#!/bin/bash
# ==============================================================================================
# ========================= Upgrade Webhook Handler ============================================
# ==============================================================================================
#
# PURPOSE
# ─────────────────────────────────────────────────────────────────────────────
# Triggered by Sonarr/Radarr/Lidarr OnUpgrade webhook (via webhook_listener.js).
# Pushes the upgraded item folder to every other mesh node immediately, then
# triggers a library rescan on each remote arr so it accepts the new file as
# ground truth without initiating a redundant quality search.
#
# Closes the propagation window: without this, a remote node that already has
# the 720p copy will see the 1080p tagged in arr_sync but not on disk and
# begin searching — a search it will never win because we already have it.
#
# ==============================================================================================
# OPERATIONAL MODEL
# ==============================================================================================
#
# Invoked per import by webhook_listener.js with <arr_type> <item_path>:
#
#   1. Validate
#        → arr_type must be sonarr|radarr|lidarr; item_path must exist and be a safe
#          absolute path
#
#   2. Resolve arr specifics
#        → API port, API version and rescan command for that arr type
#
#   3. Discover remote nodes
#        → discover_remote_nodes(); no remotes configured means exit cleanly
#
#   4. Per remote node, independently:
#        a. Resolve its Tailscale IP — unresolvable skips that node
#        b. rsync the single item to the same absolute path (--no-delete)
#        c. Skip the rescan if rsync failed — never scan a partial file
#        d. Trigger the arr's refresh command, cache-first API key with SSH fallback
#
# One failing node is counted and skipped; the rest still receive the upgrade.
#
# ==============================================================================================
# DESIGN PRINCIPLES
# ==============================================================================================
#
# Closes the Propagation Window
#   arr_sync runs every 4 hours. Without this handler, a remote node that already
#   has the old version sees the upgrade tagged in arr_sync but the new file not
#   yet on disk, and initiates a redundant quality search — a search it will never
#   win because this host already has the file. Immediate push eliminates that window.
#
# Rescan as Ground Truth
#   Pushing the file is not enough — the remote arr must also be told the file
#   exists. Triggering a rescan makes the remote accept the pushed file as the
#   current version without starting a new search.
#
# Cache-First API Key Lookup
#   Remote arr API keys are read from conf if cached; otherwise fetched via SSH
#   from the remote's config.xml. This avoids storing secrets redundantly while
#   keeping API calls fast on hosts where the key is already known.
#
# ==============================================================================================
# OPERATIONAL SAFEGUARDS
# ==============================================================================================
#
# Root Enforcement
#   rsync runs over SSH as root and writes to root@remote at the same absolute path.
#
# Argument Validation
#   Exits with a usage message if arr_type or item_path is missing, and rejects an
#   arr_type outside sonarr|radarr|lidarr rather than defaulting to one.
#
# Path Existence
#   Exits if item_path is not a directory on disk.
#
# Item Path Depth Guard
#   item_path must be an absolute path at least three levels deep. It arrives from the
#   arr's webhook payload and is rsynced to the same path on the partner, so a truncated
#   or malformed value would push a system directory — or the filesystem root — onto the
#   remote. The existence check alone does not catch this, because / is a directory.
#
# No Lock — Deliberate
#   This is an event handler invoked per import by webhook_listener.js. Concurrent
#   upgrades are normal and expected. A default lock would silently drop overlapping
#   events, and a waiting lock would queue them behind a slow transfer, so neither is
#   used: each invocation rsyncs a different item path and they do not contend.
#
# Tailscale Resolution
#   Skips a node if its Tailscale IP cannot be resolved, rather than attempting the
#   transfer against an unresolved or stale address.
#
# rsync Exit Check
#   The rescan is only triggered if rsync succeeded. A failed transfer never causes the
#   remote arr to scan a partial file into its library.
#
# No Delete on Push
#   rsync runs with --no-delete. This pushes one upgraded item; it is not a mirror, and
#   must never remove content on the partner that this run does not know about.
#
# SSH Fallback
#   If no cached API key is available, falls back to SSH to read config.xml on the
#   remote rather than failing the rescan step.
#
# Per-Node Isolation
#   One unreachable or failing node is counted and skipped; the remaining nodes still
#   receive the upgrade.
#
# ==============================================================================================
# CONFIGURATION
# ==============================================================================================
#
# host*.conf
#
#   HOST*                      — host names used to discover remote nodes
#   HOST*_SONARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#   HOST*_RADARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#   HOST*_LIDARR_API_KEY       — cached API key for direct HTTP rescan (optional)
#
# master.conf
#
#   SSH_KEY                    — SSH key path for rsync and SSH fallback
#   ARR_SYNC_CONNECT_TIMEOUT   — SSH connect timeout in seconds
#   DOCKER_APPDATA_BASE        — base path for reading arr config.xml on remote
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
# upgrade_webhook_handler.sh <arr_type> <item_path>
#
#   arr_type   — sonarr | radarr | lidarr
#   item_path  — absolute path to the series/movie/artist folder on local disk
#                (series.path from Sonarr, movie.folderPath from Radarr,
#                 artist.path from Lidarr)
#
# Called by webhook_listener.js — not intended for direct invocation outside testing.
#
# ==============================================================================================

set -uo pipefail

ARR_TYPE="${1:-}"
ITEM_PATH="${2:-}"

[[ -z "$ARR_TYPE" || -z "$ITEM_PATH" ]] && {
    echo "Usage: upgrade_webhook_handler.sh <arr_type> <item_path>" >&2
    exit 1
}

