#!/usr/bin/env python3
"""Adopt reviewed legacy deployment edits into a local Compose override.

Only deployment configuration is accepted. Business code and arbitrary untracked
files remain untouched. Backups contain private settings and use mode 0700/0600.
"""
import copy
import json
import os
from pathlib import Path
import shutil
import subprocess
import sys
import tempfile
import time

try:
    import yaml
except ImportError:
    sys.exit('❌ 迁移旧部署配置需要 Python PyYAML；尚未修改配置或容器')

root = Path(sys.argv[1]).resolve()
os.chdir(root)


def git(*args):
    return subprocess.check_output(['git', *args], text=True)


upstream = git('rev-parse', '--abbrev-ref', '@{upstream}').strip()
subprocess.run(['git', 'fetch', '--quiet', upstream.split('/')[0]], check=True)
subprocess.run(['git', 'merge-base', '--is-ancestor', 'HEAD', upstream], check=True)
restore_images = set(os.environ.get('UPDATE_RESTORE_REPOSITORY_IMAGES', '').split())
selected_services = set(os.environ.get('UPDATE_SERVICES', '').split())
if restore_images - {'easyai-server', 'easyai-web', 'ws-gateway'} or restore_images - selected_services:
    sys.exit('❌ 恢复仓库镜像只支持本次 UPDATE_SERVICES 中的核心服务；尚未修改配置或容器')
changed = set(git('diff', 'HEAD', '--name-only').splitlines())
if changed - {'docker-compose.yml'}:
    sys.exit('❌ 存在部署配置以外的本地代码修改；尚未修改配置或容器')
tracked = set(git('ls-tree', '-r', '--name-only', upstream).splitlines())
untracked = set(git('ls-files', '--others', '--exclude-standard').splitlines())
collisions = tracked & untracked
allowed = {'scripts/init-security-env.sh'}
if any(p not in allowed and not (Path(p).parent == Path('.') and p.endswith('.conf')) for p in collisions):
    sys.exit('❌ 存在新版仓库会覆盖的其他本地文件；尚未修改配置或容器')
if not changed and not collisions:
    sys.exit(0)
for name in changed | collisions:
    if not (root / name).is_file() or (root / name).is_symlink():
        sys.exit('❌ 配置文件类型不受支持；尚未修改配置或容器')


MISSING = object()


def clone(value):
    return MISSING if value is MISSING else copy.deepcopy(value)


def volume_target(value):
    # Ignore colons inside ${VARIABLE:-default} when identifying the mount target.
    depth = 0
    separators = []
    for i, char in enumerate(value):
        if char == '{': depth += 1
        elif char == '}': depth -= 1
        elif char == ':' and depth == 0: separators.append(i)
    if not separators: return value
    end = separators[1] if len(separators) > 1 else len(value)
    return value[separators[0] + 1:end]


def canonical(value, key=''):
    if isinstance(value, dict):
        return {k: canonical(v, k) for k, v in value.items()}
    if isinstance(value, list):
        if key in ('environment', 'labels'):
            return dict((v.partition('=')[0], v.partition('=')[2] if '=' in v else None) for v in value)
        if key == 'networks': return {v: {} for v in value}
        if key == 'volumes' and all(isinstance(v, str) for v in value):
            return {volume_target(v): v for v in value}
    return value


preserved = []


def merge(base, local, remote, path=()):
    if local == base: return clone(remote)
    if local == remote: return clone(remote)
    if isinstance(local, dict) and isinstance(remote, dict) and (isinstance(base, dict) or base is MISSING):
        old = base if isinstance(base, dict) else {}
        result = {}
        for key in sorted(set(old) | set(local) | set(remote)):
            value = merge(old.get(key, MISSING), local.get(key, MISSING), remote.get(key, MISSING), path + (key,))
            if value is not MISSING: result[key] = value
        return result
    if local is MISSING and base is MISSING: return clone(remote)
    if local is MISSING: return MISSING
    if remote is MISSING and base is not MISSING:
        sys.exit('❌ 新版删除了仍被本地修改的字段，无法安全合并；尚未修改配置或容器')
    preserved.append('.'.join(path))
    return clone(local)


def delta(remote, merged, path=()):
    if remote == merged: return MISSING
    if isinstance(remote, dict) and isinstance(merged, dict):
        result = {}
        for key in merged:
            value = delta(remote.get(key, MISSING), merged[key], path + (key,))
            if value is not MISSING: result[key] = value
        # Removal cannot be safely represented by an ordinary Compose override.
        if set(remote) - set(merged):
            fields = ', '.join('.'.join(path + (key,)) for key in sorted(set(remote) - set(merged)))
            sys.exit('❌ 本地配置删除了新版字段，无法安全合并；尚未修改配置或容器: ' + fields)
        return result
    return copy.deepcopy(merged)


