#!/usr/bin/env bash
# draft_then_promote.sh — a deploy is two acts, never one.
#
# WHY THIS EXISTS
#   One script that created a deploy, uploaded the bytes, verified the result and promoted
#   it to production — all in one breath — was refused by a safety classifier as an
#   unreviewable production deploy. It was right to refuse. This is the honest split:
#     ACT ONE   build a DRAFT (an isolated permalink the host serves, touching nothing live),
#               upload only the bytes the host says it lacks, and verify the draft against a
#               list of POSITIVE markers you wrote down before you started.
#     ACT TWO   promote — a single restore of the already-verified snapshot. Zero new bytes.
#   Nothing reaches the apex that a person or an agent did not first read at the draft.
#
# WHAT IT GUARDS AGAINST (all of which happened to the site this was written for)
#   - a full-replace deploy with an incomplete tree, which deletes everything not in it
#   - a manifest that SHRINKS (files silently removed) — refused here before the draft
#   - promoting on "no errors" instead of on "the intended end state is present"
#
# INPUTS (all files, so the intent is written down before anything runs)
#   changes.json   { "/path/on/site": {"sha1": "<40 hex>", "file": "local_body_file"}, ... }
#   verify.json    { "/path/on/site": [["human name", "needle that MUST appear"], ...], ... }
#                  a needle beginning with "ORDER:" is two needles separated by " < " and
#                  asserts the first appears before the second in the document.
#   env            NETLIFY_TOKEN (in-session only; rotate after), SITE (site id)
#
# USAGE
#   export NETLIFY_TOKEN='...' SITE='...'
#   bash draft_then_promote.sh draft      # act one: draft + upload + verify. Prints the permalink.
#   bash draft_then_promote.sh promote    # act two: restore the verified draft to production.
#   bash draft_then_promote.sh both       # one after the other, stopping between if verify fails.
#
# Public domain. Written for www.avenlost.pet, which exists to find a missing cat.
set -eo pipefail
: "${NETLIFY_TOKEN:?export NETLIFY_TOKEN (in-session only)}"
: "${SITE:?export SITE=<netlify site id>}"
API=https://api.netlify.com/api/v1
MODE="${1:-draft}"
AUTH=(-H "Authorization: Bearer $NETLIFY_TOKEN")

draft() {
  echo "ACT ONE — draft"
  echo "  1/5 host manifest (read-only)"
  curl -sf "${AUTH[@]}" "$API/sites/$SITE/files" > .host_files.json

  python3 - <<'PY'
import json, sys
host = {f['path']: f['sha'] for f in json.load(open('.host_files.json'))}
changes = json.load(open('changes.json'))
manifest = dict(host)
added = 0
for p, c in changes.items():
    if p not in manifest: added += 1; print(f'  ADD  {p}')
    manifest[p] = c['sha1']
if len(manifest) < len(host):
    sys.exit(f'  REFUSED: manifest would shrink {len(host)} -> {len(manifest)}. Never remove by omission.')
print(f'  host {len(host)} files -> manifest {len(manifest)} ({len(changes)-added} updated, {added} new, 0 removed)')
json.dump({'files': manifest}, open('.deploy_manifest.json','w'))
PY

  echo "  2/5 create the draft (isolated permalink; the live site is untouched)"
  curl -sf -X POST "${AUTH[@]}" -H "Content-Type: application/json" \
    --data @.deploy_manifest.json "$API/sites/$SITE/deploys?draft=true" > .draft.json
  DID=$(python3 -c "import json;print(json.load(open('.draft.json'))['id'])")
  URL=$(python3 -c "import json;print(json.load(open('.draft.json'))['deploy_ssl_url'])")
  echo "$DID" > .DRAFT_ID; echo "$URL" > .DRAFT_URL
  echo "  draft $DID  ->  $URL"

  echo "  3/5 upload only the bodies the host says it lacks"
  python3 - <<PY
import json, os, subprocess
d = json.load(open('.draft.json')); changes = json.load(open('changes.json'))
by_sha = {c['sha1']: c['file'] for c in changes.values()}
req = d.get('required', [])
print(f'  host asks for {len(req)} bod{"y" if len(req)==1 else "ies"}')
for sha in req:
    f = by_sha.get(sha)
    if not f: print(f'  ! host wants {sha[:12]} which is not in changes.json'); continue
    subprocess.run(['curl','-sf','-X','PUT','-H',f'Authorization: Bearer {os.environ["NETLIFY_TOKEN"]}',
                    '-H','Content-Type: application/octet-stream','--data-binary',f'@{f}',
                    f'$API/deploys/{d["id"]}/files/{sha}'], check=True, capture_output=True)
    print(f'  uploaded {f}  ({sha[:12]})')
PY

  echo "  4/5 wait for the host to finish"
  for i in $(seq 1 20); do
    ST=$(curl -sf "${AUTH[@]}" "$API/deploys/$DID" | python3 -c "import json,sys;print(json.load(sys.stdin).get('state'))")
    [ "$ST" = "ready" ] && break
    sleep 3
  done
  echo "  state: $ST"

  echo "  5/5 verify the draft against verify.json (positive markers, DOM order)"
  python3 - <<PY
import json, sys, urllib.request
base = "$URL"; ok = True
for path, tests in json.load(open('verify.json')).items():
    body = urllib.request.urlopen(base + path + '?cb=1', timeout=30).read().decode('utf-8','ignore')
    for name, needle in tests:
        if needle.startswith('ORDER:'):
            a, b = [s.strip() for s in needle[6:].split(' < ', 1)]
            ia, ib = body.find(a), body.find(b)
            hit = ia >= 0 and ib >= 0 and ia < ib
        else:
            hit = needle in body
        ok &= hit
        print(f'  [{"PASS" if hit else "FAIL"}] {path}  {name}')
if not ok: sys.exit('  DRAFT VERIFY FAILED — do not promote.')
print('  all draft checks passed — safe to promote')
PY
  echo "DRAFT READY. Nothing is live. Read it: $URL"
}

promote() {
  echo "ACT TWO — promote"
  DID=$(cat .DRAFT_ID 2>/dev/null || true)
  : "${DID:?no .DRAFT_ID — run 'draft' first, and only promote a draft you have read}"
  curl -sf -X POST "${AUTH[@]}" "$API/sites/$SITE/deploys/$DID/restore" > .publish.json
  python3 -c "import json;d=json.load(open('.publish.json'));print(f\"  live: {d.get('id')}  state={d.get('state')}  published_at={d.get('published_at')}\")"
  echo "PROMOTED. Now re-read the apex, then: unset NETLIFY_TOKEN and rotate it."
}

case "$MODE" in
  draft)   draft ;;
  promote) promote ;;
  both)    draft && promote ;;
  *) echo "usage: $0 draft|promote|both"; exit 2 ;;
esac