#!/usr/bin/env bash
# Send deploy notification from VPS (Telegram creds from /opt/ghabilee-backend/.env).
# GitHub runners may not reach api.telegram.org; VPS can.
set -euo pipefail

: "${SSH_KEY:?SSH_KEY required}"
: "${VPS_HOST:?VPS_HOST required}"
: "${VPS_USER:?VPS_USER required}"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REMOTE_DIR="/tmp/ghabilee-notify-$$"
COMMIT_SUBJECT_B64="$(printf '%s' "${DEPLOY_COMMIT_SUBJECT:-}" | base64 | tr -d '\n')"

install -m 700 -d "$HOME/.ssh"
printf '%s\n' "$SSH_KEY" > "$HOME/.ssh/vps_key"
chmod 600 "$HOME/.ssh/vps_key"
trap 'rm -f "$HOME/.ssh/vps_key"' EXIT

SSH_OPTS=(-i "$HOME/.ssh/vps_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new)
SCP_OPTS=("${SSH_OPTS[@]}")

ssh "${SSH_OPTS[@]}" "${VPS_USER}@${VPS_HOST}" "mkdir -p '${REMOTE_DIR}'"
scp "${SCP_OPTS[@]}" \
  "${SCRIPT_DIR}/notify-ops-telegram.sh" \
  "${SCRIPT_DIR}/notify-deploy.sh" \
  "${VPS_USER}@${VPS_HOST}:${REMOTE_DIR}/"

ssh "${SSH_OPTS[@]}" "${VPS_USER}@${VPS_HOST}" \
  "DEPLOY_SHA='${DEPLOY_SHA:-}' DEPLOY_STATUS='${DEPLOY_STATUS:-success}' DEPLOY_VERSION='${DEPLOY_VERSION:-}' COMMIT_SUBJECT_B64='${COMMIT_SUBJECT_B64}' REMOTE_DIR='${REMOTE_DIR}' sh -s" <<'REMOTE'
set -eu
if [ -n "${COMMIT_SUBJECT_B64:-}" ]; then
  DEPLOY_COMMIT_SUBJECT="$(printf '%s' "$COMMIT_SUBJECT_B64" | base64 -d 2>/dev/null || true)"
  export DEPLOY_COMMIT_SUBJECT
fi
set -a
if [ -s /opt/ghabilee-backend/.env ]; then
  # shellcheck disable=SC1091
  . /opt/ghabilee-backend/.env
elif [ -s /opt/ghabilee/backend/.env ]; then
  # shellcheck disable=SC1091
  . /opt/ghabilee/backend/.env
fi
set +a
export DEPLOY_SHA DEPLOY_STATUS DEPLOY_COMMIT_SUBJECT DEPLOY_VERSION
chmod +x "${REMOTE_DIR}/notify-ops-telegram.sh" "${REMOTE_DIR}/notify-deploy.sh"
bash "${REMOTE_DIR}/notify-deploy.sh"
rm -rf "${REMOTE_DIR}"
REMOTE