pipeline {
  agent any

  parameters {
    choice(
      name: 'DEPLOY_ENV',
      choices: ['development', 'production'],
      description: 'development 只执行验证；production 需要人工确认后发布'
    )
    choice(
      name: 'SERVICE',
      choices: ['all', 'tenant-service', 'im-service', 'push-service', 'update-service', 'file-service', 'demo-service', 'xuqm-bugcollect-service'],
      description: '要构建的服务模块（all = 全部，每个服务独立版本号）'
    )
  }

  environment {
    ACR_REGISTRY       = 'crpi-n44qjpuucgjt8e8c.cn-beijing.personal.cr.aliyuncs.com'
    ACR_NAMESPACE      = 'xuqmgroup'
    ACR_USERNAME       = 'xuqinmin12'
    PROD_HOST          = '106.54.23.149'
    PROD_USER          = 'ubuntu'
    COMPOSE_FILE       = '/opt/xuqm/deploy/compose.production.yaml'
    VERSIONS_FILE      = '/opt/xuqm/deploy/versions.json'
    DOCKER_BUILDKIT    = '1'
    JAVA_TOOL_OPTIONS  = '-Dfile.encoding=UTF-8 -Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8'
  }

  options {
    timeout(time: 60, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '30'))
    disableConcurrentBuilds()
  }

  stages {
    stage('Checkout') {
      steps {
        checkout([
          $class: 'GitSCM',
          branches: [[name: 'main']],
          extensions: [[$class: 'CleanBeforeCheckout']],
          userRemoteConfigs: [[
            url: 'ssh://git@xuqinmin.com:2222/xuqmGroup/XuqmGroup-Server.git',
            credentialsId: 'jenkins-ssh-key'
          ]]
        ])
      }
    }

    stage('Verify') {
      steps {
        bat 'mvnw.cmd -B test'
      }
    }

    stage('Confirm Production') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      input {
        message '确认发布并部署到生产环境？'
        ok '确认生产发布'
      }
      steps {
        echo '生产发布已人工确认'
      }
    }

    stage('Validate Production Secrets') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      steps {
        withCredentials([
          string(credentialsId: 'SDK_CONFIG_SIGNING_KEY_ID', variable: 'CONFIG_KEY_ID'),
          string(credentialsId: 'SDK_CONFIG_SIGNING_PRIVATE_KEY_BASE64', variable: 'CONFIG_PRIVATE_KEY'),
          string(credentialsId: 'SDK_CONFIG_SIGNING_PUBLIC_KEY_BASE64', variable: 'CONFIG_PUBLIC_KEY'),
          string(credentialsId: 'SDK_INTERNAL_TOKEN', variable: 'INTERNAL_TOKEN')
        ]) {
          bat '''
            if "%CONFIG_KEY_ID%"=="" exit /b 1
            if "%CONFIG_PRIVATE_KEY%"=="" exit /b 1
            if "%CONFIG_PUBLIC_KEY%"=="" exit /b 1
            if "%INTERNAL_TOKEN%"=="" exit /b 1
            if "%INTERNAL_TOKEN%"=="xuqm-internal-token" exit /b 1
          '''
        }
      }
    }

    stage('Resolve Versions') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      steps {
        script {
          def allServices = ['tenant-service', 'im-service', 'push-service', 'update-service', 'file-service', 'demo-service', 'xuqm-bugcollect-service']

          // 支持从 job 名自动推断服务（如 xuqmgroup-update-service → update-service）
          def jobService = env.JOB_NAME.tokenize('/').last()
              .replaceFirst(/^xuqmgroup-/, '')
          def resolvedService = allServices.contains(jobService) ? jobService : params.SERVICE
          def targets = resolvedService == 'all' ? allServices : [resolvedService]
          echo "Job: ${env.JOB_NAME} → SERVICE=${resolvedService}"

          // serviceVersions: Map<svcName, newVersion>
          def serviceVersions = [:]
          for (svc in targets) {
            def vf = "VERSION.${svc}"
            def current = fileExists(vf) ? readFile(vf).trim() : '1.0.0'
            def parts = current.tokenize('.')
            while (parts.size() < 3) parts.add('0')
            def newVer = "${parts[0]}.${parts[1]}.${parts[2].toInteger() + 1}"
            serviceVersions[svc] = newVer
            writeFile file: vf, text: newVer
            echo "${svc}: ${current} → ${newVer}"
          }
          env.SERVICE_VERSIONS_JSON = groovy.json.JsonOutput.toJson(serviceVersions)
        }
      }
    }

    stage('Docker Build & Push') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      steps {
        withCredentials([string(credentialsId: 'ACR_PASSWORD', variable: 'ACR_PASS')]) {
          script {
            def serviceVersions = new groovy.json.JsonSlurperClassic().parseText(env.SERVICE_VERSIONS_JSON)
            for (svc in serviceVersions.keySet()) {
              def ver = serviceVersions[svc]
              def base = "${ACR_REGISTRY}/${ACR_NAMESPACE}/${svc}"
              def versionedImage = "${base}:${ver}"
              def latestImage = "${base}:latest"
              echo "Building ${svc}:${ver}..."
              bat """
                chcp 65001 >nul
                docker login ${ACR_REGISTRY} -u ${ACR_USERNAME} -p %ACR_PASS%
                if %errorlevel% neq 0 exit /b 1
                docker pull --platform=linux/amd64 ${latestImage} || echo Pull failed, will build fresh
                docker build --platform=linux/amd64 --build-arg SERVICE_MODULE=${svc} --build-arg SERVICE_VERSION=${ver} --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ${latestImage} -t ${versionedImage} -t ${latestImage} .
                if %errorlevel% neq 0 exit /b 1
                docker push ${versionedImage}
                if %errorlevel% neq 0 exit /b 1
                docker push ${latestImage}
                if %errorlevel% neq 0 exit /b 1
                docker rmi ${versionedImage} ${latestImage}
                exit /b 0
              """
            }
          }
        }
      }
    }

