#!/usr/bin/env bash
# deploy/setup.sh
# One-command installer for the trading system on Ubuntu 22.04 (DigitalOcean)
# Run as root:  bash <(curl -fsSL https://setup.apexaitrade.com/install.sh)
set -euo pipefail

APP_DIR="/opt/trading_system"
SERVICE_USER="trading"
NODE_VERSION="20"
LICENSE_API="https://license.apexaitrade.com"
DASHBOARD_IMAGE="ghcr.io/apex-ai-trading/dashboard:latest"

# ── Parse CLI arguments ───────────────────────────────────────────────────
LICENSE_KEY=""
DOMAIN=""
DB_PASSWORD=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --license)    LICENSE_KEY="$2";     shift 2 ;;
    --domain)     DOMAIN="$2";          shift 2 ;;
    --db-password) DB_PASSWORD="$2";    shift 2 ;;
    *) shift ;;
  esac
done

# ── Helpers ───────────────────────────────────────────────────────────────
bold()  { echo -e "\033[1m$*\033[0m"; }
info()  { echo -e "  \033[36m→\033[0m $*"; }
ok()    { echo -e "  \033[32m✓\033[0m $*"; }
err()   { echo -e "  \033[31m✗\033[0m $*" >&2; }
prompt() {
  # prompt <varname> <label> [default] [secret]
  local var="$1" label="$2" default="${3:-}" secret="${4:-}"
  local value=""
  while [ -z "$value" ]; do
    if [ -n "$secret" ]; then
      printf "  ${label}: " >/dev/tty
      value=""
      while IFS= read -r -s -n1 char </dev/tty; do
        if [[ $char == $'\0' || $char == $'\n' ]]; then break; fi
        if [[ $char == $'\177' || $char == $'\b' ]]; then
          if [ ${#value} -gt 0 ]; then
            value="${value%?}"
            printf '\b \b' >/dev/tty
          fi
        else
          value+="$char"
          printf '*' >/dev/tty
        fi
      done
      echo >/dev/tty
    else
      read -rp "  ${label}${default:+ [$default]}: " value </dev/tty
      value="${value:-$default}"
    fi
    [ -z "$value" ] && err "This field is required."
  done
  printf -v "$var" '%s' "$value"
}

echo ""
echo "═══════════════════════════════════════════════"
bold "  Trading System — Setup"
echo "═══════════════════════════════════════════════"
echo ""

# ── Previous installation check ───────────────────────────────────────────
PREV_FOUND=()
[ -d "$APP_DIR" ]                                          && PREV_FOUND+=("App directory: $APP_DIR")
[ -f /etc/systemd/system/trading-system.service ]         && PREV_FOUND+=("Systemd service: trading-system")
sudo -u postgres psql -tc \
  "SELECT 1 FROM pg_database WHERE datname='trading_system'" \
  2>/dev/null | grep -q 1                                 && PREV_FOUND+=("PostgreSQL database: trading_system")
docker ps -a --format '{{.Names}}' 2>/dev/null \
  | grep -q '^apex-dashboard$'                            && PREV_FOUND+=("Docker container: apex-dashboard")

if [ ${#PREV_FOUND[@]} -gt 0 ]; then
  echo "  ⚠️  Existing installation detected:"
  for item in "${PREV_FOUND[@]}"; do echo "      • $item"; done
  echo ""
  echo "  [1] Fresh install — wipe everything and start clean (all data will be lost)"
  echo "  [2] Exit — leave the existing installation untouched"
  echo ""
  read -rp "  Your choice [1/2]: " _WIPE_CHOICE </dev/tty
  echo ""

  if [ "${_WIPE_CHOICE}" != "1" ]; then
    info "Exiting — existing installation unchanged."
    exit 0
  fi

  read -rp "  Type YES to confirm wipe: " _WIPE_CONFIRM </dev/tty
  echo ""
  if [ "${_WIPE_CONFIRM}" != "YES" ]; then
    info "Aborted — existing installation unchanged."
    exit 0
  fi

  bold "  Wiping previous installation…"
  systemctl stop    trading-system                      2>/dev/null || true
  systemctl disable trading-system                      2>/dev/null || true
  rm -f /etc/systemd/system/trading-system.service
  systemctl daemon-reload                               2>/dev/null || true
  sudo -u postgres psql -c "DROP DATABASE IF EXISTS trading_system;" 2>/dev/null || true
  sudo -u postgres psql -c "DROP USER     IF EXISTS trading;"        2>/dev/null || true
  rm -rf "$APP_DIR"
  docker stop apex-dashboard                            2>/dev/null || true
  docker rm   apex-dashboard                            2>/dev/null || true
  rm -f /etc/nginx/sites-enabled/trading-system
  rm -f /etc/nginx/sites-available/trading-system
  ok "Previous installation wiped"
  echo ""
fi

