#!/bin/bash
set -e

VERSION="0.9.13"
DIGEST="0eb0ac225791d6ce32e5183949bec596651de65ff16745529d1bf69f0cda3fe5"
MANAGER="http://127.0.0.1:19088"
TOKEN="dev-admin-token"
ARTIFACT_ID="artifact-56c16c03-1"
STORAGE_POOL="spool-3b376d8f-1"

echo "=== 1. Sign binary ==="
SIGNATURE=$(python3 -c "
import base64, hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.serialization import load_pem_private_key
import os
key_path = os.path.expanduser('~/.friend/keys/release-2026-private.pem')
with open(key_path, 'rb') as f:
    key = load_pem_private_key(f, password=None)
digest_hex = '$DIGEST'
sig = key.sign(bytes.fromhex(digest_hex))
print(base64.b64encode(sig).decode())
" 2>&1)
echo "Signature: ${SIGNATURE:0:40}..."

echo ""
echo "=== 2. Upload binary to storage pool ==="
OBJ_NAME="friend-agent-${VERSION}-linux-amd64"
UPLOAD_RESULT=$(curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
  -F "file=@/tmp/friend-agent-v0.9.13" \
  -F "kind=file" \
  -F "name=$OBJ_NAME" \
  "$MANAGER/api/v1/storage-pools/$STORAGE_POOL/objects" 2>/dev/null)
echo "$UPLOAD_RESULT" | python3 -c "
import json,sys
d=json.load(sys.stdin)
print('Storage object ID:', d.get('id',''))
print('Digest:', d.get('digest',''))
print('Size:', d.get('size_bytes',''))
" 2>/dev/null || echo "$UPLOAD_RESULT"

SOBJ_ID=$(echo "$UPLOAD_RESULT" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
echo "sobj_id=$SOBJ_ID"

echo ""
echo "=== 3. Update artifact via PUT API ==="
SIZE=$(stat -c%s /tmp/friend-agent-v0.9.13 2>/dev/null || stat -f%z /tmp/friend-agent-v0.9.13)
curl -sS -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d "{
    \"digest\": \"sha256:$DIGEST\",
    \"signature\": \"$SIGNATURE\",
    \"key_id\": \"release-2026\",
    \"storage_object_id\": \"$SOBJ_ID\",
    \"size_bytes\": $SIZE,
    \"signed\": true
  }" \
  "$MANAGER/api/v1/artifacts/$ARTIFACT_ID" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print('Artifact updated:', d.get('id',''), 'status:', d.get('status',''), 'digest:', d.get('digest','')[:20])
" 2>/dev/null

echo ""
echo "=== 4. Trigger agent.upgrade on both instances ==="
for INSTANCE in friend-043bd076 friend-4f864178; do
  echo "Upgrading $INSTANCE..."
  curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
    -d "{
      \"action\": \"agent.upgrade\",
      \"payload\": {
        \"program\": \"friend-agent\",
        \"version\": \"$VERSION\",
        \"source_url\": \"http://10.200.0.10:19088/artifact-content/$ARTIFACT_ID/$DIGEST\",
        \"digest\": \"sha256:$DIGEST\",
        \"signature\": \"$SIGNATURE\",
        \"key_id\": \"release-2026\"
      }
    }" \
    "$MANAGER/api/v1/instances/$INSTANCE/commands" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print('  Command:', d.get('id',''), 'status:', d.get('status',''))
" 2>/dev/null
done

echo ""
echo "=== 5. Wait for upgrade ==="
sleep 20

echo ""
echo "=== 6. Check instance status ==="
for INSTANCE in friend-043bd076 friend-4f864178; do
  echo "--- $INSTANCE ---"
  curl -sS -H "Authorization: Bearer $TOKEN" "$MANAGER/api/v1/instances/$INSTANCE" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
inst=d.get('instance',d)
print('  config_state:', inst.get('config_state',''))
print('  health_state:', inst.get('health_state',''))
print('  agent_version:', inst.get('agent_version',''))
print('  last_error:', str(inst.get('last_error',''))[:200])
"
done