#!/usr/bin/env bash
# jobseeker-platform.sh — Lapisan platform jobseeker untuk mesin Hermes BARU.
# Jalankan SETELAH bootstrap-mesin.sh berhasil (VNC stack + webhook + CDP).
#
# Yang dilakukan (idempotent):
#   1. Tooling jobseeker  → /opt/data/jobseeker/ (accounts, quota, report, sync, portal-check, vnc-token, mock BE)
#   2. Skill jobseeker    → /opt/data/skills/jobseeker/jobseeker-agent/SKILL.md
#   3. API server Hermes  → aktifkan port 8642 + generate API_SERVER_KEY di /opt/data/.env
#   4. Template config    → /opt/data/jobseeker/agent-config.env (isi manual oleh operator)
#   5. Restart gateway    → agar config API server aktif
#
# Pemakaian:
#   bash jobseeker-platform.sh            # normal (unduh dari mesin utama)
#   SRC_BASE=... bash jobseeker-platform.sh   # ganti sumber file (default mesin utama)
#
# Setelah selesai: kumpulkan 2 nilai untuk didaftarkan ke BE user_service:
#   - API_SERVER_KEY  (dari /opt/data/.env)      → kolom api_key
#   - vnc-jwt-secret  (dari run/vnc-jwt-secret)  → kolom vnc_jwt_secret
set -u

SRC_BASE="${SRC_BASE:-https://hermes-3s1llz-6080.jkt3.sumopod.my.id}"
HERMES_BIN="$(command -v hermes || echo /opt/hermes/bin/hermes)"
# Hermes home: HERMES_HOME env → fallback /opt/data (standar SumoPod) → $HOME/.hermes
HH="${HERMES_HOME:-}"
if [ -z "$HH" ]; then
  HH="/opt/data"
  [ -f "$HOME/.hermes/config.yaml" ] && HH="$HOME/.hermes"
fi
ENV_FILE="$HH/.env"
JS_DIR="$HH/jobseeker"
# VNC stack hidup di $HOME/vncsetup (konvensi bootstrap) — JANGAN pakai $HH
VNC_RUN="$HOME/vncsetup/run"

ok()   { echo "  ✓ $*"; }
info() { echo "→ $*"; }
fail() { echo "  ✗ $*"; exit 1; }

info "1/5 — Tooling jobseeker → $JS_DIR"
mkdir -p "$JS_DIR"
for f in accounts.py check-quota.py report-application.py sync-profile.py \
         portal-check.py vnc-token.py test_be_listener.py \
         agent-config.env.example; do
  curl -fsSL "$SRC_BASE/$f" -o "$JS_DIR/$f" || fail "gagal unduh $f dari $SRC_BASE"
done
chmod +x "$JS_DIR"/*.py "$JS_DIR"/*.sh 2>/dev/null
ok "tooling siap ($(ls "$JS_DIR" | wc -l) file)"

# venv CDP (untuk portal-check.py — WebSocket ke Chrome, watchdog status login)
if [ ! -x /opt/data/venv-cdp/bin/python ]; then
  info "venv-cdp dibuat (websocket-client)..."
  uv venv /opt/data/venv-cdp 2>/dev/null || python3 -m venv /opt/data/venv-cdp
  uv pip install --python /opt/data/venv-cdp/bin/python websocket-client >/dev/null 2>&1 \
    || /opt/data/venv-cdp/bin/pip install -q websocket-client
  ok "venv-cdp siap"
else
  ok "venv-cdp sudah ada"
fi
# pymupdf (baca/parse CV PDF — untuk pretest & verifikasi kriteria)
if ! /opt/data/venv-cdp/bin/python -c "import pymupdf" 2>/dev/null; then
  info "pymupdf diinstall (baca PDF/CV)..."
  uv pip install --python /opt/data/venv-cdp/bin/python pymupdf >/dev/null 2>&1 \
    || /opt/data/venv-cdp/bin/pip install -q pymupdf
  ok "pymupdf siap"
else
  ok "pymupdf sudah ada"
fi

info "2/5 — Skill jobseeker (base + 5 portal) via hermes skills install → direktori benar"
for sfx in jobseeker-agent-SKILL.md jobseeker-portal-jobstreet-SKILL.md jobseeker-portal-glints-SKILL.md \
           jobseeker-portal-linkedin-SKILL.md jobseeker-portal-indeed-SKILL.md jobseeker-portal-kalibrr-SKILL.md; do
  if "$HERMES_BIN" skills install "$SRC_BASE/$sfx" --category jobseeker --yes >/dev/null 2>&1; then
    ok "skill $sfx siap"
  else
    name="${sfx%-SKILL.md}"
    mkdir -p "$HH/skills/jobseeker/$name"
    curl -fsSL "$SRC_BASE/$sfx" -o "$HH/skills/jobseeker/$name/SKILL.md" || fail "gagal unduh skill $sfx"
    ok "skill $sfx (fallback manual)"
  fi
done

# ── 3. API server Hermes + kompatibilitas provider ───────────────────────────
info "3/5 — API server Hermes (port 8642) + model provider"

