#!/bin/bash
################################################################################
# Script Name: version/3.7.4/UPDATE.sh
# Description: Apply version 3.7.4:
#              - mail leaving this server now says what sent it (X-Mailer)
#              - an OIDC provider on the internal network can be reached
#                without giving up certificate verification
#              - breakout rooms in the conferencing service
#              - the meeting room stops claiming end-to-end encryption it
#                never had, and its noise suppression is now real
#              - a plan form that says what the server actually has
#              This script checks the two things whose absence is otherwise
#              invisible: whether the webmail was rebuilt, and whether its
#              new migration arrived.
# Company/Brand: HiTechCloud by Pho Tue SoftWare Solutions JSC
################################################################################

set -uo pipefail
GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
ok()   { echo -e "[3.7.4] ${GREEN}✓${NC} $*"; }
warn() { echo -e "[3.7.4] ${YELLOW}!${NC} $*" >&2; }
bad()  { echo -e "[3.7.4] ${RED}✗${NC} $*" >&2; }
[[ $EUID -eq 0 ]] || { echo "[3.7.4] This update must run as root." >&2; exit 1; }

VERSION="3.7.4"
BIN=/usr/local/bin
WEBMAIL_SRC="${HITECHCLOUD_WEBMAIL_SRC:-/opt/hitechcloud/hitechcloudmail/webmail}"
DRY_RUN="${HITECHCLOUD_UPDATE_DRY_RUN:-0}"
run() { if [[ "$DRY_RUN" == 1 ]]; then echo "[3.7.4] would: $*"; else "$@"; fi; }

mkdir -p /usr/local/hitechcloud /etc/hitechcloud 2>/dev/null || true
echo "$VERSION" > /usr/local/hitechcloud/version 2>/dev/null || true
echo "$VERSION" > /etc/hitechcloud/version 2>/dev/null || true

# 1. The webmail carries most of this release: the X-Mailer header on every
#    outgoing message, the OIDC private-host permission and its migration, and
#    the corrected claims in the meeting room. All of it arrives by rebuilding
#    from the source in this release, which `hitechcloudcli update` does - but
#    a server updated by hand, or one whose rebuild failed and was not noticed,
#    would keep running the previous copy while reporting this version.
#
#    Checked by looking for something only this release has, rather than by
#    trusting that the rebuild ran.
if systemctl list-unit-files 2>/dev/null | grep -q '^hitechcloud-webmail\.service'; then
    marker="${WEBMAIL_SRC}/backend/src/services/mailerIdentity.js"
    if [[ -f "$marker" ]]; then
        ok "webmail source is this release"
    else
        run "${BIN}/hitechcloudcli" native-webmail update >/dev/null 2>&1 \
            && ok "webmail rebuilt from this release" \
            || warn "the webmail is still the previous release; run: hitechcloudcli native-webmail update"
    fi
fi

# 2. The OIDC column.
#
#    Shipped as webmail migration 0061 and applied by the webmail itself at
#    startup. Worth reporting rather than assuming: without the column, every
#    OIDC login fails on the query that reads it, and the only sign is a 500
#    on a page nobody visits until somebody tries to sign in with SSO.
if command -v psql >/dev/null 2>&1 && [[ -n "${WEBMAIL_DB_URL:-}" ]]; then
    if psql "${WEBMAIL_DB_URL}" -tAc \
        "SELECT 1 FROM information_schema.columns WHERE table_name='oidc_providers' AND column_name='allow_private_host'" \
        2>/dev/null | grep -q 1; then
        ok "OIDC private-host column present"
    else
        warn "the OIDC private-host column is not there yet; the webmail adds it on its next start"
    fi
fi

# 3. The conferencing service gained breakout rooms, which is new code in the
#    binary this release already installed and needs no state migrated. Said
#    so that a reader of this file is not left wondering which parts of the
#    changelog it covers.
if systemctl list-unit-files 2>/dev/null | grep -q '^hitechcloud-meet\.service'; then
    ok "breakout rooms: carried by the meeting service in this release"
fi

ok "Version ${VERSION} applied."