#!/usr/bin/env bash
# Load Telegram credentials from the Iran VPS .env, then send from this host.
#
# Why not notify on the VPS?
# - Iran egress often cannot reach api.telegram.org
# - Sourcing the full backend .env breaks on cron globs (BOOKING_EXPIRY_CRON=*)
#
# Gitea act_runner (foreign) can reach Telegram; we only SSH to fetch TELEGRAM_* keys.
set -euo pipefail

: "${SSH_KEY:?SSH_KEY required}"
: "${VPS_HOST:?VPS_HOST required}"
: "${VPS_USER:?VPS_USER required}"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
EXTRACTOR="${SCRIPT_DIR}/extract-telegram-env.py"

install -m 700 -d "$HOME/.ssh"
printf '%s\n' "$SSH_KEY" > "$HOME/.ssh/vps_key"
chmod 600 "$HOME/.ssh/vps_key"
trap 'rm -f "$HOME/.ssh/vps_key"' EXIT

SSH_OPTS=(-i "$HOME/.ssh/vps_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new)
REMOTE_EXTRACT="/tmp/ghabilee-extract-telegram-env-$$.py"

scp "${SSH_OPTS[@]}" "$EXTRACTOR" "${VPS_USER}@${VPS_HOST}:${REMOTE_EXTRACT}"

while IFS= read -r line; do
  [[ -z "$line" || "$line" != TELEGRAM_*=* ]] && continue
  key="${line%%=*}"
  value="${line#*=}"
  export "${key}=${value}"
done < <(ssh "${SSH_OPTS[@]}" "${VPS_USER}@${VPS_HOST}" "python3 '${REMOTE_EXTRACT}'; rm -f '${REMOTE_EXTRACT}'")

if [[ -z "${TELEGRAM_BOT_TOKEN:-}" ]]; then
  echo "[ghabilee-admin-notify] failed: TELEGRAM_BOT_TOKEN missing on VPS" >&2
  exit 1
fi
if [[ -z "${TELEGRAM_GROUP_CHAT_ID:-}${TELEGRAM_CHAT_ID:-}" ]]; then
  echo "[ghabilee-admin-notify] failed: no Telegram chat id on VPS" >&2
  exit 1
fi

chmod +x "${SCRIPT_DIR}/notify-ops-telegram.sh" "${SCRIPT_DIR}/notify-deploy.sh"
# Run on the Actions runner (foreign) — not on the Iran VPS.
bash "${SCRIPT_DIR}/notify-deploy.sh"