#!/usr/bin/env bash

set -euo pipefail

project_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)

inventory_path=${INVENTORY_PATH:-"$project_root/inventory/hosts.yaml"}

upstream_hosts_file=${UPSTREAM_HOSTS_FILE:-}

upstream_ssh_target=${UPSTREAM_SSH_TARGET:-nextgen@192.168.2.103}

upstream_hosts_path=${UPSTREAM_HOSTS_PATH:-/home/nextgen/projects/ssh-infrastructure/inventory/hosts.yaml}

local_is_jumper_identity_file=${LOCAL_IS_JUMPER_IDENTITY_FILE:-}

if [[ -z "$local_is_jumper_identity_file" ]]; then

    local_is_jumper_identity_file='~/.ssh/keys/is-jumper_ed25519'

fi

deploy_after_sync=${DEPLOY_AFTER_SYNC:-1}

force_deploy=${FORCE_DEPLOY:-0}

tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/ssh-infra-sync.XXXXXX")

trap 'rm -rf "$tmpdir"' EXIT

tmp_hosts="$tmpdir/hosts.yaml"

tmp_generated="$tmpdir/generated"

if [[ -n "$upstream_hosts_file" ]]; then

    cp "$upstream_hosts_file" "$tmp_hosts"

else

    /usr/bin/scp -q "${upstream_ssh_target}:${upstream_hosts_path}" "$tmp_hosts"

fi

python3 - "$tmp_hosts" "$local_is_jumper_identity_file" <<'PY'

from pathlib import Path

import sys

import yaml

path = Path(sys.argv[1])

identity_file = sys.argv[2]

text = path.read_text(encoding="utf-8")

with path.open("r", encoding="utf-8") as handle:

    data = yaml.safe_load(handle)

is_jumper = data.get("entrypoints", {}).get("is_jumper", {})

if (

    is_jumper.get("identity_file") == identity_file

    and is_jumper.get("identities_only") is True

):

    raise SystemExit(0)

lines = text.splitlines(keepends=True)

entrypoints_idx = None

for idx, line in enumerate(lines):

    if line.strip() == "entrypoints:" and not line.startswith((" ", "\t")):

        entrypoints_idx = idx

        break

if entrypoints_idx is None:

    raise SystemExit("missing entrypoints section")

is_jumper_idx = None

for idx in range(entrypoints_idx + 1, len(lines)):

    line = lines[idx]

    if line and not line.startswith((" ", "\t")) and line.strip():

        break

    if line.startswith("  is_jumper:"):

        is_jumper_idx = idx

        break

if is_jumper_idx is None:

    raise SystemExit("missing entrypoints.is_jumper section")

block_end = len(lines)

for idx in range(is_jumper_idx + 1, len(lines)):

    line = lines[idx]

    if line.strip() and not line.startswith("    "):

        block_end = idx

        break

identity_line = f"    identity_file: {identity_file}\n"

identities_only_line = "    identities_only: true\n"

identity_idx = None

identities_only_idx = None

for idx in range(is_jumper_idx + 1, block_end):

    stripped = lines[idx].strip()

    if stripped.startswith("identity_file:"):

        identity_idx = idx

    elif stripped.startswith("identities_only:"):

        identities_only_idx = idx

if identity_idx is None:

    insert_at = identities_only_idx if identities_only_idx is not None else block_end

    lines.insert(insert_at, identity_line)

    if identities_only_idx is not None:

        identities_only_idx += 1

        block_end += 1

else:

    lines[identity_idx] = identity_line

if identities_only_idx is None:

    insert_at = (identity_idx + 1) if identity_idx is not None else block_end

    lines.insert(insert_at, identities_only_line)

else:

    lines[identities_only_idx] = identities_only_line

path.write_text("".join(lines), encoding="utf-8")

PY

python3 "$project_root/tools/generate-configs.py" \

    --inventory "$tmp_hosts" \

    --output-dir "$tmp_generated"

if cmp -s "$tmp_hosts" "$inventory_path"; then

    printf 'inventory unchanged: %s\n' "$inventory_path"

    if [[ "$deploy_after_sync" == "1" && "$force_deploy" == "1" ]]; then

        "$project_root/tools/deploy-local.sh"

    fi

    exit 0

fi

install -m 644 "$tmp_hosts" "$inventory_path"

printf 'updated inventory from upstream: %s\n' "$inventory_path"

if [[ "$deploy_after_sync" == "1" ]]; then

    "$project_root/tools/deploy-local.sh"

else

    printf 'skipped deploy because DEPLOY_AFTER_SYNC=%s\n' "$deploy_after_sync"

fi