#!/bin/bash
set -e

export PATH=$PATH:/usr/local/bin:/usr/bin:/bin

# ==================================================
# CodeDeploy BeforeInstall
# Cleanup old deployment + fetch AWS secrets
# ==================================================

APP_PATH="/var/www/html/api"
SECRET_PATH="$APP_PATH/storage"
SECRET_FILE="$SECRET_PATH/db_secret.json"
REGION="ap-south-1"

# Secret ARNs
PROD_SECRET="arn:aws:secretsmanager:ap-south-1:840620226347:secret:emis_prod_write_db-tJKkxe"
READ1_SECRET="arn:aws:secretsmanager:ap-south-1:840620226347:secret:emis_prod_read_replica_1-jm1GZD"
ATTD_READ_SECRET="arn:aws:secretsmanager:ap-south-1:840620226347:secret:attendance_read_db-7XqOt2"
ATTD_WRITE_SECRET="arn:aws:secretsmanager:ap-south-1:840620226347:secret:attendance_write_db-uXlfyc"

echo "======================================="
echo "Starting deployment pre-install script"
echo "======================================="

# --------------------------------------------------
# Validate AWS CLI
# --------------------------------------------------

if ! command -v aws >/dev/null 2>&1; then
    echo "AWS CLI not installed"
    exit 1
fi

echo "AWS CLI found"

# --------------------------------------------------
# Cleanup old deployment
# --------------------------------------------------

if [ -d "$APP_PATH" ]; then

    echo "Cleaning old deployment..."

    rm -rf "$APP_PATH/application" || true
    rm -rf "$APP_PATH/system" || true
    rm -f "$APP_PATH/index.php" || true
    rm -f "$APP_PATH/.htaccess" || true

    echo "Old deployment removed."

else
    echo "Creating application directory..."
    mkdir -p "$APP_PATH"
fi

# --------------------------------------------------
# Create storage folder
# --------------------------------------------------

mkdir -p "$SECRET_PATH"

# --------------------------------------------------
# Fetch AWS Secrets
# --------------------------------------------------

echo "Fetching AWS Secrets..."

PROD=$(aws secretsmanager get-secret-value \
--secret-id "$PROD_SECRET" \
--region "$REGION" \
--query SecretString \
--output text)

READ1=$(aws secretsmanager get-secret-value \
--secret-id "$READ1_SECRET" \
--region "$REGION" \
--query SecretString \
--output text)

ATTD_READ=$(aws secretsmanager get-secret-value \
--secret-id "$ATTD_READ_SECRET" \
--region "$REGION" \
--query SecretString \
--output text)

ATTD_WRITE=$(aws secretsmanager get-secret-value \
--secret-id "$ATTD_WRITE_SECRET" \
--region "$REGION" \
--query SecretString \
--output text)

# --------------------------------------------------
# Create local secret file
# --------------------------------------------------

cat > "$SECRET_FILE" <<EOF
{
  "prod": $PROD,
  "read1": $READ1,
  "attd_read": $ATTD_READ,
  "attd_write": $ATTD_WRITE
}
EOF

chmod 600 "$SECRET_FILE"
chown www-data:www-data "$SECRET_FILE" || true

echo "Secrets saved to:"
echo "$SECRET_FILE"

echo "BeforeInstall completed successfully."