def serialize(value, key=''):
    if isinstance(value, dict):
        if key == 'volumes' and value and all(isinstance(v, str) for v in value.values()): return list(value.values())
        return {k: serialize(v, k) for k, v in value.items()}
    return value


base = canonical(yaml.safe_load(git('show', 'HEAD:docker-compose.yml')))
local = canonical(yaml.safe_load((root / 'docker-compose.yml').read_text()))
remote_text = git('show', upstream + ':docker-compose.yml')
remote = canonical(yaml.safe_load(remote_text))
# Explicitly release reviewed local image pins through the deployment project.
# Other local settings and pins on services outside this update remain intact.
for service in sorted(restore_images):
    remote_service = remote.get('services', {}).get(service, {})
    local_service = local.get('services', {}).get(service, {})
    if not isinstance(remote_service.get('image'), str) or not isinstance(local_service, dict) or not local_service:
        sys.exit('❌ 无法读取目标服务的仓库镜像定义；尚未修改配置或容器')
    local_service['image'] = remote_service['image']
# Early managed deployments removed Watchtower's old token while disabling its
# HTTP trigger. Current deployments require a shared internal token; restore the
# upstream reference, whose value is initialized by update.sh, rather than
# preserving an unauthenticated monitor. Other removals still stop adoption.
monitor = local.get('services', {}).get('watchtower', {}).get('environment', {})
old_monitor = base.get('services', {}).get('watchtower', {}).get('environment', {})
new_monitor = remote.get('services', {}).get('watchtower', {}).get('environment', {})
token_key = 'WATCHTOWER_HTTP_API_TOKEN'
if token_key in old_monitor and token_key not in monitor and token_key in new_monitor:
    monitor = local['services']['watchtower'].setdefault('environment', {})
    monitor[token_key] = new_monitor[token_key]
merged = merge(base, local, remote)
override = delta(remote, merged)
with tempfile.NamedTemporaryFile(mode='w', dir=root, prefix='.update-compose-', suffix='.json', delete=False) as candidate:
    json.dump(serialize(merged), candidate)
    candidate_path = Path(candidate.name)
try:
    candidate_path.chmod(0o600)
    compose = ['docker', 'compose'] if shutil.which('docker') else ['docker-compose']
    validation = subprocess.run(compose + ['--env-file', '.env', '-f', str(candidate_path), 'config', '--quiet'], capture_output=True, text=True)
    if validation.returncode:
        sys.exit('❌ 合并后的部署配置未通过校验；尚未修改配置或容器')
finally:
    candidate_path.unlink()
backup_root = root / 'data/deployment-backups'
backup_root.mkdir(parents=True, exist_ok=True, mode=0o700)
backup = Path(tempfile.mkdtemp(prefix='legacy-update-' + time.strftime('%Y%m%d-%H%M%S') + '-', dir=backup_root))
backup.chmod(0o700)
for name in changed | collisions | {'.env'}:
    destination = backup / name
    destination.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
    shutil.copy2(root / name, destination)
    destination.chmod(0o600)
config_dir = root / 'data/deployment-config'
config_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
override_path = config_dir / 'legacy-compose.json'
if override is not MISSING and override:
    if override_path.exists():
        sys.exit('❌ 已存在旧配置迁移结果；请检查备份后再重试，尚未修改仓库')
    override_path.write_text(json.dumps(serialize(override), indent=2) + '\n')
    override_path.chmod(0o600)
    env_path = root / '.env'
    lines = env_path.read_text().splitlines()
    existing = next((line.partition('=')[2].strip().strip('"').strip("'") for line in lines if line.startswith('COMPOSE_FILE=')), '')
    files = existing.split(os.pathsep) if existing else ['docker-compose.yml']
    relative = str(override_path.relative_to(root))
    if relative not in files: files.append(relative)
    lines = [line for line in lines if not line.startswith('COMPOSE_FILE=')]
    lines.append('COMPOSE_FILE=' + os.pathsep.join(files))
    env_path.write_text('\n'.join(lines) + '\n')
    env_path.chmod(0o600)
for name in collisions:
    (root / name).unlink()
if changed:
    subprocess.run(['git', 'restore', '--source=HEAD', '--staged', '--worktree', '--', 'docker-compose.yml'], check=True)
(backup / 'migration.json').write_text(json.dumps({'from': git('rev-parse', 'HEAD').strip(), 'to': git('rev-parse', upstream).strip(), 'preservedFields': preserved, 'restoredRepositoryImages': sorted(restore_images), 'files': sorted(changed | collisions)}, indent=2))
(backup / 'migration.json').chmod(0o600)
print('✅ 已备份旧配置并迁移本地差异；新版部署字段由仓库继续管理')
print('   备份目录: ' + str(backup))
if restore_images:
    print('   已恢复仓库镜像定义: ' + ', '.join(sorted(restore_images)))