#!/usr/bin/env bash
# Run operator tasks from a host on LAN. Always loads dotenv (PRIVATE_KEY, NPM_PASSWORD, etc.) from repo .env and smom-dbis-138/.env.
# Optional: contract deploy, Blockscout verify, backup, Proxmox VM/container creation.
#
# Usage:
#   ./scripts/run-all-operator-tasks-from-lan.sh [--dry-run] [--skip-backup] [--skip-verify]
#   ./scripts/run-all-operator-tasks-from-lan.sh [--dry-run] --deploy          # + contract deploy (phases + TransactionMirror if needed)
#   ./scripts/run-all-operator-tasks-from-lan.sh [--dry-run] --create-vms     # + create DBIS Core / missing containers
#   ./scripts/run-all-operator-tasks-from-lan.sh [--dry-run] --deploy --create-vms  # all
#
# Requires: LAN access to 192.168.11.x; smom-dbis-138/.env with PRIVATE_KEY for deploy.
# For create-vms: SSH to PROXMOX_HOST (default 192.168.11.10).

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_ROOT"

# Always load dotenv so Operator/LAN has NPM_PASSWORD, PRIVATE_KEY, RPC, etc.
if [[ -f "$SCRIPT_DIR/lib/load-project-env.sh" ]]; then
  # shellcheck source=scripts/lib/load-project-env.sh
  source "$SCRIPT_DIR/lib/load-project-env.sh"
fi

DRY_RUN=false
SKIP_BACKUP=false
SKIP_VERIFY=false
DO_DEPLOY=false
DO_CREATE_VMS=false

for a in "$@"; do
  [[ "$a" == "--dry-run" ]] && DRY_RUN=true
  [[ "$a" == "--skip-backup" ]] && SKIP_BACKUP=true
  [[ "$a" == "--skip-verify" ]] && SKIP_VERIFY=true
  [[ "$a" == "--deploy" ]] && DO_DEPLOY=true
  [[ "$a" == "--create-vms" ]] && DO_CREATE_VMS=true
  [[ "$a" == "-h" || "$a" == "--help" ]] && {
    echo "Usage: $0 [--dry-run] [--skip-backup] [--skip-verify] [--deploy] [--create-vms]"
    echo "  --dry-run       Print steps only, do not run."
    echo "  --skip-backup  Skip NPMplus backup."
    echo "  --skip-verify  Skip Blockscout contract verification."
    echo "  --deploy       Also run contract deployment (smom-dbis-138 phased + TransactionMirror if needed)."
    echo "  --create-vms   Also create Proxmox containers (DBIS Core 6 containers; requires SSH to PROXMOX_HOST)."
    echo "See: docs/00-meta/STEPS_FROM_PROXMOX_OR_LAN_WITH_SECRETS.md"
    exit 0
  }
done

log_info() { echo -e "\033[0;34m[INFO]\033[0m $1"; }
log_ok()   { echo -e "\033[0;32m[✓]\033[0m $1"; }
log_warn() { echo -e "\033[0;33m[⚠]\033[0m $1"; }
log_err()  { echo -e "\033[0;31m[✗]\033[0m $1"; }

echo ""
echo "=== Run all operator tasks (from LAN) ==="
echo "  dry-run=$DRY_RUN skip-backup=$SKIP_BACKUP skip-verify=$SKIP_VERIFY deploy=$DO_DEPLOY create-vms=$DO_CREATE_VMS"
echo ""

# 1) Wave 0: NPMplus RPC fix + backup
if [[ "$DRY_RUN" == true ]]; then
  echo "[DRY-RUN] Would run: run-wave0-from-lan.sh (NPMplus RPC fix + backup)"
else
  bash "$SCRIPT_DIR/run-wave0-from-lan.sh" $([[ "$SKIP_BACKUP" == true ]] && echo --skip-backup) 2>/dev/null || true
fi
echo ""

# 2) Blockscout verification
if [[ "$SKIP_VERIFY" != true ]]; then
  if [[ "$DRY_RUN" == true ]]; then
    echo "[DRY-RUN] Would run: ./scripts/verify/run-contract-verification-with-proxy.sh (dotenv already loaded)"
  else
    log_info "Blockscout source verification..."
    (bash "$SCRIPT_DIR/verify/run-contract-verification-with-proxy.sh") || log_warn "Blockscout verify skipped (env or script failed)"
  fi
  echo ""
fi

# 3) Optional: contract deployment (PRIVATE_KEY from dotenv already loaded above)
if [[ "$DO_DEPLOY" == true ]]; then
  if [[ "$DRY_RUN" == true ]]; then
    echo "[DRY-RUN] Would run: smom-dbis-138 deploy-all-phases.sh (and deploy-transaction-mirror-chain138.sh if needed)"
  else
    if [[ -n "${PRIVATE_KEY:-}" ]]; then
        log_info "Contract deployment (phased)..."
        (cd smom-dbis-138 && ./scripts/deployment/deploy-all-phases.sh) && log_ok "Phased deploy done" || log_warn "Phased deploy failed (may already be deployed)"
        log_info "TransactionMirror (if needed)..."
        bash "$SCRIPT_DIR/deployment/deploy-transaction-mirror-chain138.sh" 2>/dev/null && log_ok "TransactionMirror deployed" || log_warn "TransactionMirror skipped or failed (add TRANSACTION_MIRROR_ADDRESS to .env if deployed)"
      else
        log_warn "PRIVATE_KEY not set; set in smom-dbis-138/.env or .env and re-run"
      fi
  fi
  echo ""
fi

# 4) Optional: create Proxmox containers (DBIS Core)
if [[ "$DO_CREATE_VMS" == true ]]; then
  if [[ "$DRY_RUN" == true ]]; then
    echo "[DRY-RUN] Would run: dbis_core/scripts/deployment/create-dbis-core-containers.sh"
  else
    if [[ -f dbis_core/scripts/deployment/create-dbis-core-containers.sh ]]; then
      log_info "Creating DBIS Core containers (if missing)..."
      NON_INTERACTIVE=1 bash dbis_core/scripts/deployment/create-dbis-core-containers.sh 2>/dev/null && log_ok "DBIS Core containers done" || log_warn "DBIS Core create failed or skipped (check PROXMOX_HOST SSH)"
    else
      log_warn "create-dbis-core-containers.sh not found; skipping"
    fi
  fi
  echo ""
fi

echo "=== Next steps (manual if needed) ==="
echo "  sendCrossChain:   ./scripts/bridge/run-send-cross-chain.sh <amount_eth> [recipient]   # omit --dry-run for real send; needs LINK"
echo "  SSH keys:         ./scripts/security/setup-ssh-key-auth.sh [--apply]"
echo "  Firewall 8006:    ./scripts/security/firewall-proxmox-8006.sh [--apply] [CIDR]"
echo "  Backup cron:      bash scripts/maintenance/schedule-npmplus-backup-cron.sh --install"
echo "  Daily/weekly:     bash scripts/maintenance/schedule-daily-weekly-cron.sh --install"
echo "  Full steps list:  docs/00-meta/STEPS_FROM_PROXMOX_OR_LAN_WITH_SECRETS.md"
echo ""