#!/usr/bin/env bash
set -euo pipefail

HOST="${STUDIO_HOST:-58.38.22.103}"
STABLE_DIR="${STUDIO_REMOTE_ROOT:-/Users/john/Project}/Memind"
PORTAL_CANDIDATE_LABEL="cn.tkmind.memind-portal-candidate"
CANARY_PROXY_LABEL="cn.tkmind.memind-canary-proxy"
CANARY_TUNNEL_LABEL="cn.tkmind.memind-canary-tunnel"
EDGE_HOST="${MEMIND_CANARY_EDGE_HOST:-ssh105-public}"
CANARY_TUNNEL_REMOTE_PORT=19082
EDGE_MOBILE_CONFIG="/etc/nginx/conf.d/m.tkmind.cn.conf"
EDGE_WECHAT_CONFIG="/etc/nginx/conf.d/wechat.m.tkmind.cn.conf"
AUTO_YES=0

if [[ "${1:-}" == "--yes" || "${1:-}" == "-y" ]]; then
  AUTO_YES=1
elif [[ $# -gt 0 ]]; then
  echo "Usage: bash scripts/rollback-portal-canary-prod.sh [--yes]" >&2
  exit 1
fi

if [[ "${AUTO_YES}" -ne 1 ]]; then
  echo "This restores both 105 nginx upstreams to stable Portal 8081 and stops only canary services."
  read -r -p "Continue with 103 canary rollback? [y/N] " confirm </dev/tty
  [[ "${confirm}" =~ ^[Yy]$ ]] || exit 0
fi

ssh -o BatchMode=yes -o ConnectTimeout=15 "${HOST}" \
  "STABLE_DIR='${STABLE_DIR}' \
   PORTAL_CANDIDATE_LABEL='${PORTAL_CANDIDATE_LABEL}' \
   CANARY_PROXY_LABEL='${CANARY_PROXY_LABEL}' \
   CANARY_TUNNEL_LABEL='${CANARY_TUNNEL_LABEL}' \
   EDGE_HOST='${EDGE_HOST}' \
   CANARY_TUNNEL_REMOTE_PORT='${CANARY_TUNNEL_REMOTE_PORT}' \
   EDGE_MOBILE_CONFIG='${EDGE_MOBILE_CONFIG}' \
   EDGE_WECHAT_CONFIG='${EDGE_WECHAT_CONFIG}' \
   /bin/bash" <<'REMOTE'
set -euo pipefail

LAUNCHD_GUI="gui/$(id -u)"
ssh -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" /bin/bash <<EDGE_ROLLBACK
set -euo pipefail
for config in '${EDGE_MOBILE_CONFIG}' '${EDGE_WECHAT_CONFIG}'; do
  canary_count="\$(grep -cF 'proxy_pass http://127.0.0.1:${CANARY_TUNNEL_REMOTE_PORT};' "\${config}" || true)"
  stable_count_before="\$(grep -cF 'proxy_pass http://58.38.22.103:8081;' "\${config}" || true)"
  if [[ "\${canary_count}" -eq 0 ]]; then
    [[ "\${stable_count_before}" -gt 0 ]]
    continue
  fi
  temp_config="\$(mktemp "\${config}.stable.XXXXXX")"
  sed 's#proxy_pass http://127\.0\.0\.1:${CANARY_TUNNEL_REMOTE_PORT};#proxy_pass http://58.38.22.103:8081;#g' \
    "\${config}" > "\${temp_config}"
  stable_count="\$(grep -cF 'proxy_pass http://58.38.22.103:8081;' "\${temp_config}")"
  [[ "\${stable_count}" -eq \$(( stable_count_before + canary_count )) ]]
  chown root:root "\${temp_config}"
  chmod 0644 "\${temp_config}"
  mv "\${temp_config}" "\${config}"
done
nginx -t
systemctl reload nginx
curl -kfsS --max-time 15 \
  --resolve m.tkmind.cn:443:127.0.0.1 \
  https://m.tkmind.cn/api/status >/dev/null
curl -kfsS --max-time 15 \
  --resolve wechat.m.tkmind.cn:443:127.0.0.1 \
  https://wechat.m.tkmind.cn/api/status >/dev/null
EDGE_ROLLBACK

launchctl bootout "${LAUNCHD_GUI}/${CANARY_TUNNEL_LABEL}" >/dev/null 2>&1 || true
launchctl bootout "${LAUNCHD_GUI}/${CANARY_PROXY_LABEL}" >/dev/null 2>&1 || true
launchctl bootout "${LAUNCHD_GUI}/${PORTAL_CANDIDATE_LABEL}" >/dev/null 2>&1 || true
/opt/homebrew/bin/docker rm -f goosed-prod-canary >/dev/null 2>&1 || true
rm -f "${STABLE_DIR}/.release-drain"

curl -fsS http://127.0.0.1:8081/api/status >/dev/null
printf 'stable_port=8081\n'
printf 'edge_upstream=58.38.22.103:8081\n'
REMOTE

echo "103 canary rollback completed; stable Portal remains active on 8081."