#!/usr/bin/env bash
set -euo pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "${script_dir}/.." && pwd)"

env_file=""
mode=""

usage() {
  cat <<USAGE
Usage: ./scripts/sync-public-env-urls.sh --env-file <file> --mode ssl|nossl

Recomputes env-backed public URLs from the current domain and HTTPS port settings:
  - NEXTCLOUD_PUBLIC_URL
  - OIDC_ISSUER
  - OIDC_REDIRECT_URI_ALLOWLIST
  - COLLABORA_PUBLIC_URL
  - TALK_SIGNALING_PUBLIC_URL
  - TALK_TURN_SERVER
  - TALK_STUN_SERVER

When BROKER_CORS_ALLOWED_ORIGINS is empty or still matches the previous single
Nextcloud public URL, it is updated as well.
USAGE
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --env-file)
      env_file="${2:-}"
      shift 2
      ;;
    --env-file=*)
      env_file="${1#*=}"
      shift
      ;;
    --mode)
      mode="${2:-}"
      shift 2
      ;;
    --mode=*)
      mode="${1#*=}"
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown option: $1"
      usage
      exit 1
      ;;
  esac
done

if [[ -z "${env_file}" || -z "${mode}" ]]; then
  usage
  exit 1
fi

if [[ "${env_file}" != /* ]]; then
  env_file="${repo_root}/${env_file}"
fi

if [[ ! -f "${env_file}" ]]; then
  echo "Missing env file: ${env_file}"
  exit 1
fi

if [[ "${mode}" != "ssl" && "${mode}" != "nossl" ]]; then
  echo "Invalid mode: ${mode}"
  exit 1
fi

read_kv() {
  local key="$1"
  local line
  line="$(grep -m1 -E "^${key}=" "${env_file}" || true)"
  if [[ -z "${line}" ]]; then
    return 1
  fi
  echo "${line#*=}"
}

set_kv() {
  local key="$1"
  local value="$2"
  local tmp
  tmp="$(mktemp)"
  if grep -q -E "^${key}=" "${env_file}"; then
    sed -E "s|^${key}=.*$|${key}=${value}|" "${env_file}" > "${tmp}"
  else
    cat "${env_file}" > "${tmp}"
    printf '\n%s=%s\n' "${key}" "${value}" >> "${tmp}"
  fi
  mv "${tmp}" "${env_file}"
}

compute_public_url() {
  local domain="$1"
  local https_port="$2"
  if [[ -z "${domain}" ]]; then
    echo ""
    return 0
  fi
  if [[ "${https_port}" == "443" ]]; then
    echo "https://${domain}"
  else
    echo "https://${domain}:${https_port}"
  fi
}

trim() {
  local value="$1"
  value="$(echo "${value}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
  echo "${value}"
}

derive_host_candidates() {
  local host_fqdn host_short
  host_fqdn="$(hostname -f 2>/dev/null || true)"
  host_short="$(hostname -s 2>/dev/null || true)"
  printf '%s\n' \
    "${host_fqdn}" \
    "${host_short}" \
    "${host_fqdn}.local" \
    "${host_short}.local" \
    "localhost" \
    "127.0.0.1" | sed '/^$/d'
}

sync_talk_stun_server() {
  local talk_domain="$1"
  local turn_port="$2"
  local current_stun_server="$3"
  local legacy_domain="${4:-}"
  local desired_stun_server current_host current_host_no_port candidate

  if [[ -z "${talk_domain}" || -z "${turn_port}" ]]; then
    return 0
  fi

  desired_stun_server="${talk_domain}:${turn_port}"
  current_stun_server="$(trim "${current_stun_server}")"
  current_stun_server="${current_stun_server%/}"

  if [[ -z "${current_stun_server}" || "${current_stun_server}" == "stun.nextcloud.com:443" ]]; then
    set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
    return 0
  fi

  current_host="${current_stun_server%%:*}"
  current_host_no_port="${current_stun_server%:*}"
  if [[ "${current_host}" == "${talk_domain}" || "${current_host_no_port}" == "${talk_domain}" || -n "${legacy_domain}" && ( "${current_host}" == "${legacy_domain}" || "${current_host_no_port}" == "${legacy_domain}" ) ]]; then
    set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
    return 0
  fi

