#!/bin/bash

set -euo pipefail

# === Default values ===
WEBSITES_FOLDER=""
DYNAMIC_SITE=""
SFTP_PASSWORD=""
DB_PASSWORD=""
WPSITE=""
SFTP_GROUP="sftpusers"
JSON_DATA=""
SITE_ID=""
DOMAINCLI=""
THUMBNAIL=""


SUBSCRIBER_USER=""
SUBSCRIBER_EMAIL=""
SUBSCRIBER_PASS=""
USER_ROLE="user"

# === Named parameter parsing ===
while [[ $# -gt 0 ]]; do
    case "$1" in
        --folder) WEBSITES_FOLDER="$2"; shift 2 ;;
        --site) DYNAMIC_SITE="$2"; shift 2 ;;
        --sftp-pass) SFTP_PASSWORD="$2"; shift 2 ;;
        --db-pass) DB_PASSWORD="$2"; shift 2 ;;
        --wpsite) WPSITE="$2"; shift 2 ;;
        --sftp-group) SFTP_GROUP="$2"; shift 2 ;;
        --json-data) JSON_DATA="$2"; shift 2 ;;
        --site-id) SITE_ID="$2"; shift 2 ;;
        --domain) DOMAINCLI="$2"; shift 2 ;;
        --thumbnail) THUMBNAIL="$2"; shift 2 ;;
        
        --subscriber-user) SUBSCRIBER_USER="$2"; shift 2 ;;
        --subscriber-email) SUBSCRIBER_EMAIL="$2"; shift 2 ;;
        --subscriber-pass) SUBSCRIBER_PASS="$2"; shift 2 ;;
        --user-role) USER_ROLE="$2"; shift 2 ;;
        *) echo "❌ Unknown option: $1"; exit 1 ;;
    esac
done

# === Validate Required Inputs ===
if [[ -z "$WEBSITES_FOLDER" || -z "$DYNAMIC_SITE" || -z "$SFTP_PASSWORD" || -z "$DB_PASSWORD" || -z "$WPSITE" || -z "$DOMAINCLI" ]]; then
    echo "❗ Usage: ./site_setup.sh --folder sites --site xynine --sftp-pass 'SFTP@123' --db-pass 'DB@123' --wpsite wp"
    exit 1
fi

# === Derived Variables ===
SFTP_USER="${WPSITE}_${DYNAMIC_SITE}"
WEB_HOME="/var/www/${WEBSITES_FOLDER}/${SFTP_USER}"
WEB_ROOT="${WEB_HOME}/public_html"
DB_NAME="db_${WPSITE}_${DYNAMIC_SITE}"
DB_USER="db_user_${WPSITE}_${DYNAMIC_SITE}"
DOMAIN="${DOMAINCLI}.silversharkdev.bloxby.io"
SITE_URL="https://${DOMAIN}"
VHOST_FILE="/etc/apache2/sites-available/${DOMAIN}.conf"
MYSQL_ROOT_PASSWORD="b?9O1i#Z/-S?Pv9O31r8"

echo "📁 Creating web directory: $WEB_ROOT"
mkdir -p "$WEB_ROOT"

if ! getent group "$SFTP_GROUP" > /dev/null; then
    echo "👥 Creating group: $SFTP_GROUP"
    groupadd "$SFTP_GROUP"
fi

if ! id "$SFTP_USER" &>/dev/null; then
    echo "👤 Creating SFTP user: $SFTP_USER"
    useradd -m -d "$WEB_HOME" -s /sbin/nologin -G "$SFTP_GROUP" "$SFTP_USER"
    echo "$SFTP_USER:$SFTP_PASSWORD" | chpasswd
else
    echo "ℹ️  User $SFTP_USER exists."
fi

chown root:root "$WEB_HOME"
chmod 755 "$WEB_HOME"
chown -R "$SFTP_USER:$SFTP_GROUP" "$WEB_ROOT"

echo "🛢️  Creating MySQL DB: $DB_NAME"
mysql -u root -p"${MYSQL_ROOT_PASSWORD}" <<MYSQL
CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\`;
CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASSWORD}';
GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';
FLUSH PRIVILEGES;
MYSQL

