#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib.sh
. "${SCRIPT_DIR}/lib.sh"

qipai_emqx_install_or_update() {
  qipai_require_root_for_write
  qipai_check_arch

  if command -v mqttx >/dev/null 2>&1; then
    qipai_fail "MQTTX must not be installed on the production server"
    return 1
  fi

  export DEBIAN_FRONTEND=noninteractive
  apt-get update
  apt-get install -y curl ca-certificates gnupg lsb-release

  if ! command -v emqx >/dev/null 2>&1; then
    local installer
    installer="/tmp/install-emqx-deb.sh"
    curl -fsSL https://assets.emqx.com/scripts/install-emqx-deb.sh -o "$installer"
    bash -n "$installer"
    bash "$installer"
  fi

  apt-get update
  apt-get install -y emqx
  systemctl enable --now emqx
  qipai_pass "EMQX package installed/updated and service enabled"
  qipai_emqx_status
  qipai_info "Authentication users and secrets must be created from /etc/qipai/qipai.secrets; they are never printed here."
  qipai_info "Apply deploy/emqx/acl.conf.template only after creating qipai_backend_prod and device credentials."
}

qipai_emqx_manage() {
  qipai_emqx_status
  if command -v emqx >/dev/null 2>&1; then
    printf "输入 U 更新 EMQX，直接回车仅查看状态: "
  else
    printf "输入 I 安装 EMQX，直接回车仅查看状态: "
  fi
  local choice
  read -r choice || true
  case "${choice}" in
    I|i|U|u) qipai_emqx_install_or_update ;;
    "") qipai_info "EMQX status check complete; no package changes requested" ;;
    *) qipai_warn "unknown choice; no package changes made" ;;
  esac
}

qipai_emqx_status() {
  local acl_template authz_template
  acl_template="${SCRIPT_DIR}/../../deploy/emqx/acl.conf.template"
  authz_template="${SCRIPT_DIR}/../../deploy/emqx/authorization.hocon.template"

  qipai_info "EMQX target: native Ubuntu Apt package, no Docker"
  qipai_info "MQTT broker host: 101.42.38.246"
  qipai_info "MQTT protocol: MQTT 3.1.1 compatible, QoS 1 baseline"
  qipai_info "MQTTX on server: forbidden"
  qipai_info "ACL template: ${acl_template}"
  qipai_info "Authorization template: ${authz_template}"

  if command -v emqx >/dev/null 2>&1; then
    qipai_pass "emqx command exists: $(command -v emqx)"
    emqx version 2>/dev/null || true
    if command -v dpkg-query >/dev/null 2>&1; then
      dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' emqx 2>/dev/null || true
    fi
  else
    qipai_warn "emqx command not found"
  fi

  if command -v mosquitto_pub >/dev/null 2>&1; then
    qipai_pass "mosquitto-clients available"
  else
    qipai_warn "mosquitto-clients not installed"
  fi

  if command -v systemctl >/dev/null 2>&1; then
    systemctl is-enabled --quiet emqx 2>/dev/null && qipai_pass "emqx service enabled" || qipai_warn "emqx service not enabled or missing"
    systemctl is-active --quiet emqx 2>/dev/null && qipai_pass "emqx service active" || qipai_warn "emqx service inactive or missing"
  else
    qipai_warn "systemctl not available; service check skipped"
  fi

  for port in 1883 18083; do
    if command -v ss >/dev/null 2>&1; then
      ss -ltn "( sport = :${port} )" | grep -q ":${port}" && qipai_pass "port ${port} is listening" || qipai_warn "port ${port} is not listening"
    else
      qipai_warn "ss not available; port ${port} check skipped"
    fi
  done

  if command -v mqttx >/dev/null 2>&1; then
    qipai_fail "MQTTX is installed on the server; production policy forbids it"
  else
    qipai_pass "MQTTX is not installed on the server"
  fi

  [ -f "$acl_template" ] && qipai_pass "ACL template exists" || qipai_warn "ACL template not found"
  [ -f "$authz_template" ] && qipai_pass "authorization template exists" || qipai_warn "authorization template not found"

  qipai_info "manual install summary:"
  qipai_info "see deploy/emqx/install-ubuntu24-amd64.md"
}

if [ "${1:-}" = "--run" ]; then
  qipai_emqx_status
elif [ "${1:-}" = "--install" ]; then
  qipai_emqx_install_or_update
fi