#!/bin/bash
# ==============================================================================================
# ========================= Upgrade Webhook Handler ============================================
# ==============================================================================================
#
# PURPOSE
# ─────────────────────────────────────────────────────────────────────────────
# Triggered by Sonarr/Radarr/Lidarr OnUpgrade webhook (via webhook_listener.js).
# Pushes the upgraded item folder to every other mesh node immediately, then
# triggers a library rescan on each remote arr so it accepts the new file as
# ground truth without initiating a redundant quality search.
#
# Closes the propagation window: without this, a remote node that already has
# the 720p copy will see the 1080p tagged in arr_sync but not on disk and
# begin searching — a search it will never win because we already have it.
#
# ==============================================================================================
# DESIGN PRINCIPLES
# ==============================================================================================
#
# Closes the Propagation Window
#   arr_sync runs every 4 hours. Without this handler, a remote node that already
#   has the old version sees the upgrade tagged in arr_sync but the new file not
#   yet on disk, and initiates a redundant quality search — a search it will never
#   win because this host already has the file. Immediate push eliminates that window.
#
# Rescan as Ground Truth
#   Pushing the file is not enough — the remote arr must also be told the file
#   exists. Triggering a rescan makes the remote accept the pushed file as the
#   current version without starting a new search.
#
# Cache-First API Key Lookup
#   Remote arr API keys are read from conf if cached; otherwise fetched via SSH
#   from the remote's config.xml. This avoids storing secrets redundantly while
#   keeping API calls fast on hosts where the key is already known.
#
# ==============================================================================================
# OPERATIONAL SAFEGUARDS
# ==============================================================================================
#
#   Arg validation      — exits with usage message if arr_type or item_path missing
#   Path existence      — exits if item_path is not a directory on disk
#   Tailscale resolution — skips a node if its Tailscale IP cannot be resolved
#   rsync exit check    — rescan is only triggered if rsync succeeded; a failed
#                         transfer does not cause the remote arr to scan a partial file
#   SSH fallback        — if no cached API key, falls back to SSH to read config.xml
#                         on the remote rather than failing the rescan step
#
# ==============================================================================================
# CONFIGURATION
# ==============================================================================================
#
# host*.conf
#
#   HOST*                      — host names used to discover remote nodes
#   HOST*_SONARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#   HOST*_RADARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#   HOST*_LIDARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#
# master.conf
#
#   SSH_KEY                    — SSH key path for rsync and SSH fallback
#   ARR_SYNC_CONNECT_TIMEOUT   — SSH connect timeout in seconds
#   DOCKER_APPDATA_BASE        — base path for reading arr config.xml on remote
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
# upgrade_webhook_handler.sh <arr_type> <item_path>
#
#   arr_type   — sonarr | radarr | lidarr
#   item_path  — absolute path to the series/movie/artist folder on local disk
#                (series.path from Sonarr, movie.folderPath from Radarr,
#                 artist.path from Lidarr)
#
# Called by webhook_listener.js — not intended for direct invocation outside testing.
#
# ==============================================================================================

set -uo pipefail

ARR_TYPE="${1:-}"
ITEM_PATH="${2:-}"

[[ -z "$ARR_TYPE" || -z "$ITEM_PATH" ]] && {
    echo "Usage: upgrade_webhook_handler.sh <arr_type> <item_path>" >&2
    exit 1
}

[[ -d "$ITEM_PATH" ]] || { echo "Path not found: $ITEM_PATH" >&2; exit 1; }

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../load_config.sh"
detect_hosts

# ── Arr type → API port / version / rescan command ───────────────────────────────────────────
case "$ARR_TYPE" in
    sonarr) PORT=8989; API_VER="v3"; RESCAN_CMD="RefreshSeries" ;;
    radarr) PORT=7878; API_VER="v3"; RESCAN_CMD="RefreshMovie"  ;;
    lidarr) PORT=8686; API_VER="v1"; RESCAN_CMD="RefreshArtist" ;;
    *)      echo "Unknown arr type: $ARR_TYPE" >&2; exit 1 ;;
esac

