#!/bin/bash
# Sourced, not run: it leaves the PHP server in the caller's background and exports
# FEUERWERK_BASE_URL, which every tool reads.
#
# The checkout is served under /feuerwerk/ like on stein2 – hence the symlink into /srv rather
# than `-t .`.

export FEUERWERK_BASE_URL=http://127.0.0.1:8080/feuerwerk/
# The MCP relay (#429) in front of the same server, so the editor's tab reaches it on its own
# origin as it does behind nginx on stein2. Only step 71 opens the editor there.
export FEUERWERK_MCP_BASE_URL=http://127.0.0.1:8081/feuerwerk/

feuerwerk_serve() {
  local root
  root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)

  mkdir -p "$root/data/projects" "$root/data/textures"
  node "$root/tools/ci/project-shells.mjs"
  # The sign-in checks type wrong passwords on purpose, and every request here comes from one
  # address: two runs within 15 minutes would lock the second one out (#427).
  rm -rf "$root/data/sign-ins"

  # Since #177 the API needs a session, and the check tools sign in as `e2e`. A fresh checkout has
  # no accounts at all, so the job makes the one it needs, with a password of its own.
  if [ ! -f "$root/data/e2e-password.txt" ]; then
    head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-password.txt"
    echo >>"$root/data/e2e-password.txt"
  fi
  php "$root/tools/make-user.php" e2e "$(cat "$root/data/e2e-password.txt")"
  # The user management step (#179) needs an administrator of its own; it owns no project.
  if [ ! -f "$root/data/e2e-admin-password.txt" ]; then
    head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-admin-password.txt"
    echo >>"$root/data/e2e-admin-password.txt"
  fi
  php "$root/tools/make-user.php" e2e-admin "$(cat "$root/data/e2e-admin-password.txt")" admin
  # The key the relay asks the API with.
  if [ ! -f "$root/data/mcp-relay.key" ]; then
    head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' >"$root/data/mcp-relay.key"
    echo >>"$root/data/mcp-relay.key"
  fi

  # A server from an earlier step of the same job is fine to keep. Asked of the one route that
  # answers without a session, so "is it up" does not depend on being signed in.
  if curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
    echo "server already up at $FEUERWERK_BASE_URL"
    feuerwerk_relay "$root"
    return 0
  fi

  mkdir -p /srv && ln -sfn "$root" /srv/feuerwerk
  # Uploaded videos are converted by the worker (#402); on stein2 that is the container
  # feuerwerk-video, here a process beside the server.
  php "$root/tools/video-worker.php" "$root/data" >/tmp/video-worker.log 2>&1 &
  # Without workers the single-threaded dev server stalls: the editor fetches project and
  # textures in parallel. The router serves videos with Range requests, see there.
  PHP_CLI_SERVER_WORKERS=8 php -S 0.0.0.0:8080 -t /srv "$root/tools/ci/router.php" >/tmp/php-server.log 2>&1 &

  for _ in $(seq 60); do
    curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1 && break
    sleep 0.5
  done
  if ! curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
    echo "the server never came up" >&2
    tail -20 /tmp/php-server.log >&2
    return 1
  fi
  echo "serving $root at $FEUERWERK_BASE_URL"
  feuerwerk_relay "$root"
}

# Starts the relay unless it answers already: without a token it says 401.
feuerwerk_relay() {
  local root=$1
  local mcp="${FEUERWERK_MCP_BASE_URL}mcp"
  [ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
  FEUERWERK_MCP_API="${FEUERWERK_BASE_URL}api/index.php" \
    FEUERWERK_MCP_ORIGINS=http://127.0.0.1:8081 \
    FEUERWERK_MCP_HOST=127.0.0.1 FEUERWERK_MCP_PORT=8081 \
    FEUERWERK_MCP_BACKEND=http://127.0.0.1:8080 \
    node "$root/tools/mcp/serve.mjs" >/tmp/mcp-relay.log 2>&1 &
  for _ in $(seq 40); do
    [ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
    sleep 0.25
  done
  echo "the MCP relay never came up" >&2
  tail -20 /tmp/mcp-relay.log >&2
  return 1
}