# api_mode: provider SumoPod (ai.sumopod.com) TIDAK punya /responses — Hermes
# default memakai mode 'responses' → 404 model not found. Paksa chat_completions.
"$HERMES_BIN" config set model.api_mode chat_completions >/dev/null 2>&1 \
  && ok "model.api_mode = chat_completions" \
  || warn "gagal set model.api_mode (cek manual: hermes config get model.api_mode)"
NEED_RESTART=0
BEFORE=$("$HERMES_BIN" config get platforms.api_server.enabled 2>/dev/null || true)
"$HERMES_BIN" config set platforms.api_server.enabled true >/dev/null 2>&1 || fail "hermes config set gagal"
"$HERMES_BIN" config set platforms.api_server.extra.port 8642 >/dev/null 2>&1
"$HERMES_BIN" config set platforms.api_server.extra.host 127.0.0.1 >/dev/null 2>&1
AFTER=$("$HERMES_BIN" config get platforms.api_server.enabled 2>/dev/null || true)
[ "$BEFORE" != "$AFTER" ] && NEED_RESTART=1

# ── API_SERVER_KEY: DEFAULT = HASIL GENERATE di /opt/data/.env ───────────────
# (keputusan: mesin baru default pakai key hasil generate, BUKAN container env.
#  Kalau container settings ikut punya API_SERVER_KEY dengan nilai BEDA, dotenv
#  tidak menimpa env → nilai container yang dipakai → chat FE 401. Warning di bawah.)
touch "$ENV_FILE"; chmod 600 "$ENV_FILE"
EFFECTIVE_KEY=""
if grep -q '^API_SERVER_KEY=' "$ENV_FILE"; then
  EFFECTIVE_KEY=$(grep '^API_SERVER_KEY=' "$ENV_FILE" | cut -d= -f2-)
  ok "API_SERVER_KEY dari .env (sudah ada)"
else
  EFFECTIVE_KEY=$(openssl rand -hex 32)
  printf 'API_SERVER_KEY=%s\n' "$EFFECTIVE_KEY" >> "$ENV_FILE"
  ok "API_SERVER_KEY di-generate → $ENV_FILE"
fi
if [ -n "${API_SERVER_KEY:-}" ] && [ "$API_SERVER_KEY" != "$EFFECTIVE_KEY" ]; then
  warn "ENV CONTAINER punya API_SERVER_KEY BEDA → akan MENIMPA key .env → chat FE 401!"
  warn "HAPUS API_SERVER_KEY dari container settings (default = pakai hasil generate),"
  warn "atau samakan nilainya dengan isi $ENV_FILE."
fi
export EFFECTIVE_KEY

info "4/5 — Template config agent"
if [ -f "$JS_DIR/agent-config.env" ]; then
  ok "agent-config.env sudah ada (biarkan)"
else
  cp "$JS_DIR/agent-config.env.example" "$JS_DIR/agent-config.env"
  echo "  → agent-config.env dibuat — ISI MANUAL: BE_API_URL, BE_INTERNAL_TOKEN, USER_ID"
fi

info "5/5 — Restart gateway (hanya jika config API server berubah)"
if [ "$NEED_RESTART" = "1" ]; then
  echo "  → config platform berubah; restart gateway dijadwalkan +180 dtk"
  echo "    (detached — jeda agar tidak bentrok dengan restart bootstrap +60 dtk)"
  setsid nohup bash -c "sleep 180; $HERMES_BIN gateway restart >/dev/null 2>&1" >/dev/null 2>&1 &
else
  ok "config API server sudah aktif — tidak perlu restart"
fi

echo
echo "═══════════════ RINGKASAN UNTUK DAFTAR KE BE (user_service) ═══════════════"
API_KEY="$(grep '^API_SERVER_KEY=' "$ENV_FILE" | cut -d= -f2- | tr -d '[:space:]')"
VNC_SECRET="$(cat "$VNC_RUN/vnc-jwt-secret" 2>/dev/null || echo '(belum ada — jalankan start-vnc.sh dulu)')"
echo "  api_key        = $API_KEY"
echo "  vnc_jwt_secret = $VNC_SECRET"
echo
echo "  vnc_url        = wss://<hostname-mesin>-6080.jkt3.sumopod.my.id/websockify"
echo "  base_url       = https://<hostname-mesin>-8642.jkt3.sumopod.my.id"
echo "══════════════════════════════════════════════════════════════════════════"
echo
echo "Langkah berikutnya (manual oleh operator):"
echo "  1. Panel SumoPod: buat tunnel port 6080 (noVNC) & 8642 (API)"
echo "  2. PASTIKAN API_SERVER_KEY TIDAK di-set di env container (atau nilainya SAMA dengan .env)"
echo "  3. Isi $JS_DIR/agent-config.env (BE_API_URL, BE_INTERNAL_TOKEN, USER_ID)"
echo "  4. Daftarkan 3 nilai di atas + API_SERVER_KEY ke tabel user_service BE"
echo "  5. RESTART gateway: $HERMES_BIN gateway restart"
echo "  6. Selesai — mesin siap dipakai user. Daily run di-trigger BE (scheduler BE, random 08-16 WIB, via chat proxy)."
echo
echo "API_SERVER_KEY efektif mesin ini (untuk user_service.api_key):"
echo "  ${EFFECTIVE_KEY:-<KOSONG — periksa $ENV_FILE>}"
exit 0