  while IFS= read -r candidate; do
    if [[ -z "${candidate}" ]]; then
      continue
    fi
    if [[ "${current_host}" == "${candidate}" || "${current_host_no_port}" == "${candidate}" ]]; then
      set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
      return 0
    fi
  done < <(derive_host_candidates)
}

sync_talk_turn_server() {
  local talk_domain="$1"
  local turn_port="$2"
  local current_turn_server="$3"
  local legacy_domain="${4:-}"
  local desired_turn_server current_host current_host_no_port candidate

  if [[ -z "${talk_domain}" || -z "${turn_port}" ]]; then
    return 0
  fi

  desired_turn_server="${talk_domain}:${turn_port}"
  current_turn_server="$(trim "${current_turn_server}")"
  current_turn_server="${current_turn_server%/}"

  if [[ -z "${current_turn_server}" ]]; then
    set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
    return 0
  fi

  current_host="${current_turn_server%%:*}"
  current_host_no_port="${current_turn_server%:*}"
  if [[ "${current_host}" == "${talk_domain}" || "${current_host_no_port}" == "${talk_domain}" || -n "${legacy_domain}" && ( "${current_host}" == "${legacy_domain}" || "${current_host_no_port}" == "${legacy_domain}" ) ]]; then
    set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
    return 0
  fi

  while IFS= read -r candidate; do
    if [[ -z "${candidate}" ]]; then
      continue
    fi
    if [[ "${current_host}" == "${candidate}" || "${current_host_no_port}" == "${candidate}" ]]; then
      set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
      return 0
    fi
  done < <(derive_host_candidates)
}

nextcloud_domain="$(read_kv "NEXTCLOUD_DOMAIN" || true)"
broker_domain="$(read_kv "BROKER_DOMAIN" || true)"
collabora_domain="$(read_kv "COLLABORA_DOMAIN" || true)"
signaling_domain="$(read_kv "SIGNALING_DOMAIN" || true)"
if [[ -z "${signaling_domain}" ]]; then
  signaling_domain="$(read_kv "TALK_DOMAIN" || true)"
fi
talk_turn_host="$(read_kv "TALK_TURN_HOST" || true)"
if [[ -z "${talk_turn_host}" || "${talk_turn_host}" == "${signaling_domain}" ]]; then
  talk_turn_host="${nextcloud_domain}"
  if [[ -n "${talk_turn_host}" ]]; then
    set_kv "TALK_TURN_HOST" "${talk_turn_host}"
  fi
fi
talk_janus_stun_server="$(read_kv "TALK_JANUS_STUN_SERVER" || true)"
if [[ -z "${talk_janus_stun_server}" || "${talk_janus_stun_server}" == "stun.nextcloud.com" || "${talk_janus_stun_server}" == "${signaling_domain}" || "${talk_janus_stun_server}" == "${talk_turn_host}" || "${talk_janus_stun_server}" == "${nextcloud_domain}" ]]; then
  set_kv "TALK_JANUS_STUN_SERVER" "${talk_turn_host}"
fi

current_nextcloud_public_url="$(read_kv "NEXTCLOUD_PUBLIC_URL" || true)"
current_broker_cors_allowed_origins="$(read_kv "BROKER_CORS_ALLOWED_ORIGINS" || true)"
current_talk_signaling_port="$(read_kv "TALK_SIGNALING_PORT" || true)"
current_talk_signaling_container_port="$(read_kv "TALK_SIGNALING_CONTAINER_PORT" || true)"
current_talk_signaling_upstream_host="$(read_kv "TALK_SIGNALING_UPSTREAM_HOST" || true)"
current_talk_signaling_upstream_port="$(read_kv "TALK_SIGNALING_UPSTREAM_PORT" || true)"
current_talk_signaling_port="${current_talk_signaling_port:-8081}"
talk_turn_port="$(read_kv "TALK_TURN_PORT" || true)"
current_talk_stun_server="$(read_kv "TALK_STUN_SERVER" || true)"
current_talk_turn_server="$(read_kv "TALK_TURN_SERVER" || true)"
current_janus_stun_port="$(read_kv "TALK_JANUS_STUN_PORT" || true)"
if [[ -z "${current_janus_stun_port}" || "${current_janus_stun_port}" == "3478" || "${current_janus_stun_port}" == "${talk_turn_port}" ]]; then
  set_kv "TALK_JANUS_STUN_PORT" "${talk_turn_port:-3478}"
fi