# ── Step 1: Collect all user input upfront ────────────────────────────────
bold "Step 1/8 — Configuration"
echo ""

[ -n "${LICENSE_KEY:-}" ] && ok "License key provided via --license flag" || prompt LICENSE_KEY "License key"
[ -n "${DB_PASSWORD:-}" ] && ok "DB password provided via --db-password flag" || prompt DB_PASSWORD "Set a Postgres DB password (we create the DB for you)" "" secret
if [ -n "${DOMAIN:-}" ]; then
  ok "Domain provided via --domain flag"
else
  SERVER_IP_HINT=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || echo "")
  echo "  Enter your domain name or server IP for nginx/SSL."
  echo "  Examples:  trading.yourdomain.com   OR   ${SERVER_IP_HINT:-165.22.106.143}"
  echo "  Do NOT include https:// — just the bare domain or IP."
  echo ""
  echo "  ⚠️  If using a domain (not an IP), you must first add a DNS A record"
  if [ -n "$SERVER_IP_HINT" ]; then
    echo "      pointing to this server: ${SERVER_IP_HINT}"
  else
    echo "      pointing to this server's public IP."
  fi
  echo "      SSL setup will fail if the record does not exist yet."
  echo "      Cloudflare users: set the record to 'DNS only' (grey cloud) — the"
  echo "      orange proxy hides the real IP and will cause certbot to fail."
  echo "      (It is fine to use an IP address instead — SSL can be added later.)"
  echo ""
  prompt DOMAIN "Your domain or IP"
fi
# Validate domain — reject anything with @ or :// which indicates user pasted a URL or email
if echo "$DOMAIN" | grep -qE '[@://]'; then
  err "Invalid domain: '${DOMAIN}'"
  err "Enter just the bare domain or IP — e.g. trading.yourdomain.com or 165.22.106.143"
  exit 1
fi
echo ""

# ── Step 2: Validate license key ──────────────────────────────────────────
bold "Step 2/8 — Validating license key…"
HTTP_STATUS=$(curl -s -o /tmp/license_resp.json -w "%{http_code}" \
  -X POST "${LICENSE_API}/activate" \
  -H "Content-Type: application/json" \
  -d "{\"key\":\"${LICENSE_KEY}\",\"machine_id\":\"$(curl -s ifconfig.me)\"}" || echo "000")

if [ "$HTTP_STATUS" != "200" ]; then
  err "License validation failed (status: ${HTTP_STATUS})."
  err "Check your key or contact support@apexaitrade.com"
  exit 1
fi

LICENSE_TOKEN=$(python3 -c "import json,sys; print(json.load(open('/tmp/license_resp.json'))['token'])" 2>/dev/null || echo "")
LICENSE_TIER=$(python3 -c "import json,sys; print(json.load(open('/tmp/license_resp.json'))['tier'])" 2>/dev/null || echo "starter")
ok "License valid — tier: ${LICENSE_TIER}"
echo ""

# ── Step 3: System packages ───────────────────────────────────────────────
bold "Step 3/8 — Installing system packages…"
apt-get update -qq
apt-get install -y curl nginx ufw postgresql postgresql-contrib
ok "Packages installed"
echo ""

# ── Step 3b: Docker ───────────────────────────────────────────────────────
bold "Step 3b/8 — Installing Docker…"
if ! command -v docker &>/dev/null; then
  curl -fsSL https://get.docker.com | sh >/dev/null
  systemctl enable --now docker
fi
ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
echo ""

# ── Step 4: Node.js ───────────────────────────────────────────────────────
bold "Step 4/8 — Node.js…"
if ! command -v node &>/dev/null || [[ "$(node -v)" != v${NODE_VERSION}* ]]; then
  curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - >/dev/null
  apt-get install -y nodejs >/dev/null
fi
ok "Node $(node -v) | npm $(npm -v)"
echo ""

