#!/usr/bin/env bash
set -euo pipefail

ROOT="${CAMP_DEPLOY_ROOT:-/var/www/camps}"
CONFIG="${CAMP_CONFIG:-/etc/camp-deploy/camps.json}"
SAFE_RE='^[a-z0-9][a-z0-9-]{0,62}$'

fail() {
  echo "camp-deploy: $*" >&2
  exit 1
}

resolve_path() {
  python3 -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$1"
}

camp_is_known() {
  python3 - "$CONFIG" "$1" <<'PY'
import json
import sys

path, slug = sys.argv[1], sys.argv[2]
try:
    with open(path, "r", encoding="utf-8") as f:
        data = json.load(f)
except OSError:
    data = {"camps": [{"slug": "ai-game-sh"}, {"slug": "ai-game-sz"}]}

sys.exit(0 if any(camp.get("slug") == slug for camp in data.get("camps", [])) else 1)
PY
}

if [[ "${1:-}" == "--is-known-camp" ]]; then
  [[ "${2:-}" =~ $SAFE_RE ]] || exit 1
  camp_is_known "$2"
  exit $?
fi

camp="${1:-}"
username="${2:-}"
project="${3:-}"

[[ "$camp" =~ $SAFE_RE ]] || fail "invalid camp"
[[ "$username" =~ $SAFE_RE ]] || fail "invalid username"
if [[ -n "$project" ]]; then
  [[ "$project" =~ $SAFE_RE ]] || fail "invalid project"
fi

camp_is_known "$camp" || fail "unknown camp: $camp"

camp_root="$ROOT/$camp"
target="$camp_root/$username"
if [[ -n "$project" ]]; then
  target="$target/$project"
fi

mkdir -p "$camp_root"
base="$camp_root"
for segment in "$username" ${project:+"$project"}; do
  if [[ -L "$base/$segment" ]]; then
    fail "refusing symlink path component: $base/$segment"
  fi
  base="$base/$segment"
done

mkdir -p "$target"

resolved_root="$(resolve_path "$camp_root")"
resolved_target="$(resolve_path "$target")"
case "$resolved_target" in
  "$resolved_root"|"$resolved_root"/*) ;;
  *) fail "target escapes camp root" ;;
esac

if find "$resolved_target" -type f \( -name '.env' -o -name '.env.*' \) -print -quit | grep -q .; then
  fail "refusing to publish .env files"
fi

if [[ ! -f "$resolved_target/index.html" ]]; then
  echo "warning: index.html not found in $resolved_target" >&2
fi

chgrp -R www-data "$resolved_target" 2>/dev/null || true
chmod -R u+rwX,g+rX,o-rwx "$resolved_target"
echo "published: $resolved_target"