echo "🌐 Creating Apache Virtual Host"
tee "$VHOST_FILE" > /dev/null <<EOF
<VirtualHost *:80>
    ServerName ${DOMAIN}
    DocumentRoot ${WEB_ROOT}
    <Directory ${WEB_ROOT}>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    ErrorLog \${APACHE_LOG_DIR}/${DYNAMIC_SITE}_error.log
    CustomLog \${APACHE_LOG_DIR}/${DYNAMIC_SITE}_access.log combined
</VirtualHost>
EOF

a2ensite "${DOMAIN}.conf"
systemctl reload apache2



# === Let's Encrypt SSL Installation (Safe mode) ===
SCHEME="http"  #default
echo "🔐 Attempting Let's Encrypt SSL certificate installation for $DOMAIN"

if ! command -v certbot >/dev/null 2>&1; then
    echo "⚠️ Certbot is NOT installed. Skipping SSL installation."
else
    echo "➡️ Certbot found. Trying to issue SSL..."

    set +e  # <-- allow certbot errors without breaking script

    certbot --apache -d "$DOMAIN" --non-interactive --agree-tos \
        -m "admin@$DOMAIN" --redirect

    CERTBOT_EXIT=$?

    set -e  # restore strict mode

    if [[ $CERTBOT_EXIT -ne 0 ]]; then
        echo "⚠️ Let's Encrypt failed (maybe rate limit, DNS error, or challenge issue)."
        echo "⏭️ Continuing without SSL..."
    else
        echo "✅ SSL installed successfully!"
        systemctl reload apache2 || true
	SCHEME="https" 
    fi
fi


# === WordPress setup ===
export WP_CLI_PHP_ARGS='-d memory_limit=512M -d max_execution_time=900'
export WP_CLI_CACHE_DIR="/tmp/.wp-cli-cache-$SFTP_USER"
mkdir -p "$WP_CLI_CACHE_DIR"

wp core download --path="$WEB_ROOT" --force --allow-root
wp config create --dbname="$DB_NAME" --dbuser="$DB_USER" --dbpass="$DB_PASSWORD" --path="$WEB_ROOT" --force --allow-root
wp core install --url="${SCHEME}://${DOMAIN}" --title="WP Site" --admin_user=admin --admin_password=')L:admini#234097vbhgk' --admin_email=info@site.com --path="$WEB_ROOT" --allow-root

if [[ -n "$SUBSCRIBER_USER" && -n "$SUBSCRIBER_EMAIL" && -n "$SUBSCRIBER_PASS" ]]; then
    SUBSCRIBER_PASS=$(openssl rand -base64 12)
    echo "👤 Creating WordPress subscriber: $SUBSCRIBER_USER"
    wp user create "$SUBSCRIBER_USER" "$SUBSCRIBER_EMAIL" --role=editor --user_pass="$SUBSCRIBER_PASS" --path="$WEB_ROOT" --allow-root
fi

echo "🔧 Fixing WordPress file and directory permissions"
chown -R "$SFTP_USER:$SFTP_GROUP" "$WEB_ROOT"
find "$WEB_ROOT" -type d -exec chmod 755 {} \;
find "$WEB_ROOT" -type f -exec chmod 644 {} \;
chmod 644 "$WEB_ROOT/wp-config.php" 2>/dev/null || true



if [[ ! -f "$WEB_ROOT/.htaccess" ]]; then
    echo "⚠️ .htaccess not created by WP CLI, writing manually"
    cat > "${WEB_ROOT}/.htaccess" <<'EOF'
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
EOF
    chown "$SFTP_USER:$SFTP_GROUP" "${WEB_ROOT}/.htaccess"
    chmod 644 "${WEB_ROOT}/.htaccess"
fi

#git clone https://github.com/gurpreet-42works/WP-Block-Theme.git "$WEB_ROOT/wp-content/themes/wp-block-theme" --quiet || echo "⚠️ Theme repo already exists."

git clone https://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@github.com/42Works-Base/silvershark-wp-theme.git "$WEB_ROOT/wp-content/themes/wp-block-theme" --quiet || echo "⚠️ Theme repo already exists."
wp theme activate wp-block-theme --path="$WEB_ROOT" --allow-root
wp plugin install /var/www/commands/bloxby-plugin.zip --activate --path="$WEB_ROOT" --allow-root

