#!/bin/bash -eu
# =============================================================================
# migration.sh — WireGuard Go → FastAPI migration
# Run as Linux user (not root). Asks for sudo once.
# =============================================================================
if [ "$EUID" -eq 0 ]; then
    echo "[X] Run as your Linux user, not root: bash migration.sh"
    exit 1
fi

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
sudo chown -R "$USER:$USER" "$SCRIPT_DIR" 2>/dev/null || true
OPERATOR_DIR="$HOME/operator-docker"
BACKUP_DIR="$HOME/.wg-migration"
LOG="$BACKUP_DIR/migration.log"
REPO_URL="git@git.simplifiedprivacy.com:zenaku/operator-docker.git"
TOTAL_STEPS=4

# ─── Borrow UI from operator-docker if available, else minimal fallback ───────
if [ -f "$OPERATOR_DIR/lib/ui.sh" ]; then
    source "$OPERATOR_DIR/lib/ui.sh"
    source "$OPERATOR_DIR/lib/log.sh"
    source "$OPERATOR_DIR/lib/steps.sh"
else
    RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RESET='\033[0m'
    ok()   { echo -e "${GREEN}[OK]${RESET} $1";   [ -f "$LOG" ] && echo "[OK] $1" >> "$LOG"; }
    info() { echo -e "${CYAN}[i]${RESET} $1";    [ -f "$LOG" ] && echo "[i] $1"  >> "$LOG"; }
    warn() { echo -e "${YELLOW}[!]${RESET} $1";  [ -f "$LOG" ] && echo "[!] $1"  >> "$LOG"; }
    print_header()  { echo ""; echo "  $1 $2"; echo ""; }
    print_section() { echo -e "\n${CYAN}─── $1 ───${RESET}"; }
    log_ok()    { ok "$1"; }
    log_info()  { info "$1"; }
    log_warn()  { warn "$1"; }
    log_error() { echo -e "${RED}[X]${RESET} $1"; [ -f "$LOG" ] && echo "[X] $1" >> "$LOG"; }
fi

fail() { log_error "$1"; exit 1; }

mkdir -p "$BACKUP_DIR"
: > "$LOG" 2>/dev/null || true

print_header "WireGuard Migration" "v1.0"

# ─── SUDO once ────────────────────────────────────────────────────────────────
info "Requesting sudo credentials (used throughout migration)..."
sudo -v || fail "sudo required. Check your permissions."
ok "Sudo credentials cached."

# ─── STEP 1: Backup (go-legacy stays running) ────────────────────────────────
print_section "Step 1/$TOTAL_STEPS — Backup WireGuard identity & peers"

[ -f "$BACKUP_DIR/private_key" ] && ok "Backup already exists — skipping step 1." || {
    info "Running backup (sudo required)..."
    sudo bash "$SCRIPT_DIR/steps/00-backup.sh" || fail "Backup failed."
}

# ─── STEP 2: SSH + Clone operator-docker ─────────────────────────────────────
print_section "Step 2/$TOTAL_STEPS — Verify SSH & Clone operator-docker"

[ -f "$HOME/.ssh/id_ed25519" ] || fail "SSH key not found. Run step 1 first (00-backup.sh generates it)."

SSH_TEST=$(GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10' \
    ssh -T git@git.simplifiedprivacy.com 2>&1 || true)

if echo "$SSH_TEST" | grep -qiE "Welcome|successfully authenticated"; then
    ok "SSH access authorized."
else
    warn "SSH not authorized. Share this key with Simplified Privacy:"
    echo ""
    cat "$HOME/.ssh/id_ed25519.pub"
    echo ""
    fail "Once authorized, run again: bash migration.sh"
fi

if [ -d "$OPERATOR_DIR" ]; then
    warn "operator-docker already exists — skipping clone."
else
    info "Cloning operator-docker..."
    GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' \
        git clone "$REPO_URL" "$OPERATOR_DIR" || fail "Could not clone repository."
    ok "Cloned to $OPERATOR_DIR"
fi

# Re-source UI from freshly cloned repo (better version)
if [ -f "$OPERATOR_DIR/lib/ui.sh" ]; then
    source "$OPERATOR_DIR/lib/ui.sh"
    source "$OPERATOR_DIR/lib/log.sh"
    source "$OPERATOR_DIR/lib/steps.sh"
fi
fail() { log_error "$1"; exit 1; }

# ─── STEP 3: Install operator-docker (preflight runs inside as step 3) ───────
print_section "Step 3/$TOTAL_STEPS — Install operator-docker"

[ -f "$OPERATOR_DIR/.env" ] && ok ".env exists — skipping install." || {
    info "Running installer..."
    cd "$OPERATOR_DIR"
    sudo systemctl start nginx 2>/dev/null || true
    echo "$HOME" > /tmp/.migration_home
    sudo MIGRATION_MODE=1 bash install.sh || { rm -f /tmp/.migration_home; fail "Installer failed."; }
    rm -f /tmp/.migration_home
    ok "operator-docker installed."
}

# ─── STEP 4: Migrate peers & identity (shuts down go-legacy here) ────────────
sudo chown -R "$USER:$USER" "$OPERATOR_DIR"
print_section "Step 4/$TOTAL_STEPS — Migrate WireGuard identity & peers"

# Use sg to activate docker group without requiring re-login.
if sg docker -c "docker info &>/dev/null" 2>/dev/null; then
    sg docker -c "bash '$SCRIPT_DIR/steps/02-peers.sh'" || fail "Peer migration failed."
else
    bash "$SCRIPT_DIR/steps/02-peers.sh" || fail "Peer migration failed."
fi

echo ""
echo "========================================="
echo "  Migration complete"
echo "  Log: cat $LOG"
echo "========================================="