#!/bin/sh
set -e

ENV=$1

if [ "$ENV" != "staging" ] && [ "$ENV" != "production" ]; then
  echo "The \`ENV\` variable should be set to \`staging\` or \`production\`." >&2
  exit 1
fi

if [ -z "$CLOUDFLARE_TOKEN" ]; then
  echo "CLOUDFLARE_TOKEN is missing"
  exit 1;
fi;

if [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
  echo "CLOUDFLARE_ACCOUNT_ID is missing"
  exit 1;
fi;

if [ -z "$CLOUDFLARE_KV_ID" ]; then
  echo "CLOUDFLARE_KV_ID is missing"
  exit 1;
fi;

if [ -z "$SONGWHIP_WEB_PUBLIC_ENDPOINT" ]; then
  echo "SONGWHIP_WEB_PUBLIC_ENDPOINT is missing"
  exit 1;
fi;


if [ -z "$SONGWHIP_WEB_ORIGIN_ENDPOINT" ]; then
  echo "SONGWHIP_WEB_ORIGIN_ENDPOINT is missing"
  exit 1;
fi;

if [ -z "$SONGWHIP_API_ENDPOINT" ]; then
  echo "SONGWHIP_API_ENDPOINT is missing"
  exit 1;
fi;

if [ -z "$SONGWHIP_ENV" ]; then
  echo "SONGWHIP_ENV is missing"
  exit 1;
fi;

# clear the local wrangler cache which stores the account-id
# meaning we get permission errors when changing account
rm -rf node_modules/.cache/wrangler

WRANGLER_FILE="wrangler.tmp.toml"
WORKER_ID="songwhip-web-$ENV"
DIR="$( cd "$( dirname "$0" )" && pwd )"

# An osx & linux compatible wrapper around `sed -i`
# https://stackoverflow.com/a/525612/516629
findAndReplace() {
  if [[ "$OSTYPE" == "darwin"* ]]; then
    sed -i "" "$@"
  else
    sed -i "$@"
  fi
}

# create temp wrangler config file
#
# Non-secret HLS proxy vars (HLS_UPSTREAM_HOST, HLS_DIRECT_DOMAINS) are baked
# into the Worker script at build time via webpack DefinePlugin — they're
# read from process.env in the deploy environment. Secret material
# (HLS_CLOUDFRONT_PRIVATE_KEY, CLOUDFRONT_KEY_PAIR_ID) is pushed separately
# via `wrangler secret put` below so it lives encrypted at rest.
echo "name = \"$WORKER_ID\"
main = \"dist/worker.js\"
compatibility_date = \"2022-09-05\"

kv_namespaces = [
  { binding = \"KV_PAGES\", id = \"${CLOUDFLARE_KV_ID}\" },
]

[vars]
HLS_UPSTREAM_HOST = \"${HLS_UPSTREAM_HOST}\"
HLS_DIRECT_DOMAINS = \"${HLS_DIRECT_DOMAINS:-songwhip.com,sng.to,orch.stream}\"

[build]
command = \"yarn build\"" > $WRANGLER_FILE

echo "deploy the worker"

CLOUDFLARE_KV_ID=$CLOUDFLARE_KV_ID \
CLOUDFLARE_ACCOUNT_ID=$CLOUDFLARE_ACCOUNT_ID \
CLOUDFLARE_API_TOKEN=$CLOUDFLARE_TOKEN \
wrangler publish --config $WRANGLER_FILE

# Push HLS CloudFront signing secrets into Worker Secrets (encrypted at rest).
# Only attempted when the env vars are set so local/CI smoke runs without
# secrets still succeed at the publish step above.
if [ -n "$HLS_CLOUDFRONT_PRIVATE_KEY" ]; then
  echo "syncing HLS_CLOUDFRONT_PRIVATE_KEY secret"
  printf '%s' "$HLS_CLOUDFRONT_PRIVATE_KEY" | \
    CLOUDFLARE_ACCOUNT_ID=$CLOUDFLARE_ACCOUNT_ID \
    CLOUDFLARE_API_TOKEN=$CLOUDFLARE_TOKEN \
    wrangler secret put HLS_CLOUDFRONT_PRIVATE_KEY --name "$WORKER_ID"
fi

if [ -n "$CLOUDFRONT_KEY_PAIR_ID" ]; then
  echo "syncing CLOUDFRONT_KEY_PAIR_ID secret"
  printf '%s' "$CLOUDFRONT_KEY_PAIR_ID" | \
    CLOUDFLARE_ACCOUNT_ID=$CLOUDFLARE_ACCOUNT_ID \
    CLOUDFLARE_API_TOKEN=$CLOUDFLARE_TOKEN \
    wrangler secret put CLOUDFRONT_KEY_PAIR_ID --name "$WORKER_ID"
fi

WORKER_URL="https://dash.cloudflare.com/$CLOUDFLARE_ACCOUNT_ID/workers/view/$WORKER_ID"

# Set as 'output' value of github action as defined in action.yml
echo $WORKER_URL


rm $WRANGLER_FILE