# ── Remote node list ──────────────────────────────────────────────────────────────────────────
discover_remote_nodes

if [[ "${#REMOTE_NODES[@]}" -eq 0 ]]; then
    echo "No remote nodes configured — nothing to push"
    exit 0
fi

ENCODED=$(printf '{"name":"%s"}' "$RESCAN_CMD" | base64 -w0)
ITEM_NAME=$(basename "$ITEM_PATH")

echo "[$(date '+%H:%M:%S')] Upgrade push: ${ARR_TYPE} — ${ITEM_NAME}"
echo "  Path: $ITEM_PATH"
echo "  Targets: ${REMOTE_NODES[*]}"

NODE_FAIL=0

# ── Push and rescan each remote ───────────────────────────────────────────────────────────────
for node_id in "${REMOTE_NODES[@]}"; do
    node_name="${!node_id}"
    node_ip=$(resolve_tailscale_ip "$node_name") || {
        echo "  [${node_name}] Cannot resolve Tailscale IP — skipping"
        (( NODE_FAIL++ ))
        continue
    }

    # ── Targeted rsync — push only this item, no delete ──────────────────────────────────────
    echo "  [${node_name}] rsync ${ITEM_NAME}..."
    rsync_out=$(rsync -av --no-delete \
        -e "ssh -i $SSH_KEY -T -o Compression=no -o IPQoS=throughput -o StrictHostKeyChecking=no" \
        "${ITEM_PATH}/" \
        "root@${node_ip}:${ITEM_PATH}/" 2>&1)
    rsync_exit=$?
    transferred=$(echo "$rsync_out" | awk '/Total transferred file size:/{gsub(/,/,"",$NF); gsub(/[^0-9]/,"",$NF); print $NF+0}')

    if [[ "$rsync_exit" -ne 0 ]]; then
        echo "  [${node_name}] rsync failed (exit ${rsync_exit}) — skipping rescan"
        (( NODE_FAIL++ ))
        continue
    fi
    echo "  [${node_name}] rsync done (${transferred:-0} bytes)"

    # ── Trigger arr rescan on remote — cache-first, SSH fallback ─────────────────────────────
    _kvar="${node_id}_${ARR_TYPE^^}_API_KEY"
    cached_key="${!_kvar:-}"

    if [[ -n "$cached_key" ]]; then
        body=$(printf '%s' "$ENCODED" | base64 -d)
        http_code=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
            -H "X-Api-Key: $cached_key" \
            -H "Content-Type: application/json" \
            -d "$body" \
            "http://${node_ip}:${PORT}/api/${API_VER}/command" 2>/dev/null)
    else
        config_xml="${DOCKER_APPDATA_BASE}/${ARR_TYPE^}/config.xml"
        http_code=$(ssh -i "$SSH_KEY" -o ConnectTimeout="$ARR_SYNC_CONNECT_TIMEOUT" \
            root@"$node_ip" bash <<REMOTE 2>/dev/null
KEY=\$(grep -oP '(?<=<ApiKey>)[^<]+' '${config_xml}' 2>/dev/null)
[[ -z "\$KEY" ]] && exit 1
BODY=\$(printf '%s' '${ENCODED}' | base64 -d)
curl -sf -o /dev/null -w '%{http_code}' -X POST \
    -H "X-Api-Key: \$KEY" \
    -H 'Content-Type: application/json' \
    -d "\$BODY" \
    "http://localhost:${PORT}/api/${API_VER}/command"
REMOTE
        )
    fi

    if [[ "$http_code" == "201" || "$http_code" == "200" ]]; then
        echo "  [${node_name}] ${RESCAN_CMD} triggered ✅"
    else
        echo "  [${node_name}] ${RESCAN_CMD} failed (HTTP ${http_code:-timeout})"
        (( NODE_FAIL++ ))
    fi
done

echo "[$(date '+%H:%M:%S')] Done — ${ITEM_NAME}"

[[ "$NODE_FAIL" -gt 0 ]] && exit 1
exit 0