#!/usr/bin/env bash
set -euo pipefail

# --- Minimal deps check ---
for bin in curl jq; do
  command -v "$bin" >/dev/null 2>&1 || { echo "[ERROR] Missing dependency: $bin" >&2; exit 2; }
done

# --- RabbitMQ config (override via env) ---
RMQ_USER="${RMQ_USER:-admin}"
RMQ_PASS="${RMQ_PASS:-change_me}"
RMQ_HOST="${RMQ_HOST:-localhost}"
RMQ_PORT="${RMQ_PORT:-15672}"
VHOST="${VHOST:-app}"
QUEUE="${QUEUE:-queue_controls}"
SLEEP_SECS="${SLEEP_SECS:-2}"

# --- NetBox config (override via env) ---
NB_URL="${NB_URL:-http://netbox.gt-tiso.ikeja.co.za}"
NB_TOKEN="${NB_TOKEN:-7648e4f5ee370cda7834682e61b47c2ee8e95623}"

log() { echo "[netbox-reporter] $*"; }
warn(){ echo "[netbox-reporter][WARN] $*" >&2; }
err() { echo "[netbox-reporter][ERROR] $*" >&2; }

# URL-encode for RabbitMQ HTTP API paths
urlenc() { printf '%s' "$1" | sed -e 's, ,%20,g' -e 's,/,%2F,g'; }

# Simple RabbitMQ HTTP call
rmq_api() {
  local method="$1" path="$2" data="${3:-}"
  local url="http://${RMQ_HOST}:${RMQ_PORT}${path}"
  if [[ -n "$data" ]]; then
    curl -sS -u "$RMQ_USER:$RMQ_PASS" -H "content-type:application/json" -X "$method" "$url" -d "$data"
  else
    curl -sS -u "$RMQ_USER:$RMQ_PASS" -H "content-type:application/json" -X "$method" "$url"
  fi
}

# Find NetBox device ID by exact name
nb_find_device_id() {
  local name="$1"
  local resp
  resp="$(curl -sS \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Accept: application/json" \
    "$NB_URL/api/dcim/devices/?name=$(printf '%s' "$name" | jq -sRr @uri)&limit=1")" || return 1
  jq -r '.results[0].id // empty' <<<"$resp"
}

# PATCH NetBox custom fields (update_wo_restart)
nb_patch_update_wo_restart() {
  local dev_id="$1" update_progress="$2" updating_to="$3"
  local body
  body="$(jq -n --arg p "$update_progress" --arg u "$updating_to" \
          '{custom_fields: {update_progress: $p, updating_to: $u}}')"

  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$body")" || code="000"

  if [[ "$code" =~ ^20[0-9]$ ]]; then
    log "Updated device id=$dev_id custom_fields OK"
    return 0
  else
    err "Failed to update device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# PATCH NetBox custom field: wifidebug (deploy_wifidebug)
nb_patch_wifidebug() {
  local dev_id="$1" value="$2"
  local body
  body="$(jq -n --arg v "$value" '{custom_fields: {wifidebug: $v}}')"

  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$body")" || code="000"

  if [[ "$code" =~ ^20[0-9]$ ]]; then
    log "Updated device id=$dev_id wifidebug='$value' OK"
    return 0
  else
    err "Failed to set wifidebug for device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# POST a Journal Entry on the device (journal_add) with prefix "updated: "
nb_add_journal() {
  local dev_id="$1" text="$2"
  local comment="updated: ${text}"
  local body
  body="$(jq -n --arg c "$comment" --argjson oid "$dev_id" \
          '{assigned_object_type:"dcim.device", assigned_object_id:$oid, comments:$c}')"

  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X POST "$NB_URL/api/extras/journal-entries/" \
    -d "$body")" || code="000"

  if [[ "$code" =~ ^20[0-9]$ || "$code" == "201" ]]; then
    log "Journal added for device id=$dev_id"
    return 0
  else
    err "Failed to add journal for device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# POST a Journal Entry with raw text (no prefix) — used for task_notify path
nb_add_journal_raw() {
  local dev_id="$1" text="$2"
  local body
  body="$(jq -n --arg c "$text" --argjson oid "$dev_id" \
          '{assigned_object_type:"dcim.device", assigned_object_id:$oid, comments:$c}')"

