT_EMAIL_ID = '[^']*';/\", \"\\\$HELPDESK_SUPPORT_EMAIL_ID = 'vtedev@mypantarei.net';\", \$f);
\$f = preg_replace(\"/\\\$HELPDESK_SUPPORT_EMAIL_REPLY_ID = '[^']*';/\", \"\\\$HELPDESK_SUPPORT_EMAIL_REPLY_ID = 'vtedev@mypantarei.net';\", \$f);
\$f = preg_replace(\"/\\\$REMINDER_EMAIL_ID ='[^']*';/\", \"\\\$REMINDER_EMAIL_ID ='vtedev@mypantarei.net';\", \$f);
\$f = preg_replace(\"/\\\$application_unique_key = '[^']*';/\", \"\\\$application_unique_key = '${APP_KEY}';\", \$f);
\$f = preg_replace(\"/\\\$csrf_secret = '[^']*';/\", \"\\\$csrf_secret = '${CSRF_SECRET}';\", \$f);
file_put_contents('${CONFIG}', \$f);
"

echo "=== 7) Morphsuit disable ==="
php8.3 "${SCRIPT_DIR}/patch-morphsuit-disable.php" "$VTE_ROOT"

echo "=== 8) Upgrade 26.04 → 26.07 (build 3508) ==="
# vteUpdater rifiuta l'istanza se restano install/ o install.php
rm -rf "${VTE_ROOT}/install" "${VTE_ROOT}/install.php"
if [[ -f "$UPGRADE_DONE" ]]; then
	echo "Upgrade già fatto, skip."
else
	mkdir -p "${VTE_ROOT}/vte_updater/packages"
	cp -a "${UPDATER_SRC}/vte_updater/packages/vte3367-3508.tgz" "${VTE_ROOT}/vte_updater/packages/"
	cp -a "${UPDATER_SRC}/vte_updater/packages/vte3367-3508src.tgz" "${VTE_ROOT}/vte_updater/packages/"
	cp -a "${UPDATER_SRC}/vte_updater/packages/vte3367-3508del.tgz" "${VTE_ROOT}/vte_updater/packages/"
	cp -a "${UPDATER_SRC}/vteUpdater.sh" "${VTE_ROOT}/vteUpdater.sh"
	chmod 755 "${VTE_ROOT}/vteUpdater.sh"
	chgrp -R www-data "${VTE_ROOT}/vte_updater" "${VTE_ROOT}/vteUpdater.sh" 2>/dev/null || true

	cd "$VTE_ROOT"
	./vteUpdater.sh -b -d 3508 \
		--skip-file-check --skip-cron --skip-db-backup --skip-vte-backup \
		--upd-package=./vte_updater/packages/vte3367-3508.tgz \
		--src-package=./vte_updater/packages/vte3367-3508src.tgz \
		--del-package=./vte_updater/packages/vte3367-3508del.tgz \
		--www-user=pantarei:www-data \
		|| echo "WARN: vteUpdater exit non-zero, verifico versione..."

	php8.3 "${SCRIPT_DIR}/patch-morphsuit-disable.php" "$VTE_ROOT"

	VER=$(php8.3 -r 'include "'"${VTE_ROOT}"'/vteversion.php"; echo ($enterprise_current_version ?? "?")." build ".($enterprise_current_build ?? "?");')
	echo "Versione: ${VER}"
	if echo "$VER" | grep -q '3508'; then
		touch "$UPGRADE_DONE"
	else
		echo "ERR: upgrade non completato (atteso build 3508)." >&2
		exit 1
	fi
fi

echo "=== 9) Credenziali e docs ==="
cat >"$ENV_FILE" <<EOF
DB_NAME=${DB_NAME}
DB_USER=${DB_USER}
DB_PASS=${DB_PASS}
HOST=${HOST}
SITE_URL=${SITE_URL}
ADMIN_EMAIL=${ADMIN_EMAIL}
ADMIN_PASS=${ADMIN_PASS}
STD_EMAIL=${STD_EMAIL}
STD_PASS=${STD_PASS}
APP_KEY=${APP_KEY}
CSRF_SECRET=${CSRF_SECRET}
EOF
chmod 600 "$ENV_FILE"

CREDS_FILE="${SCRIPT_DIR}/vteaxess-db.cnf"
cat >"$CREDS_FILE" <<EOF
[client]
user=${DB_USER}
password=${DB_PASS}
database=${DB_NAME}
EOF
chmod 600 "$CREDS_FILE"

cat >"${SCRIPT_DIR}/SSL-VTEAXESS.md" <<EOF
# SSL / Apache VTE-Axess

Hostname: \`vte-axess.mypantarei.net\` (alias \`VTE-Axess.mypantarei.net\`)

## Completare provisioning root (una tantum)

\`\`\`bash
sudo bash /var/www/html/server-ops/mypantarei/install-vteaxess-root-finish.sh
\`\`\`

Abilita vhost HTTP, hosts, cron PHP 8.3, copia credenziali in \`/root/.vteaxess-db.cnf\`.

## Dopo DNS → HTTPS

\`\`\`bash
sudo certbot certonly --webroot -w /var/www/html/vteaxess -d vte-axess.mypantarei.net
sudo a2ensite vteaxess-le-ssl.conf
sudo apache2ctl configtest && sudo systemctl reload apache2
\`\`\`

Poi in \`config.inc.php\` imposta \`\$site_URL = 'https://vte-axess.mypantarei.net';\` (e PORTAL/gdpr).

**Non** redirigere tutto l'HTTP: l'Axess TMC X1 parla solo HTTP (path \`/modules/ControlloAccessi/axess/\`).
EOF

mkdir -p "${VTE_ROOT}/logs/cron"
touch "${VTE_ROOT}/logs/cron.log"

chgrp -R www-data "$VTE_ROOT" 2>/dev/null || true
touch "$FILES_DONE"

echo ""
echo "Fatto (parte non-root)."
echo "  Cartella:       ${VTE_ROOT}"
echo "  DB / user:      ${DB_NAME} / ${DB_USER}"
echo "  Password DB:    ${DB_PASS}"
echo "  Admin VTE:      admin / ${ADMIN_PASS}"
echo "  Env:            ${ENV_FILE}"
echo ""
echo "OBBLIGATORIO per vhost Apache:"
echo "  sudo bash ${SCRIPT_DIR}/install-vteaxess-root-finish.sh"