# ── Step 5: Postgres database ─────────────────────────────────────────────
bold "Step 5/8 — Setting up database…"
DB_NAME="trading_system"
DB_USER="trading"

sudo -u postgres psql -tc "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}'" | grep -q 1 || \
  sudo -u postgres psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
sudo -u postgres psql -tc "SELECT 1 FROM pg_database WHERE datname='${DB_NAME}'" | grep -q 1 || \
  sudo -u postgres createdb -O "${DB_USER}" "${DB_NAME}"
ok "Database '${DB_NAME}' ready"
echo ""

# ── Step 6: Download and install application ──────────────────────────────
bold "Step 6/8 — Installing application…"
if ! id "$SERVICE_USER" &>/dev/null; then
  useradd --system --no-create-home --shell /usr/sbin/nologin "$SERVICE_USER"
fi
# Allow trading user to manage Docker containers (needed for dashboard updates)
usermod -aG docker "$SERVICE_USER" 2>/dev/null || true

mkdir -p "$APP_DIR"
info "Downloading trading system from license server…"
if [ -z "$LICENSE_TOKEN" ]; then
  err "No license token received from license server. Contact support@apexaitrade.com"
  exit 1
fi
HTTP_DL=$(curl -s -o /tmp/trading-system.tar.gz -w "%{http_code}" \
  "${LICENSE_API}/download?token=${LICENSE_TOKEN}")
if [ "$HTTP_DL" != "200" ]; then
  err "Download failed (status: ${HTTP_DL}). Contact support@apexaitrade.com"
  exit 1
fi
tar -xzf /tmp/trading-system.tar.gz -C "$APP_DIR"
rm -f /tmp/trading-system.tar.gz
cd "$APP_DIR"
npm ci --omit=dev --silent
ok "Trading system installed"

# Run DB schema migration (creates all tables on first install)
info "Running database migrations…"
DB_HOST=localhost DB_PORT=5432 DB_NAME="$DB_NAME" DB_USER="$DB_USER" DB_PASSWORD="$DB_PASSWORD" \
  node scripts/migrate-to-db.js
ok "Database schema ready"

info "Downloading dashboard image from license server…"
HTTP_IMG=$(curl -s -o /tmp/dashboard.tar.gz -w "%{http_code}" \
  "${LICENSE_API}/download/dashboard?token=${LICENSE_TOKEN}")
if [ "$HTTP_IMG" != "200" ]; then
  err "Dashboard image download failed (status: ${HTTP_IMG}). Contact support@apexaitrade.com"
  exit 1
fi
docker load < /tmp/dashboard.tar.gz
rm -f /tmp/dashboard.tar.gz

DASHBOARD_IMAGE=$(docker images --format '{{.Repository}}:{{.Tag}}' | grep 'apex-dashboard' | head -1)
[ -z "$DASHBOARD_IMAGE" ] && DASHBOARD_IMAGE="apex-dashboard:latest"

docker stop apex-dashboard 2>/dev/null || true
docker rm   apex-dashboard 2>/dev/null || true
# Use http for bare IPs (no SSL cert), https for real domains
if echo "$DOMAIN" | grep -qP '^(\d{1,3}\.){3}\d{1,3}$'; then
  DASHBOARD_SCHEME="http"
else
  DASHBOARD_SCHEME="https"
fi
docker run -d \
  --name apex-dashboard \
  --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  -e APEX_API_URL="${DASHBOARD_SCHEME}://${DOMAIN}" \
  "$DASHBOARD_IMAGE"
ok "Dashboard container running"
echo ""

# ── Step 7: Write config files ────────────────────────────────────────────
bold "Step 7/8 — Writing configuration…"
mkdir -p "$APP_DIR/data" "$APP_DIR/accounts"

