#!/usr/bin/env bash
# Scaffold the AGS Account Laravel app on the droplet.
# Idempotent: bails if /var/www/html/account already exists.
set -e

cd /var/www/html

DBPASS=$(grep ^DB_PASSWORD /var/www/html/mathapi/.env | cut -d= -f2-)
MAILPASS=$(grep ^MAIL_PASSWORD /var/www/html/mathapi/.env | cut -d= -f2-)

echo "=== Create MySQL DB ==="
mysql -uroot -p"$DBPASS" -e "CREATE DATABASE IF NOT EXISTS account CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" 2>/dev/null
mysql -uroot -p"$DBPASS" -Nse "SHOW DATABASES;" 2>/dev/null | grep -E "^(api|account|vocab)$"

echo ""
echo "=== composer create-project laravel/laravel /var/www/html/account ==="
if [ -d /var/www/html/account ]; then
  echo "account/ already exists — skipping create-project. Run rm -rf to redo."
else
  COMPOSER_ALLOW_SUPERUSER=1 composer create-project laravel/laravel /var/www/html/account --prefer-dist --no-interaction --no-progress 2>&1 | tail -10
fi

cd /var/www/html/account

echo ""
echo "=== Adding firebase/php-jwt + filament v6 ==="
COMPOSER_ALLOW_SUPERUSER=1 composer require firebase/php-jwt filament/filament --no-interaction --no-progress 2>&1 | tail -10

echo ""
echo "=== Writing .env ==="
cat > .env <<ENVFILE
APP_NAME="AGS Account"
APP_ENV=production
APP_KEY=
APP_DEBUG=false
APP_TIMEZONE=UTC
APP_URL=https://account.allgifted.com

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
APP_MAINTENANCE_STORE=database

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_LEVEL=warning

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=account
DB_USERNAME=root
DB_PASSWORD=${DBPASS}

SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_DOMAIN=null

CACHE_STORE=database
QUEUE_CONNECTION=database
FILESYSTEM_DISK=local

MAIL_MAILER=smtp
MAIL_HOST=smtp.gmail.com
MAIL_PORT=587
MAIL_USERNAME=ace.allgifted@gmail.com
MAIL_PASSWORD=${MAILPASS}
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=ace.allgifted@gmail.com
MAIL_FROM_NAME="AGS Account"

# SSO global secret — used to sign session JWTs (account ↔ apps).
# Per-app JWTs use the secret stored in apps.jwt_secret.
SSO_ROOT_SECRET=
ENVFILE

php artisan key:generate --force 2>&1 | tail -1

# Generate a long random SSO_ROOT_SECRET (used by SsoTokenService for the
# session JWT issued to the user before they pick an app).
SSO_SEC=$(openssl rand -hex 48)
sed -i "s|^SSO_ROOT_SECRET=.*|SSO_ROOT_SECRET=${SSO_SEC}|" .env

echo ""
echo "=== Ownership + perms ==="
chown -R www-data:www-data /var/www/html/account
chmod -R 775 storage bootstrap/cache

echo ""
echo "=== Sanity ==="
php artisan --version
php artisan about 2>&1 | head -25 || true