#!/bin/sh
set -eu

bucket=""
endpoint=""
dry_run=false
version_out=""

usage() {
  cat <<'EOF'
Usage: reconcile-installer-r2.sh --bucket BUCKET --endpoint HTTPS_URL [--dry-run] [--version-out FILE]

Validates vastora/current.json, protects every object referenced by it, and
deletes only stale objects below the exact vastora/releases/ prefix.
EOF
}

while [ "$#" -gt 0 ]; do
  case "$1" in
    --bucket) bucket="${2:-}"; shift 2 ;;
    --endpoint) endpoint="${2:-}"; shift 2 ;;
    --dry-run) dry_run=true; shift ;;
    --version-out) version_out="${2:-}"; shift 2 ;;
    -h|--help) usage; exit 0 ;;
    *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
  esac
done

case "$bucket" in *[!a-z0-9.-]*|'') echo "R2 bucket name is invalid." >&2; exit 2 ;; esac
case "$endpoint" in https://*.r2.cloudflarestorage.com) ;; *) echo "R2 endpoint must use the Cloudflare HTTPS endpoint." >&2; exit 2 ;; esac
for required in awk aws basename cmp grep jq mktemp sha256sum sort split tr wc; do
  if ! command -v "$required" >/dev/null 2>&1; then
    echo "Required command is not installed: $required" >&2
    exit 1
  fi
done

current_key="vastora/current.json"
release_root="vastora/releases/"
temporary_dir="$(mktemp -d "${TMPDIR:-/tmp}/vastora-r2-reconcile.XXXXXX")"
cleanup() { rm -rf "$temporary_dir"; }
trap cleanup EXIT HUP INT TERM

aws_r2() {
  aws --cli-connect-timeout 10 --cli-read-timeout 60 s3api "$@" --endpoint-url "$endpoint" --no-cli-pager
}

validate_manifest() {
  manifest_path="$1"
  manifest_version="$(jq -er '.version | strings' "$manifest_path")"
  if ! printf '%s' "$manifest_version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
    echo "R2 current release pointer contains an invalid version." >&2
    return 1
  fi
  manifest_prefix="vastora/releases/v$manifest_version/"
  if ! jq -e --arg version "$manifest_version" --arg prefix "$manifest_prefix" '
    (.schema == 1) and (.version == $version) and
    (.centerImage | test("^ghcr\\.io/petauron/vastora-center@sha256:[0-9a-f]{64}$")) and
    ((.assets | keys | sort) == ["install.sh", "vastora-center-install.tar.gz", "vastora-center-install.tar.gz.sha256"]) and
    (.assets["install.sh"].key == ($prefix + "install.sh")) and
    (.assets["vastora-center-install.tar.gz"].key == ($prefix + "vastora-center-install.tar.gz")) and
    (.assets["vastora-center-install.tar.gz.sha256"].key == ($prefix + "vastora-center-install.tar.gz.sha256")) and
    (all(.assets[]; .sha256 | test("^[0-9a-f]{64}$")))
  ' "$manifest_path" >/dev/null; then
    echo "R2 current release pointer is invalid." >&2
    return 1
  fi
  printf '%s\n' "$manifest_version"
}

verify_remote_digest() {
  key="$1"
  expected_digest="$2"
  actual_digest="$(aws_r2 head-object --bucket "$bucket" --key "$key" --query 'Metadata.sha256' --output text 2>/dev/null || true)"
  if [ "$actual_digest" != "$expected_digest" ]; then
    echo "Protected R2 object is missing or has mismatched metadata: $key" >&2
    return 1
  fi
}

list_keys() {
  output="$1"
  : > "$output"
  continuation=""
  page_number=0
  while :; do
    page_number=$((page_number + 1))
    page="$temporary_dir/list-$page_number.json"
    if [ -n "$continuation" ]; then
      aws_r2 list-objects-v2 --bucket "$bucket" --prefix "$release_root" --max-keys 1000 --continuation-token "$continuation" > "$page"
    else
      aws_r2 list-objects-v2 --bucket "$bucket" --prefix "$release_root" --max-keys 1000 > "$page"
    fi
    if ! jq -e 'all(.Contents[]?;
      (.Key | type == "string") and
      (.Key | test("^vastora/releases/[A-Za-z0-9._/-]+$")) and
      (.Key | contains("//") | not) and
      (.Key | split("/") | all(. != "" and . != "." and . != ".."))
    )' "$page" >/dev/null; then
      echo "R2 listing contains an unsafe or out-of-scope object key." >&2
      return 1
    fi
    jq -r '.Contents[]?.Key' "$page" >> "$output"
    if [ "$(jq -r '.IsTruncated // false' "$page")" != "true" ]; then
      break
    fi
    continuation="$(jq -er '.NextContinuationToken | strings | select(length > 0)' "$page")"
  done
  sort -u "$output" -o "$output"
}