#install CF7 plugin

wp plugin install contact-form-7 --path="$WEB_ROOT" --activate  --allow-root
wp option update blog_public 0 --path="$WEB_ROOT" --allow-root

if [[ -n "$JSON_DATA" ]]; then
    wp option add sitedata "$JSON_DATA" --path="$WEB_ROOT" --allow-root
    wp option add boxby_siteid "$SITE_ID" --path="$WEB_ROOT" --allow-root
    wp menu create "Header Menu" --path="$WEB_ROOT" --allow-root
    wp menu location assign header-menu header-menu --path="$WEB_ROOT" --allow-root
    wp menu create "Footer Menu" --path="$WEB_ROOT" --allow-root
    wp menu location assign footer-menu footer-menu --path="$WEB_ROOT" --allow-root
fi


#wp aibuilder generate-pages --path="$WEB_ROOT" --apikey="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" --allow-root

APIKEY="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"

wp aibuilder generate-pages --path="$WEB_ROOT" --apikey="$APIKEY" --allow-root &
wp aibuilder generate-website-logo --path="$WEB_ROOT" --apikey="$APIKEY" --allow-root &
wp aibuilder generate-blog-posts --path="$WEB_ROOT" --apikey="$APIKEY" --allow-root &

wait

wp rewrite structure '/%postname%/' --path="$WEB_ROOT" --allow-root
wp rewrite flush --hard --path="$WEB_ROOT" --allow-root

MU_PLUGIN_DIR="${WEB_ROOT}/wp-content/mu-plugins"
mkdir -p "$MU_PLUGIN_DIR"

if [ -f "/var/bloxbycommands/bloxby-access-levels.php" ]; then
    cp "/var/bloxbycommands/bloxby-access-levels.php" "$MU_PLUGIN_DIR/"
    chown root:root "$MU_PLUGIN_DIR/bloxby-access-levels.php"
    chmod 644 "$MU_PLUGIN_DIR/bloxby-access-levels.php"
    echo "✅ Bloxby access levels plugin installed into mu-plugins."
else
    echo "⚠️ Warning: /var/bloxbycommands/bloxby-access-levels.php not found."
fi

# === Remove unwanted cli-builder.php file from theme ===
CLI_BUILDER_FILE="${WEB_ROOT}/wp-content/themes/wp-block-theme/includes/cli-builder.php"

if [ -f "$CLI_BUILDER_FILE" ]; then
    rm -f "$CLI_BUILDER_FILE"
    echo "🗑️ Removed cli-builder.php from theme."
else
    echo "ℹ️ No cli-builder.php found, skipping removal."
fi

CLI_PATTERN_FOLDER="${WEB_ROOT}/wp-content/themes/wp-block-theme/patterns"

# if [ "$USER_ROLE" = "user" ]; then
#     if [ -d "$CLI_PATTERN_FOLDER" ]; then
#         rm -rf "$CLI_PATTERN_FOLDER"
#         echo "🗑️ Removed pattern from theme (USER_ROLE=user)."
#     else
#         echo "ℹ️ No pattern found, skipping removal."
#     fi
# else
#     echo "⛔ USER_ROLE is not 'user'. Skipping removal."
# fi

#if [[ -n "$THUMBNAIL" ]]; then
#    node  /var/bloxbycommands/screenshot/screenshot.js "${SITE_URL}" "${THUMBNAIL}"
#fi

# === FINAL PERMISSIONS FIX (SFTP + WordPress + Uploads) ===

echo "🔧 Applying final permission rules..."

PARENT_FOLDER="/var/www/${WEBSITES_FOLDER}/${SFTP_USER}"
PUBLIC_HTML="${WEB_ROOT}"
WPCONTENT="${WEB_ROOT}/wp-content"

# 1. Parent folder must be root-owned for SFTP chroot
chown root:root "$PARENT_FOLDER"
chmod 755 "$PARENT_FOLDER"

# 2. SFTP user full access to public_html
chown -R "${SFTP_USER}:${SFTP_GROUP}" "$PUBLIC_HTML"
chmod -R 775 "$PUBLIC_HTML"

# 3. wp-content writable by WordPress & SFTP
chown -R "www-data:${SFTP_GROUP}" "$WPCONTENT"
chmod -R 775 "$WPCONTENT"

# 4. New files inherit group
chmod g+s "$WPCONTENT"

echo "✅ Final permissions applied!"


echo "✅ Site created!"
echo "🌍 Domain:      https://$DOMAIN"
echo "📁 Web Root:    $WEB_ROOT"
echo "👤 SFTP User:   $SFTP_USER"
echo "🔐 SFTP Pass:   $SFTP_PASSWORD"
echo "👥 Group:       $SFTP_GROUP"
echo "🛢️  DB Name:     $DB_NAME"