#!/bin/bash
# Gitea Webhook 接收器 - 自动部署文档站
# 使用方法: 在服务器上运行此脚本作为服务

set -euo pipefail

WEBHOOK_SECRET="${WEBHOOK_SECRET:-lawless-docs-deploy}"
DEPLOY_DIR="/var/www/docs.xuqinmin.com/site"
REPO_URL="https://xuqinmin.com/xuqinmin12/lawless.git"
BRANCH="main"
PORT="${WEBHOOK_PORT:-9000}"

# 日志函数
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

# 验证 webhook 签名
verify_signature() {
    local payload="$1"
    local signature="$2"
    local expected=$(echo -n "$payload" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')
    [ "$signature" = "$expected" ]
}

# 部署函数
deploy() {
    log "Starting deployment..."

    # 创建临时目录
    TMP_DIR=$(mktemp -d)
    cd "$TMP_DIR"

    # 克隆仓库
    log "Cloning repository..."
    git clone --depth 1 --branch "$BRANCH" "$REPO_URL" repo
    cd repo

    # 安装依赖并构建
    log "Building docs..."
    pip3 install mkdocs-material --quiet || true
    mkdocs build --clean --site-dir site

    # 部署到目标目录
    log "Deploying to $DEPLOY_DIR..."
    sudo mkdir -p "$DEPLOY_DIR"
    sudo rsync -avz --delete site/ "$DEPLOY_DIR/"

    # 清理
    cd /
    rm -rf "$TMP_DIR"

    log "Deployment completed successfully!"
}

# HTTP 服务器
while true; do
    {
        # 读取请求
        read -r method url version
        headers=""
        content_length=0
        while read -r line; do
            line=$(echo "$line" | tr -d '\r')
            [ -z "$line" ] && break
            headers="$headers$line\n"
            if echo "$line" | grep -qi "Content-Length:"; then
                content_length=$(echo "$line" | awk '{print $2}')
            fi
        done

        # 读取请求体
        if [ "$content_length" -gt 0 ]; then
            body=$(head -c "$content_length")
        else
            body=""
        fi

        # 处理请求
        if echo "$url" | grep -q "/deploy"; then
            # 验证签名
            signature=$(echo "$headers" | grep -i "X-Gitea-Signature:" | awk '{print $2}')

            if [ -z "$signature" ] || verify_signature "$body" "$signature"; then
                # 执行部署
                deploy &
                response="HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nDeployment triggered"
            else
                response="HTTP/1.1 403 Forbidden\r\nContent-Type: text/plain\r\n\r\nInvalid signature"
            fi
        elif echo "$url" | grep -q "/health"; then
            response="HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nOK"
        else
            response="HTTP/1.1 404 Not Found\r\nContent-Type: text/plain\r\n\r\nNot Found"
        fi

        # 发送响应
        echo -e "$response"
    } | nc -l -p "$PORT" -q 1
done