#!/bin/bash

# Authentication Security Enhancement Deployment Script
# This script helps safely deploy auth security enhancements

set -e

echo "=== PicPeak Authentication Security Deployment ==="
echo ""

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Check if we're in the backend directory
if [ ! -f "package.json" ] || [ ! -d "src" ]; then
    echo -e "${RED}Error: Must run from backend directory${NC}"
    exit 1
fi

# Function to prompt for confirmation
confirm() {
    read -p "$1 (y/n): " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        echo -e "${YELLOW}Deployment cancelled${NC}"
        exit 1
    fi
}

echo "This script will help deploy authentication security enhancements"
echo ""
echo "Current deployment phase options:"
echo "1. Run database migrations only (safe)"
echo "2. Test enhanced auth endpoints"
echo "3. Switch to enhanced auth (full deployment)"
echo "4. Rollback to original auth"
echo ""

read -p "Select phase (1-4): " PHASE

case $PHASE in
    1)
        echo -e "${GREEN}Phase 1: Running database migrations${NC}"
        confirm "Run migrations?"
        
        echo "Creating backup..."
        cp database.db database.db.backup.$(date +%Y%m%d_%H%M%S) 2>/dev/null || true
        
        echo "Running migrations..."
        npx knex migrate:latest
        
        echo -e "${GREEN}✓ Migrations completed${NC}"
        echo "New tables added: login_attempts"
        echo "New columns added to admin_users: password_changed_at, last_login_ip"
        ;;
        
    2)
        echo -e "${GREEN}Phase 2: Testing enhanced auth${NC}"
        
        # Check if server is running
        if ! curl -s http://localhost:3001/health > /dev/null; then
            echo -e "${RED}Server not running on port 3001${NC}"
            exit 1
        fi
        
        echo "Running auth security tests..."
        node scripts/test-auth-security.js
        
        echo ""
        echo "Test endpoints manually:"
        echo "- Login: POST /api/auth/admin/login"
        echo "- Logout: POST /api/auth/logout"
        echo "- Session: GET /api/auth/session"
        ;;
        
    3)
        echo -e "${YELLOW}Phase 3: Full deployment${NC}"
        echo "This will switch to enhanced authentication"
        confirm "Deploy enhanced auth?"
        
        # Check if migrations are run
        if ! npx knex migrate:status | grep -q "015_add_login_attempts_table"; then
            echo -e "${RED}Error: Migrations not run. Run phase 1 first.${NC}"
            exit 1
        fi
        
        echo "Updating server.js to use enhanced auth..."
        # This is where you'd update the imports
        # For safety, we'll just show what needs to be done
        
        echo -e "${YELLOW}Manual steps required:${NC}"
        echo "1. Edit server.js"
        echo "2. Change: const authRoutes = require('./src/routes/auth');"
        echo "   To: const authRoutes = require('./src/routes/auth-enhanced');"
        echo "3. Restart the application"
        echo ""
        echo "After restart, the enhanced auth will be active with:"
        echo "- Account lockout protection"
        echo "- Login attempt tracking"
        echo "- Enhanced security logging"
        ;;
        
    4)
        echo -e "${RED}Phase 4: Rollback${NC}"
        confirm "Rollback auth changes?"
        
        echo "Rolling back to original auth..."
        echo ""
        echo -e "${YELLOW}Manual steps required:${NC}"
        echo "1. Edit server.js"
        echo "2. Change: const authRoutes = require('./src/routes/auth-enhanced');"
        echo "   To: const authRoutes = require('./src/routes/auth');"
        echo "3. Restart the application"
        echo ""
        echo "Optional: Clear lockouts"
        echo "sqlite3 database.db \"DELETE FROM login_attempts WHERE success = 0\""
        ;;
        
    *)
        echo -e "${RED}Invalid option${NC}"
        exit 1
        ;;
esac

echo ""
echo -e "${GREEN}Done!${NC}"
echo ""
echo "Monitor logs after any changes:"
echo "docker-compose logs -f backend | grep -i auth"