#!/usr/bin/env bash
# 重建并上线 governance api + web（本机 docker build 需要宿主代理 + --network host）
set -u
cd /home/zheromiku/knowledge-governance || exit 1
TS=$(date +%Y%m%d-%H%M%S)
PROXY_ARGS=(--build-arg HTTP_PROXY=http://127.0.0.1:7890 --build-arg HTTPS_PROXY=http://127.0.0.1:7890 --build-arg NO_PROXY=localhost,127.0.0.1 --build-arg GOPROXY=https://goproxy.cn,direct)

echo "=== 1. 打回滚标签 ($TS)"
docker tag knowledge-governance-p1-api:latest "knowledge-governance-p1-api:rollback-$TS" || exit 1
docker tag knowledge-governance-p1-web:latest "knowledge-governance-p1-web:rollback-$TS" || exit 1

echo "=== 2. 构建 api"
docker build --network host "${PROXY_ARGS[@]}" -f Dockerfile -t knowledge-governance-p1-api:latest . || { echo "API_BUILD_FAILED"; exit 1; }

echo "=== 3. 构建 web"
docker build --network host "${PROXY_ARGS[@]}" -f Dockerfile.web -t knowledge-governance-p1-web:latest . || { echo "WEB_BUILD_FAILED"; exit 1; }

echo "=== 4. 上线 api + web（不动依赖）"
# COMPOSE_FILES 让调用方叠加发布接线 / 门禁 override，默认只有基础 compose.yaml。
# 例：COMPOSE_FILES="-f compose.yaml -f compose.release-sim.yaml" bash scripts/deploy-api-web.sh
#
# 注意（2026-10-10 实测踩到）：重建 api 时若不叠加 compose.release-gates.yaml，两道生产门禁会被
# **静默关掉**（PRODUCTION_RELEASE_REQUESTS_ENABLED/BACKUP_RESTORE_VERIFIED=false），页面只在点击
# 「授权发布」时回一句 "production release requests are disabled" —— 很容易误判成功能坏了。
# 因此下面做前置保护：正在运行的 api 若已开闸、而本次没叠加门禁文件，直接拒绝（确要关闸用 ALLOW_GATE_OFF=1）。
COMPOSE_FILES_EFFECTIVE="${COMPOSE_FILES:--f compose.yaml}"
GATES_PREV=$(docker exec knowledge-governance-p1-api-1 sh -lc 'printf %s "${PRODUCTION_RELEASE_REQUESTS_ENABLED:-}"' 2>/dev/null || true)
if [ "${GATES_PREV}" = "true" ] && [[ "${COMPOSE_FILES_EFFECTIVE}" != *compose.release-gates.yaml* ]] && [ "${ALLOW_GATE_OFF:-0}" != "1" ]; then
  echo "REFUSED_WOULD_CLOSE_PRODUCTION_GATES"
  echo "  当前 api 已开闸（PRODUCTION_RELEASE_REQUESTS_ENABLED=true），而本次 COMPOSE_FILES 不含 compose.release-gates.yaml，"
  echo "  继续会用基础 compose 重建 api → 生产授权接口被静默关闭。"
  echo "  保留门禁：COMPOSE_FILES=\"-f compose.yaml -f compose.release-sim.yaml -f compose.release-gates.yaml\" bash scripts/deploy-api-web.sh"
  echo "  确实要关闸：ALLOW_GATE_OFF=1 bash scripts/deploy-api-web.sh"
  exit 1
fi
docker compose ${COMPOSE_FILES_EFFECTIVE} up -d --no-build --no-deps api web || { echo "UP_FAILED"; exit 1; }

echo "=== 5. 状态"
docker ps --filter name=knowledge-governance-p1 --format '{{.Names}} {{.Status}} {{.Image}}'
echo "api image=$(docker inspect -f '{{.Image}}' knowledge-governance-p1-api-1)"
echo "web image=$(docker inspect -f '{{.Image}}' knowledge-governance-p1-web-1)"
echo "=== 6. 健康"
echo "health=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8088/health)"
echo "=== 7. 生产端点环境变量（只报名字与非空）"
docker exec knowledge-governance-p1-api-1 sh -lc 'for v in PRODUCTION_WEKNORA_BASE_URL PRODUCTION_WEKNORA_API_KEY_FILE PRODUCTION_WEKNORA_ALLOW_DOCKER_HTTP; do eval "val=\$$v"; if [ -n "$val" ]; then echo "$v=<set>"; else echo "$v=<empty>"; fi; done'
echo "=== 7b. 生产门禁状态（重建后必须与预期一致）"
docker exec knowledge-governance-p1-api-1 sh -lc 'for v in PRODUCTION_RELEASE_REQUESTS_ENABLED PRODUCTION_BACKUP_RESTORE_VERIFIED; do eval "val=\$$v"; echo "$v=${val:-<empty>}"; done'
echo "=== 8. 新包"
docker exec knowledge-governance-p1-web-1 sh -lc 'grep -o "index-[A-Za-z0-9_-]*\.js" /usr/share/nginx/html/index.html | head -1'
echo "DONE"