[[ -d "$ITEM_PATH" ]] || { echo "Path not found: $ITEM_PATH" >&2; exit 1; }

if [[ "$EUID" -ne 0 ]]; then
    echo "Must be run as root" >&2
    exit 1
fi

# ITEM_PATH is rsynced to root@remote at the same absolute path. It arrives from the arr's
# webhook payload, so a malformed or truncated value would push a system directory — or the
# filesystem root — onto the partner. -d alone does not catch that: / is a directory.
_depth="${ITEM_PATH//[^\/]/}"
if [[ "$ITEM_PATH" != /* || "${#_depth}" -lt 3 ]]; then
    echo "Refusing unsafe item path: '$ITEM_PATH' — expected an absolute path at least 3 levels deep" >&2
    exit 1
fi
unset _depth

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../load_config.sh"
detect_hosts

# ── Arr type → API port / version / rescan command ───────────────────────────────────────────
case "$ARR_TYPE" in
    sonarr) PORT=8989; API_VER="v3"; RESCAN_CMD="RefreshSeries" ;;
    radarr) PORT=7878; API_VER="v3"; RESCAN_CMD="RefreshMovie"  ;;
    lidarr) PORT=8686; API_VER="v1"; RESCAN_CMD="RefreshArtist" ;;
    *)      echo "Unknown arr type: $ARR_TYPE" >&2; exit 1 ;;
esac

# ── Remote node list ──────────────────────────────────────────────────────────────────────────
discover_remote_nodes

if [[ "${#REMOTE_NODES[@]}" -eq 0 ]]; then
    echo "No remote nodes configured — nothing to push"
    exit 0
fi

ENCODED=$(printf '{"name":"%s"}' "$RESCAN_CMD" | base64 -w0)
ITEM_NAME=$(basename "$ITEM_PATH")

echo "[$(date '+%H:%M:%S')] Upgrade push: ${ARR_TYPE} — ${ITEM_NAME}"
echo "  Path: $ITEM_PATH"
echo "  Targets: ${REMOTE_NODES[*]}"

NODE_FAIL=0

# ── Push and rescan each remote ───────────────────────────────────────────────────────────────
for node_id in "${REMOTE_NODES[@]}"; do
    node_name="${!node_id}"
    node_ip=$(resolve_tailscale_ip "$node_name") || {
        echo "  [${node_name}] Cannot resolve Tailscale IP — skipping"
        (( NODE_FAIL++ ))
        continue
    }

    # ── Targeted rsync — push only this item, no delete ──────────────────────────────────────
    echo "  [${node_name}] rsync ${ITEM_NAME}..."
    rsync_out=$(rsync -av --no-delete \
        -e "ssh -i $SSH_KEY -T -o Compression=no -o IPQoS=throughput -o StrictHostKeyChecking=no" \
        "${ITEM_PATH}/" \
        "root@${node_ip}:${ITEM_PATH}/" 2>&1)
    rsync_exit=$?
    transferred=$(echo "$rsync_out" | awk '/Total transferred file size:/{gsub(/,/,"",$NF); gsub(/[^0-9]/,"",$NF); print $NF+0}')

    if [[ "$rsync_exit" -ne 0 ]]; then
        echo "  [${node_name}] rsync failed (exit ${rsync_exit}) — skipping rescan"
        (( NODE_FAIL++ ))
        continue
    fi
    echo "  [${node_name}] rsync done (${transferred:-0} bytes)"

    # ── Trigger arr rescan on remote — cache-first, SSH fallback ─────────────────────────────
    _kvar="${node_id}_${ARR_TYPE^^}_API_KEY"
    cached_key="${!_kvar:-}"

    if [[ -n "$cached_key" ]]; then
        body=$(printf '%s' "$ENCODED" | base64 -d)
        http_code=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
            -H "X-Api-Key: $cached_key" \
            -H "Content-Type: application/json" \
            -d "$body" \
            "http://${node_ip}:${PORT}/api/${API_VER}/command" 2>/dev/null)
    else
        config_xml="${DOCKER_APPDATA_BASE}/${ARR_TYPE^}/config.xml"
        http_code=$(ssh -i "$SSH_KEY" -o ConnectTimeout="$ARR_SYNC_CONNECT_TIMEOUT" \
            root@"$node_ip" bash <<REMOTE 2>/dev/null
KEY=\$(grep -oP '(?<=<ApiKey>)[^<]+' '${config_xml}' 2>/dev/null)
[[ -z "\$KEY" ]] && exit 1
BODY=\$(printf '%s' '${ENCODED}' | base64 -d)
curl -sf -o /dev/null -w '%{http_code}' -X POST \
    -H "X-Api-Key: \$KEY" \
    -H 'Content-Type: application/json' \
    -d "\$BODY" \
    "http://localhost:${PORT}/api/${API_VER}/command"
REMOTE
        )
    fi

    if [[ "$http_code" == "201" || "$http_code" == "200" ]]; then
        echo "  [${node_name}] ${RESCAN_CMD} triggered ✅"
    else
        echo "  [${node_name}] ${RESCAN_CMD} failed (HTTP ${http_code:-timeout})"
        (( NODE_FAIL++ ))
    fi
done

echo "[$(date '+%H:%M:%S')] Done — ${ITEM_NAME}"

[[ "$NODE_FAIL" -gt 0 ]] && exit 1
exit 0