# Seed static data files — these are not included in the release tarball
# (data/*.json is excluded to avoid overwriting live server state on updates)
# but they must exist on fresh installs so services start correctly.
cat > "$APP_DIR/data/early-mover-watchlist.json" <<'SEEDEOF'
{
  "Integrated Oil & Gas":         ["HAL", "DVN", "MRO", "SLB", "BKR", "XOM", "CVX", "COP", "EOG"],
  "Copper Miners":                ["FCX", "SCCO"],
  "Agricultural Commodities":     ["MOS", "NTR", "CF"],
  "Defense & Aerospace":          ["LMT", "RTX", "NOC", "GD"],
  "Industrial Machinery":         ["EMR", "GVA", "TEX", "ETN", "CAT", "DE"],
  "Freight & Logistics":          ["UNP", "CSX", "JBHT", "XPO"],
  "Semiconductor Equipment":      ["AMAT", "LRCX", "KLAC"],
  "Steel & Specialty Metals":     ["NUE", "STLD", "RS"],
  "Homebuilders":                 ["DHI", "LEN", "PHM"],
  "Mortgage REITs":               ["AGNC", "NLY"],
  "Home Improvement Retail":      ["HD", "LOW"],
  "Title Insurance":              ["FAF", "FNF"],
  "SaaS / High-Multiple Tech":    ["NOW", "CRWD", "DDOG"],
  "Regional Banks":               ["WAL", "WTFC", "HBAN"],
  "Community & Regional Banks":   ["WAL", "WTFC", "HBAN"],
  "Life Insurance":               ["MET", "PRU", "AFL"],
  "Mortgage Originators":         ["PFSI", "RKT", "UWM"],
  "Utilities":                    ["NEE", "DUK", "SO"],
  "Regulated Utilities":          ["NEE", "AEP", "XEL"],
  "Consumer Staples (food & beverage)": ["PG", "KO", "GIS"],
  "Domestic Consumer Staples":    ["WMT", "COST", "CLX"],
  "Managed Care / Pharma":        ["UNH", "CVS", "MCK"],
  "US-Revenue Healthcare":        ["HCA", "THC", "CCRN"],
  "US-Focused Regional Banks":    ["WAL", "WTFC", "HBAN"],
  "Essential Retail":             ["WMT", "COST", "DG"],
  "Discount & Dollar Stores":     ["DG", "DLTR", "FIVE"],
  "Pharma / Generic Drug Makers": ["PFE", "AMGN", "MRK"],
  "Waste Management":             ["WM", "RSG", "CWST"],
  "Gold Miners":                  ["NEM", "AEM", "WPM"],
  "Copper Producers":             ["FCX", "SCCO"],
  "Emerging Market Exporters":    ["EEM", "VWO"],
  "Dividend Aristocrats":         ["JNJ", "PG", "KO"],
  "Low-Beta Blue Chips":          ["JNJ", "PG", "MMM"],
  "Covered Call Candidates in Defensives": ["JNJ", "PG", "KO"],
  "Short-Duration Investment Grade": []
}
SEEDEOF

# Write license token so the service doesn't call /activate on first boot
MACHINE_ID=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || hostname)
cat > "$APP_DIR/data/license-token.json" <<EOF
{"token":"${LICENSE_TOKEN}","machine_id":"${MACHINE_ID}","activatedAt":"$(date -u +%Y-%m-%dT%H:%M:%SZ)"}
EOF

# Generate a random session secret
SESSION_SECRET=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 48 || true)

cat > "$APP_DIR/.env" <<EOF
# Database
DB_HOST=localhost
DB_PORT=5432
DB_NAME=${DB_NAME}
DB_USER=${DB_USER}
DB_PASSWORD=${DB_PASSWORD}

# License
LICENSE_KEY=${LICENSE_KEY}
LICENSE_TOKEN=${LICENSE_TOKEN}
LICENSE_TIER=${LICENSE_TIER}

# Dashboard
DASHBOARD_ORIGIN=${DASHBOARD_SCHEME}://${DOMAIN}
APEX_API_URL=${DASHBOARD_SCHEME}://${DOMAIN}
SESSION_SECRET=${SESSION_SECRET}
EOF
chown "$SERVICE_USER:$SERVICE_USER" "$APP_DIR/.env"
chmod 640 "$APP_DIR/.env"

# Nginx — start with HTTP-only config first; certbot will upgrade to SSL
cat > /etc/nginx/sites-available/trading-system <<NGINXEOF
server {
    listen 80;
    server_name ${DOMAIN};

    location /api/ {
        proxy_pass         http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_buffering    off;
        proxy_cache        off;
        proxy_read_timeout 86400s;
        proxy_set_header   Host              \$host;
        proxy_set_header   X-Real-IP         \$remote_addr;
        proxy_set_header   X-Forwarded-For   \$proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto \$scheme;
    }