    stage('Deploy to Production') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      steps {
        lock('prod-deploy') {
          withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
            script {
              def serviceVersions = new groovy.json.JsonSlurperClassic().parseText(env.SERVICE_VERSIONS_JSON)
              for (svc in serviceVersions.keySet()) {
                def latestImage = "${ACR_REGISTRY}/${ACR_NAMESPACE}/${svc}:latest"
                echo "Deploying ${svc}..."
                retry(2) {
                  bat """
                    chcp 65001 >nul
                    ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${PROD_USER}@${PROD_HOST} "docker image prune -f 2>/dev/null || true; docker pull ${latestImage} || exit 1; docker compose -f ${COMPOSE_FILE} up -d --no-deps --force-recreate ${svc} || exit 1; docker image prune -f"
                  """
                }
              }

              // 合并更新 versions.json（只改动本次构建涉及的服务，不覆盖其它服务或 web 条目）
              def releasedAt = new Date().format("yyyy-MM-dd'T'HH:mm:ss'Z'", TimeZone.getTimeZone('UTC'))
              def builtJson = groovy.json.JsonOutput.toJson(serviceVersions)
              def allSvcsList = groovy.json.JsonOutput.toJson(['tenant-service', 'im-service', 'push-service', 'update-service', 'file-service', 'demo-service', 'xuqm-bugcollect-service'])
              def updateScript = """\
import json, os
path = '${env.VERSIONS_FILE}'
d = json.load(open(path)) if os.path.exists(path) else {}
built = ${builtJson}
all_svcs = ${allSvcsList}
d.setdefault('services', {})
for s in all_svcs:
    d['services'].setdefault(s, {})
    if s in built:
        d['services'][s]['version'] = built[s]
        d['services'][s]['changed'] = True
    else:
        d['services'][s].setdefault('version', 'unknown')
        d['services'][s]['changed'] = False
# platformVersion 取 tenant-service 版本（主服务），私有部署 check-update 用此字段判断是否有新版本
if 'tenant-service' in built:
    d['platformVersion'] = built['tenant-service']
elif 'platformVersion' not in d:
    d['platformVersion'] = list(built.values())[0] if built else 'unknown'
d['releasedAt'] = '${releasedAt}'
json.dump(d, open(path, 'w'), indent=2, ensure_ascii=False)
print('versions.json updated, platformVersion=' + d.get('platformVersion', ''))
""".stripIndent()
              writeFile file: 'update_versions.py', text: updateScript
              bat """
                chcp 65001 >nul
                scp -i "%SSH_KEY%" -o StrictHostKeyChecking=no update_versions.py ${PROD_USER}@${PROD_HOST}:/tmp/update_versions.py
                ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${PROD_USER}@${PROD_HOST} "python3 /tmp/update_versions.py && rm /tmp/update_versions.py"
              """
            }
          }
        }
      }
    }

    stage('Commit Versions') {
      when { expression { params.DEPLOY_ENV == 'production' } }
      steps {
        script {
          def serviceVersions = new groovy.json.JsonSlurperClassic().parseText(env.SERVICE_VERSIONS_JSON)
          def versionFiles = serviceVersions.keySet().collect { "VERSION.${it}" }.join(' ')
          def summary = serviceVersions.collect { svc, ver -> "${svc}=${ver}" }.join(', ')
          // 先本地提交（幂等）
          bat """
            chcp 65001 >nul
            git config user.email "jenkins@xuqm.com"
            git config user.name "Jenkins CI"
            git add ${versionFiles}
            git diff --cached --quiet || git commit -m "ci: bump versions [${summary}] [skip ci]"
          """
          // push 加 retry + rebase，应对多 job 并发推送冲突
          withCredentials([sshUserPrivateKey(credentialsId: 'jenkins-ssh-key', keyFileVariable: 'GIT_SSH_KEY')]) {
            writeFile file: 'git-ssh.cmd', text: '@echo off\r\nssh -i "%GIT_SSH_KEY%" -o IdentitiesOnly=yes %*\r\n', encoding: 'UTF-8'
            try {
              withEnv(["GIT_SSH=${pwd()}\\git-ssh.cmd"]) {
                retry(3) {
                  bat """
                    chcp 65001 >nul
                    git pull --rebase origin main
                    git push origin HEAD:main
                  """
                }
              }
            } finally {
              bat 'if exist git-ssh.cmd del /f /q git-ssh.cmd'
            }
          }
        }
      }
    }
  }

  post {
    success {
      script {
        def serviceVersions = new groovy.json.JsonSlurperClassic().parseText(env.SERVICE_VERSIONS_JSON ?: '{}')
        def summary = serviceVersions.collect { svc, ver -> "${svc}:${ver}" }.join(', ')
        def resultText = params.DEPLOY_ENV == 'production' ? "构建部署成功 — ${summary}" : 'development 验证成功（未发布）'
        bat "chcp 65001 >nul && echo ✅ ${resultText}"
      }
    }
    failure { bat 'chcp 65001 >nul && echo ❌ 构建失败，请检查日志' }
  }
}