#!/bin/bash

set -euo pipefail

REGISTRY="registry.digitalocean.com/thob-blr1"
SHA=$(git rev-parse --short=10 HEAD)

# Load .env if present, so VITE_* don't have to be exported by hand.
if [ -f .env ]; then
  echo "Loading build vars from .env"
  set -a
  # shellcheck disable=SC1091
  . ./.env
  set +a
fi

# VITE_ vars are inlined into the client bundle at BUILD time. If they are empty
# here, the app ships with a broken PocketBase URL (https://api/...) that fails
# in the browser as a DNS error resembling CORS. Refuse to build.
: "${VITE_POCKETBASE_URL:?VITE_POCKETBASE_URL is not set — export it or add it to .env}"
: "${VITE_FRONTEND_URL:?VITE_FRONTEND_URL is not set — export it or add it to .env}"

echo "Building commit: $SHA"
echo "  VITE_POCKETBASE_URL=$VITE_POCKETBASE_URL"
echo "  VITE_FRONTEND_URL=$VITE_FRONTEND_URL"

# Login
doctl registry login

# App
echo "Building AR App..."
docker buildx build \
  --platform linux/amd64 \
  --build-arg "VITE_POCKETBASE_URL=$VITE_POCKETBASE_URL" \
  --build-arg "VITE_FRONTEND_URL=$VITE_FRONTEND_URL" \
  -f Dockerfile \
  --load \
  -t "$REGISTRY/ar:$SHA" \
  -t "$REGISTRY/ar:latest" .

# Verify the URL actually made it into the client bundle before pushing.
echo "Verifying baked-in PocketBase URL..."
PB_HOST=$(echo "$VITE_POCKETBASE_URL" | sed -e 's#^https\?://##' -e 's#/.*$##')
if ! docker run --rm --entrypoint sh "$REGISTRY/ar:$SHA" \
     -c "grep -rq '$PB_HOST' /app/build/client"; then
  echo "❌ Build verification failed: '$PB_HOST' not found in the client bundle."
  echo "   The image was NOT pushed."
  exit 1
fi
echo "✅ Verified: $PB_HOST is baked into the client bundle"

docker push "$REGISTRY/ar:$SHA"
docker push "$REGISTRY/ar:latest"

echo "✅ All images built and pushed successfully (tag: $SHA)"