#!/bin/bash
# One-time / repeat fix for LinkedIn Connected Accounts on production.
# Run on server: cd /var/www/html/gventure/postsync_pro && bash scripts/fix-production-linkedin-env.sh

set -e

PROJECT_DIR="${PROJECT_DIR:-/var/www/html/gventure/postsync_pro}"
ENV_FILE="$PROJECT_DIR/.env.local"
APP_URL="${NEXT_PUBLIC_APP_URL:-https://postsyncpro.gventure.info}"
SOCIAL_URI="${LINKEDIN_SOCIAL_REDIRECT_URI:-$APP_URL/connected-accounts/oauth/linkedin/callback}"

if [ ! -f "$ENV_FILE" ]; then
  echo "ERROR: $ENV_FILE not found. Copy from .env.production.example first."
  exit 1
fi

cp "$ENV_FILE" "${ENV_FILE}.bak.$(date +%Y%m%d%H%M%S)"

# Ensure NEXT_PUBLIC_APP_URL
if grep -q '^NEXT_PUBLIC_APP_URL=' "$ENV_FILE"; then
  sed -i "s|^NEXT_PUBLIC_APP_URL=.*|NEXT_PUBLIC_APP_URL=$APP_URL|" "$ENV_FILE"
else
  echo "NEXT_PUBLIC_APP_URL=$APP_URL" >> "$ENV_FILE"
fi

# Connected Accounts callback (required for LinkedIn social connect)
if grep -q '^LINKEDIN_SOCIAL_REDIRECT_URI=' "$ENV_FILE"; then
  sed -i "s|^LINKEDIN_SOCIAL_REDIRECT_URI=.*|LINKEDIN_SOCIAL_REDIRECT_URI=$SOCIAL_URI|" "$ENV_FILE"
else
  echo "LINKEDIN_SOCIAL_REDIRECT_URI=$SOCIAL_URI" >> "$ENV_FILE"
fi

# Old login callback — not used by Connected Accounts; comment out to avoid confusion
sed -i 's/^LINKEDIN_REDIRECT_URI=/#LINKEDIN_REDIRECT_URI=/' "$ENV_FILE"

echo "==> LinkedIn env in $ENV_FILE:"
grep -E '^(NEXT_PUBLIC_APP_URL|LINKEDIN_)' "$ENV_FILE" | grep -v SECRET

if grep -q '^LINKEDIN_CLIENT_ID=your_linkedin_client_id' "$ENV_FILE"; then
  echo ""
  echo "ERROR: LINKEDIN_CLIENT_ID is still the placeholder. Set your real Client ID in .env.local"
  exit 1
fi

if [ -z "$(grep '^LINKEDIN_CLIENT_ID=' "$ENV_FILE" | cut -d= -f2)" ]; then
  echo "ERROR: LINKEDIN_CLIENT_ID is empty"
  exit 1
fi

echo ""
echo "==> Restart postsync-pro"
cd "$PROJECT_DIR"
pm2 restart postsync-pro || pm2 start ecosystem.config.cjs
pm2 save

echo ""
echo "==> Verify OAuth redirect (check client_id and redirect_uri in Location header)"
curl -sI "http://127.0.0.1:3033/api/social/linkedin/connect?projectId=verify" | grep -i '^location:' || true

echo ""
echo "Done. Also add this URL in LinkedIn Developer Portal → Auth → Authorized redirect URLs:"
echo "  $SOCIAL_URI"