#!/usr/bin/env bash
# Build and publish the production admin image in GitHub Actions.
# Build-time public variables are read from the VPS .env file and never logged.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

ADMIN_ENV_FILE="${ADMIN_ENV_FILE:?ADMIN_ENV_FILE is required}"
IMAGE_REPO="${IMAGE_REPO:?IMAGE_REPO is required}"
IMAGE_TAG="${IMAGE_TAG:?IMAGE_TAG is required}"

[[ -s "$ADMIN_ENV_FILE" ]] || {
  echo "Error: ADMIN_ENV_FILE is missing or empty: $ADMIN_ENV_FILE" >&2
  exit 1
}

# shellcheck disable=SC1090
set -a
source "$ADMIN_ENV_FILE"
set +a

env_or_empty() {
  local key="$1"
  printf '%s' "${!key-}"
}

# Loopback targets bake self-proxy rewrites into the image and peg a CPU core in Docker.
sanitize_api_proxy_target() {
  local target
  target="$(env_or_empty API_PROXY_TARGET)"
  case "$target" in
    *127.0.0.1*|*localhost*|*'::1'*)
      echo "Warning: refusing loopback API_PROXY_TARGET for production image build" >&2
      printf ''
      ;;
    *)
      printf '%s' "$target"
      ;;
  esac
}

BUILD_ARGS=(
  --build-arg "NEXT_PUBLIC_API_URL=$(env_or_empty NEXT_PUBLIC_API_URL)"
  --build-arg "NEXT_PUBLIC_FILE_SERVER_URL=$(env_or_empty NEXT_PUBLIC_FILE_SERVER_URL)"
  --build-arg "MAP_API_KEY=$(env_or_empty MAP_API_KEY)"
  --build-arg "NEXT_PUBLIC_MAP_API_KEY=$(env_or_empty NEXT_PUBLIC_MAP_API_KEY)"
  --build-arg "NEXT_PUBLIC_VAPID_PUBLIC_KEY=$(env_or_empty NEXT_PUBLIC_VAPID_PUBLIC_KEY)"
  --build-arg "NEXT_PUBLIC_BASE_PATH=$(env_or_empty NEXT_PUBLIC_BASE_PATH)"
  --build-arg "NEXT_PUBLIC_SITE_URL=$(env_or_empty NEXT_PUBLIC_SITE_URL)"
  --build-arg "NEXT_PUBLIC_OBSERVABILITY_ENDPOINT=$(env_or_empty NEXT_PUBLIC_OBSERVABILITY_ENDPOINT)"
  --build-arg "NEXT_PUBLIC_SENTRY_DSN=$(env_or_empty NEXT_PUBLIC_SENTRY_DSN)"
  --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=$(env_or_empty NEXT_PUBLIC_SENTRY_ENVIRONMENT)"
  --build-arg "NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE=$(env_or_empty NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)"
  --build-arg "NEXT_PUBLIC_ARCAPTCHA_SITE_KEY=$(env_or_empty NEXT_PUBLIC_ARCAPTCHA_SITE_KEY)"
  --build-arg "SENTRY_AUTH_TOKEN=$(env_or_empty SENTRY_AUTH_TOKEN)"
  --build-arg "SENTRY_ORG=$(env_or_empty SENTRY_ORG)"
  --build-arg "SENTRY_PROJECT=$(env_or_empty SENTRY_PROJECT)"
  --build-arg "API_PROXY_TARGET=$(sanitize_api_proxy_target)"
)

echo "Building ${IMAGE_REPO}:${IMAGE_TAG} (build arguments redacted)"
docker buildx build \
  --platform linux/amd64 \
  --push \
  -t "${IMAGE_REPO}:${IMAGE_TAG}" \
  -t "${IMAGE_REPO}:main" \
  "${BUILD_ARGS[@]}" \
  .