#!/bin/sh
set -eu

SERVER_IP="${1:?SERVER_IP is required}"
REMOTE_DIR="${2:-/opt/caiwuxitong}"
SOURCE_CONFIG="$REMOTE_DIR/host-nginx-8442-dingtalk.conf"
TARGET_CONFIG="/etc/nginx/conf.d/caiwuxitong-backend-8442.conf"
BACKUP_DIR="$REMOTE_DIR/backups/nginx-dingtalk-callback-$(date +%Y%m%d-%H%M%S)"

if [ "$(id -u)" -ne 0 ]; then
    echo "configure-dingtalk-callback.sh must run as root" >&2
    exit 1
fi

if [ "$SERVER_IP" != "218.93.190.75" ]; then
    echo "Refusing to configure an unexpected server IP: $SERVER_IP" >&2
    exit 1
fi

test -s "$SOURCE_CONFIG"
test -s "$TARGET_CONFIG"
test -s /etc/nginx/caiwu-jiansuntuzhi-fullchain.pem
test -s /etc/nginx/caiwu-jiansuntuzhi.key

install -d -m 700 "$BACKUP_DIR"
install -m 600 "$TARGET_CONFIG" "$BACKUP_DIR/caiwuxitong-backend-8442.conf"
install -m 644 "$SOURCE_CONFIG" "$TARGET_CONFIG"

if ! nginx -t; then
    install -m 644 "$BACKUP_DIR/caiwuxitong-backend-8442.conf" "$TARGET_CONFIG"
    nginx -t
    echo "Nginx validation failed; the previous configuration was restored." >&2
    exit 1
fi

systemctl reload nginx

probe="$(curl -sS -o /dev/null -w '%{http_code} %{redirect_url}' --max-time 15 \
    "http://$SERVER_IP:8442/auth/dingtalk/callback?state=configuration-probe")"
status="${probe%% *}"
redirect_url="${probe#* }"
expected_redirect="https://caiwu.jiansuntuzhi.cn:8442/auth/dingtalk/callback?state=configuration-probe"

if [ "$status" != "302" ] || [ "$redirect_url" != "$expected_redirect" ]; then
    install -m 644 "$BACKUP_DIR/caiwuxitong-backend-8442.conf" "$TARGET_CONFIG"
    nginx -t
    systemctl reload nginx
    echo "DingTalk HTTP callback probe failed with status $status and redirect $redirect_url; the previous configuration was restored." >&2
    exit 1
fi

echo "DINGTALK_HTTP_CALLBACK_READY=http://$SERVER_IP:8442/auth/dingtalk/callback"
echo "NGINX_BACKUP=$BACKUP_DIR/caiwuxitong-backend-8442.conf"