#!/usr/bin/env bash

set -Eeuo pipefail

WM_LOCAL_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WM_LOCAL_ROOT_DIR="$(cd "$WM_LOCAL_DEPLOY_DIR/.." && pwd)"
WM_LOCAL_INFRA_DIR="${WATERMAPS_INFRA_DIR:-$WM_LOCAL_ROOT_DIR/infra/opentofu}"

wm_local_die() {
  printf 'Fehler: %s\n' "$*" >&2
  exit 1
}

wm_local_resolve_ssh() {
  local requested_server="${1:-}"
  local requested_identity="${2:-}"

  WM_SERVER_IPV4="${requested_server:-${WATERMAPS_SERVER_IPV4:-}}"
  if [[ -z "$WM_SERVER_IPV4" ]]; then
    command -v tofu >/dev/null 2>&1 ||
      wm_local_die "OpenTofu fehlt und WATERMAPS_SERVER_IPV4 wurde nicht gesetzt."
    [[ -d "$WM_LOCAL_INFRA_DIR" ]] ||
      wm_local_die "OpenTofu-Verzeichnis fehlt: $WM_LOCAL_INFRA_DIR"
    WM_SERVER_IPV4="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw server_ipv4)"
  fi
  [[ "$WM_SERVER_IPV4" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ||
    wm_local_die "Ungültige Server-IPv4: $WM_SERVER_IPV4"

  WM_SSH_IDENTITY="${requested_identity:-${WATERMAPS_SSH_KEY:-}}"
  if [[ -z "$WM_SSH_IDENTITY" ]] && command -v tofu >/dev/null 2>&1 && [[ -d "$WM_LOCAL_INFRA_DIR" ]]; then
    candidate_identity="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw ssh_private_key_path 2>/dev/null || true)"
    if [[ -n "$candidate_identity" && -f "$candidate_identity" ]]; then
      WM_SSH_IDENTITY="$candidate_identity"
    fi
  fi
  if [[ -n "$WM_SSH_IDENTITY" && ! -f "$WM_SSH_IDENTITY" ]]; then
    wm_local_die "SSH-Keydatei nicht gefunden: $WM_SSH_IDENTITY"
  fi

  WM_SSH_USER="${WATERMAPS_SSH_USER:-deploy}"
  [[ "$WM_SSH_USER" =~ ^[a-z_][a-z0-9_-]{0,30}$ ]] ||
    wm_local_die "Ungültiger SSH-Benutzer: $WM_SSH_USER"
  if [[ -n "${WATERMAPS_REMOTE_SUDO+x}" ]]; then
    WM_REMOTE_SUDO="$WATERMAPS_REMOTE_SUDO"
  elif [[ "$WM_SSH_USER" == "root" ]]; then
    WM_REMOTE_SUDO=""
  else
    WM_REMOTE_SUDO="sudo"
  fi
  case "$WM_REMOTE_SUDO" in
    ""|sudo) ;;
    *) wm_local_die "WATERMAPS_REMOTE_SUDO darf nur leer oder 'sudo' sein." ;;
  esac

  WM_SSH_TARGET="$WM_SSH_USER@$WM_SERVER_IPV4"
  WM_SSH_OPTIONS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new)
  if [[ -n "$WM_SSH_IDENTITY" ]]; then
    WM_SSH_OPTIONS+=(-i "$WM_SSH_IDENTITY" -o IdentitiesOnly=yes)
  fi
}

wm_local_wait_for_ssh() {
  local timeout_seconds="${WATERMAPS_SSH_WAIT_SECONDS:-600}"
  local deadline=$((SECONDS + timeout_seconds))

  while ((SECONDS < deadline)); do
    if ssh "${WM_SSH_OPTIONS[@]}" \
      -o ConnectTimeout=5 \
      "$WM_SSH_TARGET" true >/dev/null 2>&1; then
      return 0
    fi
    printf '[watermaps] Warte auf SSH und Cloud-init-Benutzer %s …\n' "$WM_SSH_TARGET"
    sleep 5
  done

  wm_local_die "SSH war nach ${timeout_seconds}s nicht erreichbar: $WM_SSH_TARGET"
}