pipeline {
    agent any

    options {
        ansiColor('xterm')
        timestamps()
        buildDiscarder logRotator(
            artifactDaysToKeepStr: '30',
            artifactNumToKeepStr: '100',
            daysToKeepStr: '365',
            numToKeepStr: '1000'
        )
        timeout(time: 6000, unit: 'MINUTES')
    }

  parameters {
    choice(name: 'PROCESS_MODE', choices: ['US','GB','AGGREGATE','SAP_SETTLEMENT'], description: 'Select processing mode (US=Regular US/Early feeds, GB=Regular UK, AGGREGATE=Aggregate feeds, SAP_SETTLEMENT=SAP Settlement Feed to S3)')
    choice(name: 'SFTP_TRANSFER_ENABLED', choices: ['No','Yes'], description: 'Transfer files via SFTP? (Stars feeds only)')
    choice(name: 'TRANSFER_MODE', choices: ['Individual Files','Zip File','Both'], description: 'What to transfer: individual files, zip archive, or both')
    string(name: 'SFTP_HOST', defaultValue: 'ftp.sme-dsr.com', description: 'SFTP Host')
    string(name: 'SFTP_USER', defaultValue: 'FTP_Orchard', description: 'SFTP Username')
    string(name: 'SFTP_FOLDER', defaultValue: 'monthly', description: 'Remote SFTP folder')
    // Prefer Jenkins Credentials for SFTP password; parameter retained only as fallback.
    // Remove if enforcing credentials-only.
    password(name: 'SFTP_PASSWORD', defaultValue: '', description: 'Deprecated: Prefer Jenkins Credentials')
    // S3 Transfer Parameters
    choice(name: 'S3_TRANSFER_ENABLED', choices: ['No','Yes'], description: 'Transfer feed files to S3? (whitelisted modes only)')
    choice(name: 'S3_GZIP_ENABLED', choices: ['Yes','No'], description: 'Gzip files before S3 transfer?')
    choice(name: 'S3_TRANSFER_MODE', choices: ['Individual Files','Zip File','Both','None'], description: 'What to transfer to S3: individual files, zip, both, or none')
    string(name: 'S3_BUCKET', defaultValue: 'prod-abacus-sap', description: 'S3 bucket name')
    string(name: 'S3_FOLDER', defaultValue: 'bw_settlement_files', description: 'S3 folder/prefix')
    string(name: 'S3_ALLOWED_MODES', defaultValue: 'SAP_SETTLEMENT', description: 'Comma-separated PROCESS_MODE values authorised for S3 transfer')
    string(name: 'PERIOD_ID', defaultValue: '', description: 'Period ID for feed processing')
  }

  environment {
    PYTHON_VERSION = '3.11.2'
    LOGGER_NAME = 'sme-feed-file-exporter'
    // Map Jenkins parameters to environment variables consumed by config.py
    PROCESS_MODE = "${params.PROCESS_MODE}"
    SFTP_TRANSFER_ENABLED = "${params.SFTP_TRANSFER_ENABLED == 'Yes' ? 'True' : 'False'}"
    TRANSFER_MODE = "${params.TRANSFER_MODE}"
    SFTP_HOST = "${params.SFTP_HOST}"
    SFTP_USER = "${params.SFTP_USER}"
    SFTP_FOLDER = "${params.SFTP_FOLDER}"
    // SFTP_PASSWORD will be injected via withCredentials in the run stage when available.
    SFTP_PASSWORD = "${params.SFTP_PASSWORD}"
    // S3 Transfer environment variables
    S3_TRANSFER_ENABLED = "${params.S3_TRANSFER_ENABLED == 'Yes' ? 'True' : 'False'}"
    S3_GZIP_ENABLED = "${params.S3_GZIP_ENABLED == 'Yes' ? 'True' : 'False'}"
    S3_TRANSFER_MODE = "${params.S3_TRANSFER_MODE}"
    S3_BUCKET = "${params.S3_BUCKET}"
    S3_FOLDER = "${params.S3_FOLDER}"
    S3_ALLOWED_MODES = "${params.S3_ALLOWED_MODES}"
    PERIOD_ID = "${params.PERIOD_ID}"
  }

  stages {
    stage('Prep') {
      steps {
        echo 'Preparing Python environment'
        sh '''
            python3 --version
        '''
      }
    }
    stage('Setup Python Environment') {
      steps {
          sh '''
              python3 -m venv venv
              . venv/bin/activate
              pip install --upgrade pip
              pip install -r requirements.txt
          '''
      }
    }
    stage('Run Feed Exporter') {
      steps {
        script {
          if (env.SFTP_TRANSFER_ENABLED == 'True') {
            // Dynamically fetch the SFTP server's public host key so that
            // paramiko's RejectPolicy can verify it without requiring a
            // pre-populated ~/.ssh/known_hosts on the agent.
            // ssh-keyscan output is public key material — not a secret.
            def knownHost = sh(
              script: "ssh-keyscan -H ${env.SFTP_HOST} 2>/dev/null",
              returnStdout: true
            ).trim()
            if (!knownHost) {
              error("ssh-keyscan returned no output for '${env.SFTP_HOST}'. " +
                    "Verify the host is reachable and SFTP_HOST is correct.")
            }
            withEnv(["SFTP_KNOWN_HOST=${knownHost}"]) {
              sh '''
                . venv/bin/activate
                python feed_file_exporter.py
              '''
            }
          } else {
            sh '''
              . venv/bin/activate
              python feed_file_exporter.py
            '''
          }
        }
      }
    }
    stage('Archive Artifacts') {
      steps {
        script {
          // Archive generated feed files and zip archives
          archiveArtifacts artifacts: 'output/**/*', allowEmptyArchive: true
        }
      }
    }
  }
    post {
        always {
            script {
                // Clean up virtual environment
                sh 'rm -rf venv'
            }
        }
        success {
          echo 'Feed export completed successfully.'
        }
        failure {
          echo 'Feed export job failed.'
        }
        unstable {
            echo 'Feed export job completed with warnings!'
        }
    }
}

// EXECUTION JENKINSFILE: Runs the actual feed export with all parameters.
// For CI/CD testing and linting only, use the main Jenkinsfile instead.
// SFTP credentials (username + private key PEM) are fetched at runtime from
// AWS Secrets Manager via SFTP_USERNAME_SECRET and SFTP_PRIVATE_KEY_SECRET.
// The server host key is fetched dynamically via ssh-keyscan when SFTP is enabled.