  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X POST "$NB_URL/api/extras/journal-entries/" \
    -d "$body")" || code="000"

  if [[ "$code" =~ ^20[0-9]$ || "$code" == "201" ]]; then
    log "Journal (raw) added for device id=$dev_id"
    return 0
  else
    err "Failed to add raw journal for device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# PATCH custom field: multiple_ssids = "yes" — used for task_notify path
nb_set_multiple_ssids_yes() {
  local dev_id="$1"
  local body='{"custom_fields":{"multiple_ssids":"yes"}}'

  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$body")" || code="000"

  if [[ "$code" =~ ^20[0-9]$ ]]; then
    log "Set multiple_ssids='yes' for device id=$dev_id"
    return 0
  else
    err "Failed to set multiple_ssids for device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# --- NEW: Add a tag to a device using tag slug (ensures tag exists; merges dictionaries) ---
nb_add_tag_by_slug() {
  local dev_id="$1" tag_slug="$2"

  # 1) Lookup tag by slug
  local tag_resp tag_id tag_name
  tag_resp="$(curl -sS \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Accept: application/json" \
    "$NB_URL/api/extras/tags/?slug=$(printf '%s' "$tag_slug" | jq -sRr @uri)&limit=1")" || tag_resp='{}'
  tag_id="$(jq -r '.results[0].id // empty' <<<"$tag_resp")"
  tag_name="$(jq -r '.results[0].name // empty' <<<"$tag_resp")"

  # 2) Create tag if missing
  if [[ -z "$tag_id" ]]; then
    local derived_name create_body create_tmp create_code
    derived_name="$(printf '%s' "$tag_slug" | sed -E 's/-+/ /g')"
    create_body="$(jq -n --arg name "$derived_name" --arg slug "$tag_slug" '{name:$name, slug:$slug}')"
    create_tmp="$(mktemp)"
    create_code="$(curl -sS -o "$create_tmp" -w "%{http_code}" \
      -H "Authorization: Token $NB_TOKEN" \
      -H "Accept: application/json" \
      -H "Content-Type: application/json" \
      -X POST "$NB_URL/api/extras/tags/" \
      -d "$create_body" || true)"
    if [[ "$create_code" != "201" && ! "$create_code" =~ ^20[0-9]$ ]]; then
      err "Failed to create tag slug='$tag_slug' (HTTP $create_code)"
      cat "$create_tmp" >&2 || true
      rm -f "$create_tmp"
      return 1
    fi
    tag_name="$(jq -r '.name' < "$create_tmp")"
    rm -f "$create_tmp"
  fi

  # 3) Read existing device tags, normalize to [{name, slug}]
  local dev_detail existing_objs_json
  dev_detail="$(curl -sS \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Accept: application/json" \
    "$NB_URL/api/dcim/devices/$dev_id/")"
  existing_objs_json="$(
    jq -c '
      (.tags // []) as $t |
      if ( ($t|length)>0 and (($t[0]|type)=="object") ) then
        [ $t[] | {name:.name, slug:.slug} ]
      else
        [ $t[] | {name:.} ]
      end
    ' <<<"$dev_detail"
  )"

  # 4) Merge + dedupe; build PATCH body
  local merged_objs_json patch_body patch_tmp patch_code
  merged_objs_json="$(
    jq -cn --arg name "$tag_name" --arg slug "$tag_slug" --argjson existing "$existing_objs_json" '
      ($existing + [ {name:$name, slug:$slug} ])
      | group_by(.name)
      | map(.[0])
    '
  )"
  patch_body="$(jq -n --argjson tags "$merged_objs_json" '{tags:$tags}')"