https_port="$(read_kv "PUBLIC_HTTPS_PORT" || true)"
if [[ "${mode}" == "ssl" ]]; then
  https_port="$(read_kv "CADDY_HTTPS_PORT" || true)"
fi
https_port="${https_port:-443}"

nextcloud_public_url="$(compute_public_url "${nextcloud_domain}" "${https_port}")"
broker_public_url="$(compute_public_url "${broker_domain}" "${https_port}")"
collabora_public_url="$(compute_public_url "${collabora_domain}" "${https_port}")"
signaling_public_url="$(compute_public_url "${signaling_domain}" "${https_port}")"

if [[ -n "${nextcloud_public_url}" ]]; then
  set_kv "NEXTCLOUD_PUBLIC_URL" "${nextcloud_public_url}"
  set_kv "OIDC_REDIRECT_URI_ALLOWLIST" "${nextcloud_public_url}/apps/user_oidc/code"
fi
if [[ -n "${broker_public_url}" ]]; then
  set_kv "OIDC_ISSUER" "${broker_public_url}"
fi
if [[ -n "${collabora_public_url}" ]]; then
  set_kv "COLLABORA_PUBLIC_URL" "${collabora_public_url}"
fi
if [[ -n "${signaling_public_url}" ]]; then
  set_kv "TALK_SIGNALING_PUBLIC_URL" "${signaling_public_url}"
fi
if [[ -z "${current_talk_signaling_upstream_host}" || "${current_talk_signaling_upstream_host}" == "talk_hpb" ]]; then
  set_kv "TALK_SIGNALING_UPSTREAM_HOST" "host.docker.internal"
fi
if [[ "${current_talk_signaling_container_port}" != "8081" ]]; then
  set_kv "TALK_SIGNALING_CONTAINER_PORT" "8081"
fi
set_kv "TALK_SIGNALING_PORT" "${current_talk_signaling_port}"
set_kv "TALK_SIGNALING_UPSTREAM_PORT" "${current_talk_signaling_port}"

if [[ -n "${nextcloud_public_url}" ]]; then
  if [[ -z "${current_broker_cors_allowed_origins}" || "${current_broker_cors_allowed_origins}" == "${current_nextcloud_public_url}" ]]; then
    set_kv "BROKER_CORS_ALLOWED_ORIGINS" "${nextcloud_public_url}"
  fi
fi

sync_talk_turn_server "${talk_turn_host}" "${talk_turn_port:-3478}" "${current_talk_turn_server}" "${signaling_domain}"
sync_talk_stun_server "${talk_turn_host}" "${talk_turn_port:-3478}" "${current_talk_stun_server}" "${signaling_domain}"

echo "Synchronized public URLs in ${env_file} for mode=${mode}"
echo "  NEXTCLOUD_PUBLIC_URL=${nextcloud_public_url:-<unchanged>}"
echo "  OIDC_ISSUER=${broker_public_url:-<unchanged>}"
if [[ -n "${collabora_public_url}" ]]; then
  echo "  COLLABORA_PUBLIC_URL=${collabora_public_url}"
fi
if [[ -n "${signaling_public_url}" ]]; then
  echo "  TALK_SIGNALING_PUBLIC_URL=${signaling_public_url}"
fi
echo "  TALK_TURN_HOST=$(read_kv "TALK_TURN_HOST" || true)"
echo "  TALK_JANUS_STUN_SERVER=$(read_kv "TALK_JANUS_STUN_SERVER" || true)"
echo "  TALK_JANUS_STUN_PORT=$(read_kv "TALK_JANUS_STUN_PORT" || true)"
echo "  TALK_SIGNALING_PORT=$(read_kv "TALK_SIGNALING_PORT" || true)"
echo "  TALK_SIGNALING_CONTAINER_PORT=$(read_kv "TALK_SIGNALING_CONTAINER_PORT" || true)"
echo "  TALK_SIGNALING_UPSTREAM_PORT=$(read_kv "TALK_SIGNALING_UPSTREAM_PORT" || true)"
echo "  TALK_TURN_SERVER=$(read_kv "TALK_TURN_SERVER" || true)"
echo "  TALK_STUN_SERVER=$(read_kv "TALK_STUN_SERVER" || true)"