#!/usr/bin/env bash
# Spec 037-DNS-VIEWER — backup pré-deploy (VM122 + opcional VM112/VM123)
set -euo pipefail

HOST="root@10.10.10.122"
STAMP=$(date +%Y%m%d-%H%M%S)
TAG="dns-viewer-pre-${STAMP}"

ssh_cmd() {
  if [[ -n "${SSHPASS:-}" ]] && command -v sshpass >/dev/null; then
    sshpass -e ssh -o StrictHostKeyChecking=no "$@"
  else
    ssh -o StrictHostKeyChecking=no "$@"
  fi
}

usage() {
  echo "Usage: $0 [--host root@10.10.10.122] [--wizard] [--console]"
  exit 1
}

DO_WIZARD=0
DO_CONSOLE=0

while [[ $# -gt 0 ]]; do
  case "$1" in
    --host) HOST="$2"; shift 2 ;;
    --wizard) DO_WIZARD=1; shift ;;
    --console) DO_CONSOLE=1; shift ;;
    -h|--help) usage ;;
    *) echo "Unknown: $1"; usage ;;
  esac
done

echo "=== DNS Viewer preflight — $TAG ==="
echo "Host Desk: $HOST"

ssh_cmd "$HOST" bash -s <<EOF
set -euo pipefail
BASE=/opt/ligbox-ops-platform
BK="\$BASE/.backups/dns-viewer-${STAMP}"
mkdir -p "\$BK/api" "\$BK/frontend/assets"

echo "[VM122] Backup api/app..."
cp -a "\$BASE/api/app/cloudflare_dns.py" "\$BK/api/" 2>/dev/null || true
cp -a "\$BASE/api/app/main.py" "\$BK/api/main.py.bak" 2>/dev/null || true
cp -a "\$BASE/api/app/permissions.py" "\$BK/api/" 2>/dev/null || true
[ -f "\$BASE/api/app/dns_viewer.py" ] && cp -a "\$BASE/api/app/dns_viewer.py" "\$BK/api/" || true
[ -f "\$BASE/api/app/openpanel_dns.py" ] && cp -a "\$BASE/api/app/openpanel_dns.py" "\$BK/api/" || true

echo "[VM122] Backup frontend/assets..."
cp -a "\$BASE/frontend/assets/app.js" "\$BK/frontend/assets/" 2>/dev/null || true
cp -a "\$BASE/frontend/assets/dns-viewer.js" "\$BK/frontend/assets/" 2>/dev/null || true
cp -a "\$BASE/frontend/index.html" "\$BK/frontend/" 2>/dev/null || true

echo "[VM122] Snapshot .env (sem secrets no stdout)..."
grep -E '^(DNS_VIEWER_ENABLED|CLOUDFLARE)' "\$BASE/.env" 2>/dev/null | sed 's/=.*/=***/' || true
cp -a "\$BASE/.env" "\$BK/env.bak" 2>/dev/null || true

echo "[VM122] Docker image tag..."
cd "\$BASE"
if command -v docker-compose >/dev/null; then
  IMG=\$(docker-compose -f docker-compose.mvp.yml images -q api 2>/dev/null | head -1 || true)
else
  IMG=\$(docker compose -f docker-compose.mvp.yml images -q api 2>/dev/null | head -1 || true)
fi
if [ -n "\$IMG" ]; then
  docker tag "\$IMG" "ligbox-ops-platform-api:pre-dns-viewer-${STAMP}" 2>/dev/null || \
    docker tag ligbox-ops-platform_api:latest "ligbox-ops-platform-api:pre-dns-viewer-${STAMP}" 2>/dev/null || true
fi

echo "[VM122] Backup path: \$BK"
ls -la "\$BK"
EOF

if [[ "$DO_WIZARD" -eq 1 ]]; then
  echo "=== VM112 wizard backup ==="
  ssh_cmd -o StrictHostKeyChecking=no root@10.10.10.112 bash -s <<EOF
set -euo pipefail
BK=/opt/ligbox-wizard/.backups/dns-viewer-${STAMP}
mkdir -p "\$BK"
cp -a /opt/ligbox-wizard/backend/app/services/dns_viewer.py "\$BK/" 2>/dev/null || true
cp -a /opt/ligbox-wizard/backend/app/routers/dns.py "\$BK/" 2>/dev/null || true
echo "Wizard backup: \$BK"
EOF
fi

if [[ "$DO_CONSOLE" -eq 1 ]]; then
  echo "=== VM123 console backup ==="
  ssh_cmd -o StrictHostKeyChecking=no root@10.10.10.123 bash -s <<EOF
set -euo pipefail
cd /opt/ligbox-ops-console
cp -a frontend "frontend.bak-dns-viewer-${STAMP}"
echo "Console backup: frontend.bak-dns-viewer-${STAMP}"
EOF
fi

echo ""
echo "=== Preflight OK — tag sugerida git: ${TAG} ==="
echo "Rollback: specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md"