  # 5) PATCH device
  patch_tmp="$(mktemp)"
  patch_code="$(curl -sS -o "$patch_tmp" -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$patch_body" || true)"

  if [[ "$patch_code" =~ ^20[0-9]$ ]]; then
    log "Tag '$tag_slug' applied to device id=$dev_id"
    rm -f "$patch_tmp"
    return 0
  else
    err "Failed to set tag '$tag_slug' for device id=$dev_id (HTTP $patch_code)"
    cat "$patch_tmp" >&2 || true
    rm -f "$patch_tmp"
    return 1
  fi
}

# --- NEW: remove a tag from a device by slug (idempotent) ---
nb_remove_tag_by_slug() {
  local dev_id="$1" tag_slug="$2"

  # 1) Get current tags
  local dev_detail existing_objs_json
  dev_detail="$(curl -sS \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Accept: application/json" \
    "$NB_URL/api/dcim/devices/$dev_id/")" || return 1

  existing_objs_json="$(
    jq -c '
      (.tags // []) as $t |
      if ( ($t|length)>0 and (($t[0]|type)=="object") ) then
        [ $t[] | {name:.name, slug:.slug} ]
      else
        [ $t[] | {name:.} ]
      end
    ' <<<"$dev_detail"
  )"

  # 2) Filter out the slug (match either by slug or by legacy name)
  local filtered_objs_json
  filtered_objs_json="$(
    jq -cn --arg slug "$tag_slug" --argjson existing "$existing_objs_json" '
      [ $existing[] | select((.slug // "") != $slug and (.name // "") != $slug) ]
    '
  )"

  # 3) PATCH back
  local patch_body patch_tmp patch_code
  patch_body="$(jq -n --argjson tags "$filtered_objs_json" '{tags:$tags}')"

  patch_tmp="$(mktemp)"
  patch_code="$(curl -sS -o "$patch_tmp" -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$patch_body" || true)"

  if [[ "$patch_code" =~ ^20[0-9]$ ]]; then
    log "Removed tag '$tag_slug' from device id=$dev_id (if present)"
    rm -f "$patch_tmp"
    return 0
  else
    err "Failed to remove tag '$tag_slug' for device id=$dev_id (HTTP $patch_code)"
    cat "$patch_tmp" >&2 || true
    rm -f "$patch_tmp"
    return 1
  fi
}

# --- NEW: clear only custom_field update_progress (set to null) ---
nb_clear_update_progress() {
  local dev_id="$1"
  local body='{"custom_fields":{"update_progress":null}}'
  local code
  code="$(curl -sS -o /dev/null -w "%{http_code}" \
    -H "Authorization: Token $NB_TOKEN" \
    -H "Content-Type: application/json" \
    -X PATCH "$NB_URL/api/dcim/devices/$dev_id/" \
    -d "$body")" || code="000"
  if [[ "$code" =~ ^20[0-9]$ ]]; then
    log "Cleared update_progress for device id=$dev_id"
    return 0
  else
    err "Failed to clear update_progress for device id=$dev_id (HTTP $code)"
    return 1
  fi
}

# Handle one JSON payload (object)
handle_payload() {
  local payload="$1"

  local device task task_result task_result_typo add1 notify
  device="$(jq -r '.inscope_device // empty' <<<"$payload")"
  task="$(jq -r '.task_name // empty' <<<"$payload")"
  task_result="$(jq -r '.task_result // empty' <<<"$payload")"
  task_result_typo="$(jq -r '.taks_result // empty' <<<"$payload")"   # backward-compat typo
  add1="$(jq -r '.task_add1 // empty' <<<"$payload")"
  notify="$(jq -r '.task_notify // empty' <<<"$payload")"             # NEW: notify path