current_manifest="$temporary_dir/current.json"
aws_r2 get-object --bucket "$bucket" --key "$current_key" "$current_manifest" >/dev/null
version="$(validate_manifest "$current_manifest")"
prefix="vastora/releases/v$version"
manifest_key="$prefix/manifest.json"
activated_key="$prefix/activated.json"

for asset in install.sh vastora-center-install.tar.gz vastora-center-install.tar.gz.sha256; do
  asset_key="$(jq -r --arg asset "$asset" '.assets[$asset].key' "$current_manifest")"
  asset_digest="$(jq -r --arg asset "$asset" '.assets[$asset].sha256' "$current_manifest")"
  verify_remote_digest "$asset_key" "$asset_digest"
done
manifest_digest="$(sha256sum "$current_manifest" | awk 'NR == 1 {print tolower($1)}')"
verify_remote_digest "$current_key" "$manifest_digest"
verify_remote_digest "$manifest_key" "$manifest_digest"
verify_remote_digest "$activated_key" "$manifest_digest"
for key in "$manifest_key" "$activated_key"; do
  copy="$temporary_dir/$(basename "$key")"
  aws_r2 get-object --bucket "$bucket" --key "$key" "$copy" >/dev/null
  if ! cmp -s "$current_manifest" "$copy"; then
    echo "Protected R2 release manifest differs from vastora/current.json: $key" >&2
    exit 1
  fi
done

expected="$temporary_dir/expected-keys"
# The current pointer is read and verified separately. Listing and deletion
# must never include sibling namespaces such as the independent app catalog.
{
  printf '%s\n' "$manifest_key" "$activated_key"
  jq -r '.assets[].key' "$current_manifest"
} | sort -u > "$expected"
if [ "$(wc -l < "$expected" | tr -d ' ')" != "5" ]; then
  echo "R2 current release does not resolve to exactly five protected release objects." >&2
  exit 1
fi

listed="$temporary_dir/listed-keys"
list_keys "$listed"
while IFS= read -r protected; do
  if ! grep -Fxq "$protected" "$listed"; then
    echo "Protected R2 object is absent from the Vastora listing: $protected" >&2
    exit 1
  fi
done < "$expected"

stale="$temporary_dir/stale-keys"
: > "$stale"
while IFS= read -r key; do
  if grep -Fxq "$key" "$expected"; then
    continue
  fi
  case "$key" in
    vastora/releases/*) printf '%s\n' "$key" >> "$stale" ;;
    *) echo "Unexpected object outside the managed Vastora release prefix: $key" >&2; exit 1 ;;
  esac
done < "$listed"
sort -u "$stale" -o "$stale"

if [ -n "$version_out" ]; then
  printf '%s\n' "$version" > "$version_out"
fi
if [ "$dry_run" = true ]; then
  while IFS= read -r key; do
    [ -n "$key" ] && printf 'Would delete: %s\n' "$key"
  done < "$stale"
  echo "Dry run protected Vastora $version and found $(wc -l < "$stale" | tr -d ' ') stale object(s)."
  exit 0
fi

if [ -s "$stale" ]; then
  batches="$temporary_dir/delete-batch-"
  split -l 1000 -d -a 6 "$stale" "$batches"
  for batch in "$batches"*; do
    pointer_check="$batch-current.json"
    aws_r2 get-object --bucket "$bucket" --key "$current_key" "$pointer_check" >/dev/null
    if ! cmp -s "$current_manifest" "$pointer_check"; then
      echo "R2 current release pointer changed during cleanup; refusing deletion." >&2
      exit 1
    fi
    request="$batch-request.json"
    response="$batch-response.json"
    jq -R -s '{Objects: (split("\n") | map(select(length > 0) | {Key: .})), Quiet: false}' "$batch" > "$request"
    aws_r2 delete-objects --bucket "$bucket" --delete "file://$request" > "$response"
    if ! jq -e '((.Errors // []) | length) == 0' "$response" >/dev/null; then
      jq -r '.Errors[] | "R2 delete failed for \(.Key): \(.Code): \(.Message)"' "$response" >&2
      exit 1
    fi
  done
fi

post_delete="$temporary_dir/post-delete-keys"
list_keys "$post_delete"
if ! cmp -s "$expected" "$post_delete"; then
  echo "R2 reconciliation left unexpected or missing Vastora objects." >&2
  exit 1
fi
final_pointer="$temporary_dir/final-current.json"
aws_r2 get-object --bucket "$bucket" --key "$current_key" "$final_pointer" >/dev/null
if ! cmp -s "$current_manifest" "$final_pointer"; then
  echo "R2 current release pointer changed during reconciliation." >&2
  exit 1
fi
echo "Reconciled R2 release objects for Vastora $version and preserved its current pointer."