#!/usr/bin/env bash
set -e

DBPASS=$(grep ^DB_PASSWORD /var/www/html/mathapi/.env | cut -d= -f2-)

echo "=== Pulling vocab repo ==="
cd /var/www/html/vocabapi
git pull --ff-only 2>&1 | tail -3

echo ""
echo "=== composer install (no-dev) for firebase/php-jwt ==="
COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --optimize-autoloader --no-interaction --no-progress 2>&1 | tail -5

echo ""
echo "=== Fetching vocab's JWT secret from account.client_apps ==="
VOCAB_SECRET=$(mysql -uroot -p"$DBPASS" account -Nse "SELECT jwt_secret FROM client_apps WHERE slug='vocab';" 2>/dev/null)
if [ -z "$VOCAB_SECRET" ]; then
  echo "ERROR: no jwt_secret for vocab in account.client_apps"
  exit 1
fi
echo "Got secret (length=${#VOCAB_SECRET})"

echo ""
echo "=== Writing SSO_JWT_SECRET + SSO_ACCOUNT_URL to vocab .env ==="
# Replace if present, else append
if grep -q "^SSO_JWT_SECRET=" .env; then
  sed -i "s|^SSO_JWT_SECRET=.*|SSO_JWT_SECRET=${VOCAB_SECRET}|" .env
else
  printf "\n# SSO with account.allgifted.com (shared HS256 secret per app)\nSSO_JWT_SECRET=%s\nSSO_ACCOUNT_URL=https://account.allgifted.com\n" "$VOCAB_SECRET" >> .env
fi
grep -E "^SSO_" .env | sed -E 's/(SSO_JWT_SECRET)=.*/\1=<set>/'

echo ""
echo "=== Cache + reload ==="
php artisan config:cache 2>&1 | tail -1
chown -R www-data:www-data /var/www/html/vocabapi
systemctl reload apache2

echo ""
echo "=== Sanity: /api/sso/exchange route registered ==="
php artisan route:list --path=api/sso 2>&1 | tail -5