  [[ -z "$task_result" && -n "$task_result_typo" ]] && task_result="$task_result_typo"

  if [[ -z "$device" || -z "$task" ]]; then
    warn "Skipping message (missing inscope_device/task_name)"
    return 0
  fi

  local dev_id
  dev_id="$(nb_find_device_id "$device")"
  if [[ -z "$dev_id" ]]; then
    err "Device '$device' not found in NetBox"
    return 0
  fi

  case "$task" in
    update_wo_restart)
      # NEW BEHAVIOR: if task_notify is present, set multiple_ssids=yes AND add journal with notify text
      if [[ -n "$notify" ]]; then
        if nb_set_multiple_ssids_yes "$dev_id"; then
          echo ">>> Device '$device' (id=$dev_id) updated:"
          echo "    multiple_ssids = 'yes'"
        fi
        if nb_add_journal_raw "$dev_id" "$notify"; then
          echo ">>> Device '$device' (id=$dev_id) journal:"
          echo "    added comment = '$notify'"
        fi
        return 0
      fi

      # existing behavior (unchanged)
      if nb_patch_update_wo_restart "$dev_id" "$task_result" "$add1"; then
        echo ">>> Device '$device' (id=$dev_id) updated:"
        echo "    update_progress = '$task_result'"
        echo "    updating_to     = '$add1'"
      fi
      ;;
    deploy_wifidebug)
      if nb_patch_wifidebug "$dev_id" "$task_result"; then
        echo ">>> Device '$device' (id=$dev_id) updated:"
        echo "    wifidebug = '$task_result'"
      fi
      ;;
    journal_add)
      if nb_add_journal "$dev_id" "$task_result"; then
        echo ">>> Device '$device' (id=$dev_id) journal:"
        echo "    added comment = 'updated: $task_result'"
      fi
      ;;
    tag_add)
      # NEW: add a tag to the device using task_result as slug
      if [[ -z "$task_result" ]]; then
        warn "tag_add: task_result (tag slug) is empty; skipping."
        return 0
      fi
      if nb_add_tag_by_slug "$dev_id" "$task_result"; then
        echo ">>> Device '$device' (id=$dev_id) updated:"
        echo "    tag added (slug) = '$task_result'"
      fi
      ;;
    # --- NEW ACTION: cleanup on successful update ---
    update_cleanup_success)
      # a) remove "update-in-progress"
      nb_remove_tag_by_slug "$dev_id" "update-in-progress" || true
      # b) remove "update-auto-restarted"
      nb_remove_tag_by_slug "$dev_id" "update-auto-restarted" || true
      # c) add "update-successful"
      nb_add_tag_by_slug "$dev_id" "update-successful" || true
      # d) clear custom field update_progress
      nb_clear_update_progress "$dev_id" || true

      echo ">>> Device '$device' (id=$dev_id) cleanup done:"
      echo "    - tag removed: update-in-progress"
      echo "    - tag removed: update-auto-restarted"
      echo "    - tag added:   update-successful"
      echo "    - custom field cleared: update_progress"
      ;;
    *)
      log "Ignoring unsupported task_name='$task' (no-op)"
      ;;
  esac
}

# --- Main consume loop ---
log "Consuming from queue='${QUEUE}' (vhost='${VHOST}')"
while :; do
  RESP="$(rmq_api POST "/api/queues/$(urlenc "$VHOST")/$(urlenc "$QUEUE")/get" '{
    "count": 1, "ackmode": "ack_requeue_false", "encoding": "auto", "truncate": 1000000
  }')"

  # No messages -> pause
  if [[ -z "$RESP" || "$RESP" == "[]" ]]; then
    sleep "$SLEEP_SECS"
    continue
  fi

  # Process each message (API returns an array)
  echo "$RESP" | jq -c '.[]' | while read -r item; do
    raw_payload="$(jq -r '.payload' <<<"$item")"

    # Payload might be a JSON object OR a JSON-encoded string; handle both.
    if jq -e . >/dev/null 2>&1 <<<"$raw_payload"; then
      # If it's a string that contains JSON, decode once
      if [[ "$(jq -r 'type' <<<"$raw_payload")" == "string" ]] && jq -e . >/dev/null 2>&1 <<<"$(jq -r . <<<"$raw_payload")"; then
        decoded="$(jq -r . <<<"$raw_payload")"
        handle_payload "$decoded"
      else
        handle_payload "$raw_payload"
      fi
    else
      warn "Skipping non-JSON payload"
    fi
  done
done