    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header   Host              \$host;
        proxy_set_header   X-Real-IP         \$remote_addr;
        proxy_set_header   X-Forwarded-For   \$proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto \$scheme;
    }
}
NGINXEOF
ln -sf /etc/nginx/sites-available/trading-system /etc/nginx/sites-enabled/trading-system
rm -f /etc/nginx/sites-enabled/default
systemctl enable --now nginx
nginx -t && systemctl reload nginx

# SSL via certbot (skip if domain looks like a bare IP)
if echo "$DOMAIN" | grep -qP '^(\d{1,3}\.){3}\d{1,3}$'; then
  info "Domain is an IP address — skipping SSL. Accessible over HTTP only."
else
  # Pre-check: domain must resolve before certbot can validate
  SERVER_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || echo "")
  RESOLVED_IP=$(getent hosts "$DOMAIN" 2>/dev/null | awk '{print $1}' || true)
  if [ -z "$RESOLVED_IP" ]; then
    info "⚠️  DNS for ${DOMAIN} does not resolve — skipping SSL."
    info "   Add an A record pointing ${DOMAIN} → ${SERVER_IP:-<this server IP>}"
    info "   Then re-run: certbot --nginx -d ${DOMAIN} --agree-tos -m admin@apexaitrade.com --redirect"
  elif [ -n "$SERVER_IP" ] && [ "$RESOLVED_IP" != "$SERVER_IP" ]; then
    info "⚠️  ${DOMAIN} resolves to ${RESOLVED_IP} but this server is ${SERVER_IP} — skipping SSL."
    info "   If you are using Cloudflare: set the DNS record to 'DNS only' (grey cloud)"
    info "   before running certbot. Proxied records hide the real IP and fail validation."
    info "   Once the certificate is issued you can re-enable the proxy."
    info "   Then re-run: certbot --nginx -d ${DOMAIN} --agree-tos -m admin@apexaitrade.com --redirect"
  else
    if ! command -v certbot &>/dev/null; then
      apt-get install -y certbot python3-certbot-nginx -qq
    fi
    certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos -m "admin@apexaitrade.com" --redirect || \
      info "certbot failed — continuing with HTTP. Re-run: certbot --nginx -d ${DOMAIN} --agree-tos -m admin@apexaitrade.com --redirect"
  fi
fi

# Allow trading user to restart its own service (needed for wizard completion and Update Now)
echo "${SERVICE_USER} ALL=(ALL) NOPASSWD: /bin/systemctl restart trading-system, /bin/systemctl reload trading-system" \
  > /etc/sudoers.d/trading-restart
chmod 440 /etc/sudoers.d/trading-restart

# Permissions
chown -R "$SERVICE_USER:$SERVICE_USER" "$APP_DIR"
chmod 640 "$APP_DIR/.env"

# Systemd
cp "$APP_DIR/deploy/trading-system.service" /etc/systemd/system/trading-system.service
systemctl daemon-reload
systemctl enable trading-system

ok "Configuration written"
echo ""

# ── Step 8: Start service ─────────────────────────────────────────────────
bold "Step 8/8 — Starting service…"
systemctl start trading-system
sleep 3

if systemctl is-active --quiet trading-system; then
  ok "Service running"
else
  err "Service failed to start. Check: journalctl -u trading-system -n 50"
  exit 1
fi
echo ""

# ── Notify license server (triggers install-complete email) ───────────────
echo ""
info "Sending install confirmation…"
curl -s -o /dev/null \
  -X POST "${LICENSE_API}/install-complete" \
  -H "Content-Type: application/json" \
  -d "{\"token\":\"${LICENSE_TOKEN}\",\"domain\":\"${DOMAIN}\"}" || true

# ── Done ──────────────────────────────────────────────────────────────────
echo "═══════════════════════════════════════════════"
bold "  Infrastructure setup complete!"
echo ""
ok "Service running: journalctl -u trading-system -f"
ok "Tier:            ${LICENSE_TIER}"
echo ""
bold "  Next step — complete setup in your dashboard"
echo ""
info "Open your browser and visit:"
info ""
info "  ${DASHBOARD_SCHEME}://${DOMAIN}"
info ""
info "The setup wizard will guide you through:"
info "  • Connecting your Alpaca account"
info "  • Setting your dashboard login credentials"
info "  • Choosing trading modules"
info "  • Configuring risk parameters"
info "  • (Optional) Telegram notifications"
echo ""
info "A confirmation email has been sent to your account."
echo "═══════════════════════════════════════════════"