#!/usr/bin/env bash

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TRANSPORT_LIB="${SCRIPT_DIR}/lib/transport.sh"
DEFAULT_REMOTE_DIR="/opt/security-center/enterprise/rendered"

# shellcheck disable=SC1090
source "${TRANSPORT_LIB}"

usage() {
  cat <<'EOF'
Enterprise deployment diagnose helper.

Usage:
  ./scripts/enterprise/diagnose-enterprise.sh --instance-id i-0123456789abcdef0

Options:
  --transport <mode>      Optional. ssm (default) or ssh.
  --instance-id <id>      Required for ssm unless provided by caller/env.
  --host <user@host>      Required for ssh.
  --remote-dir <path>     Optional. Default: /opt/security-center/enterprise/rendered
  --identity-file <path>  Optional. SSH private key for ssh mode.
  --region <name>         AWS region for ssm mode.
  --profile <name>        AWS CLI profile override.
  --dry-run               Print remote diagnose actions without executing them.
  --help                  Show this help.
EOF
}

die() {
  echo "ERROR: $*" >&2
  exit 1
}

TRANSPORT="ssm"
INSTANCE_ID=""
REMOTE_HOST=""
REMOTE_DIR="${DEFAULT_REMOTE_DIR}"
IDENTITY_FILE=""
AWS_REGION_NAME="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}"
AWS_PROFILE_NAME="${AWS_PROFILE:-}"
DRY_RUN="false"

while (($# > 0)); do
  case "$1" in
    --transport)
      TRANSPORT="$2"
      shift 2
      ;;
    --instance-id)
      INSTANCE_ID="$2"
      shift 2
      ;;
    --host)
      REMOTE_HOST="$2"
      shift 2
      ;;
    --remote-dir)
      REMOTE_DIR="$2"
      shift 2
      ;;
    --identity-file)
      IDENTITY_FILE="$2"
      shift 2
      ;;
    --region)
      AWS_REGION_NAME="$2"
      shift 2
      ;;
    --profile)
      AWS_PROFILE_NAME="$2"
      shift 2
      ;;
    --dry-run)
      DRY_RUN="true"
      shift
      ;;
    --help|-h)
      usage
      exit 0
      ;;
    *)
      die "unknown argument: $1"
      ;;
  esac
done

case "${TRANSPORT}" in
  ssm)
    [[ -n "${INSTANCE_ID}" ]] || die "--instance-id is required for --transport ssm"
    [[ -n "${AWS_REGION_NAME}" ]] || die "--region is required for --transport ssm"
    ;;
  ssh)
    [[ -n "${REMOTE_HOST}" ]] || die "--host is required for --transport ssh"
    ;;
  *)
    die "unsupported transport: ${TRANSPORT}"
    ;;
esac

SC_TRANSPORT_MODE="${TRANSPORT}"
SC_TRANSPORT_DRY_RUN="${DRY_RUN}"
SC_TRANSPORT_REMOTE_HOST="${REMOTE_HOST}"
SC_TRANSPORT_INSTANCE_ID="${INSTANCE_ID}"
SC_TRANSPORT_IDENTITY_FILE="${IDENTITY_FILE}"
SC_TRANSPORT_AWS_REGION="${AWS_REGION_NAME}"
SC_TRANSPORT_AWS_PROFILE="${AWS_PROFILE_NAME}"
sc_transport_init

sc_transport_run "set -euo pipefail
echo '== compose status =='
cd '${REMOTE_DIR}' && docker compose --env-file .env.runtime -f docker-compose.enterprise.yml ps || true
echo
echo '== runtime env summary =='
grep -E '^(SC_PUBLIC_HOSTNAME|SC_ALLOWED_ORIGIN|SC_AUTH0_CALLBACK_URL|SC_AUTH0_DOMAIN|SC_AUTH0_ALLOWED_WEB_ORIGIN|SC_AUTH0_ALLOWED_LOGOUT_URL|SC_BYPASS_SSO|SC_OAUTH_ENABLED|SC_NEXT_PUBLIC_SSO_PROVIDER)=' .env.runtime || true
echo
echo '== nginx callback/origin summary =='
grep -E 'server_name|proxy_pass|X-Forwarded-Proto|X-Forwarded-Host' nginx-security-center.conf || true
echo
echo '== health probes =='
curl -I -s http://127.0.0.1/ | head -n 5 || true
curl -I -s https://127.0.0.1/ -k | head -n 5 || true
echo
echo '== recent container logs =='
docker compose --env-file .env.runtime -f docker-compose.enterprise.yml logs --tail=60 nginx frontend backend mysql redis || true
"