#!/usr/bin/env bash
# install.sh — deploy the EngineAI PM01 fleet agent onto a robot.
#
#   bash install.sh <ip> [user] [token]
#   bash install.sh 10.210.136.150 ubuntu "$ECO_DEV_TOKEN"
#
# Idempotent: re-running updates the code and leaves an existing .env (and its
# tokens) untouched. Pass a token only on the FIRST install, or to rotate it.
#
# Auth: uses FLEET_SSH_KEY if set, else sshpass with FLEET_SSH_PASS
# (default "ubuntu"). Set FLEET_SSH_PASS in the environment — never edit it in.
set -euo pipefail

IP="${1:-}"
USER_="${2:-ubuntu}"
TOKEN="${3:-}"
[ -z "$IP" ] && { echo "usage: bash install.sh <ip> [user] [token]" >&2; exit 2; }

HERE="$(cd "$(dirname "$0")" && pwd)"
SSH_OPTS="-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"

if [ -n "${FLEET_SSH_KEY:-}" ]; then
    SSH() { ssh $SSH_OPTS -i "$FLEET_SSH_KEY" "$USER_@$IP" "$@"; }
    PUT() { scp $SSH_OPTS -i "$FLEET_SSH_KEY" "$1" "$USER_@$IP:$2"; }
elif command -v sshpass >/dev/null 2>&1; then
    P="${FLEET_SSH_PASS:-ubuntu}"
    SSH() { sshpass -p "$P" ssh $SSH_OPTS "$USER_@$IP" "$@"; }
    PUT() { sshpass -p "$P" scp $SSH_OPTS "$1" "$USER_@$IP:$2"; }
else
    SSH() { ssh $SSH_OPTS "$USER_@$IP" "$@"; }
    PUT() { scp $SSH_OPTS "$1" "$USER_@$IP:$2"; }
fi

say() { printf '\n\033[1m== %s\033[0m\n' "$1"; }

say "staging files on $IP"
SSH 'mkdir -p ~/.sanad_stage'
PUT "$HERE/agent/sanad_api_eng.py"      '~/.sanad_stage/'
PUT "$HERE/agent/.env.example"          '~/.sanad_stage/'
PUT "$HERE/agent/requirements.txt"      '~/.sanad_stage/'
PUT "$HERE/agent/sanad-api-eng.service" '~/.sanad_stage/'
PUT "$HERE/tools/probe_eng.sh"          '~/.sanad_stage/'

say "installing (needs sudo on the robot)"
# The .env is created from .env.example ONLY if absent, so re-running never
# clobbers a live token. sudo -S reads the password from stdin when the robot
# has no passwordless sudo.
SSH "sudo -S -p '' bash -s" <<REMOTE
set -e
install -d -m 755 /opt/sanad_api_eng
install -d -m 750 /var/lib/sanad_api_eng
install -m 755 ~$USER_/.sanad_stage/sanad_api_eng.py  /opt/sanad_api_eng/sanad_api_eng.py
install -m 644 ~$USER_/.sanad_stage/.env.example      /opt/sanad_api_eng/.env.example
install -m 644 ~$USER_/.sanad_stage/requirements.txt  /opt/sanad_api_eng/requirements.txt
install -m 755 ~$USER_/.sanad_stage/probe_eng.sh      /opt/sanad_api_eng/probe_eng.sh
install -m 644 ~$USER_/.sanad_stage/sanad-api-eng.service /etc/systemd/system/sanad-api-eng.service

if [ ! -f /opt/sanad_api_eng/.env ]; then
    install -m 600 -o root -g root /opt/sanad_api_eng/.env.example /opt/sanad_api_eng/.env
    echo "  created /opt/sanad_api_eng/.env from .env.example — SET SN AND TOKEN"
else
    echo "  kept existing /opt/sanad_api_eng/.env (tokens preserved)"
fi
chmod 600 /opt/sanad_api_eng/.env

if [ -n "$TOKEN" ]; then
    sed -i "s#^DEVICE_TOKEN=.*#DEVICE_TOKEN=$TOKEN#" /opt/sanad_api_eng/.env
    echo "  DEVICE_TOKEN set"
fi

systemctl daemon-reload
systemctl enable sanad-api-eng >/dev/null 2>&1
systemctl restart sanad-api-eng
rm -rf ~$USER_/.sanad_stage
REMOTE

say "waiting for the first telemetry post"
sleep 12
SSH "sudo -S -p '' journalctl -u sanad-api-eng -n 25 --no-pager -o cat" \
    | grep -E 'fleet server|subscribed|telemetry ok|ERROR|WARNING' || true

say "status"
SSH "sudo -S -p '' systemctl is-active sanad-api-eng; sudo -S -p '' systemctl is-enabled sanad-api-eng"

cat <<'DONE'

Next:
  * set SN (and ROBOT_NAME) in /opt/sanad_api_eng/.env, then restart
  * to add the second fleet server, set SERVER_2_TOKEN + SERVER_2_ENABLE=1
  * live log:  ssh <user>@<ip> 'sudo journalctl -u sanad-api-eng -f'
DONE