#!/bin/sh
# ============================================================
#  安全與邏輯修正批次部署（2026-09-15）
#  含：權限中介層修復 / 收租月曆 / 附件 mimes / 公式注入 /
#      匯入錯蓋 / unique index / 總表分頁 / 登入限速 /
#      provision-admin / session 踢出 / 小修一批
#  適用：154.94.239.207 (BT Panel)，以 root 執行
# ============================================================
set -e

PROJ=/www/wwwroot/faithfulness
BASE=/home/wing/wkr_tmp

echo "=== [1/6] 備份資料庫 ==="
export MYSQL_PWD=$(grep '^DB_PASSWORD=' $PROJ/.env | cut -d= -f2)
DB_USER=$(grep '^DB_USERNAME=' $PROJ/.env | cut -d= -f2)
DB_NAME=$(grep '^DB_DATABASE=' $PROJ/.env | cut -d= -f2)
mkdir -p $BASE/backup
/www/server/mysql/bin/mysqldump -h 127.0.0.1 -u "$DB_USER" --single-transaction "$DB_NAME" > $BASE/backup/db_before_secfix_$(date +%Y%m%d).sql 2>/dev/null || true
ls -la $BASE/backup/db_before_secfix_*.sql | tail -1

echo "=== [2/6] 解壓新檔 ==="
rm -rf $BASE/extract_secfix
mkdir -p $BASE/extract_secfix
tar -xzf $BASE/wkr_security_fixes.tar.gz -C $BASE/extract_secfix
echo "解壓完成（$(cd $BASE/extract_secfix && find . -type f | wc -l) 個檔案）"

echo "=== [3/6] 備份将被覆蓋的舊檔 ==="
rm -rf $BASE/backup/files_secfix
mkdir -p $BASE/backup/files_secfix
cd $BASE/extract_secfix
find . -type f | while read f; do
  f=$(echo "$f" | sed 's|^\./||')
  if [ -f "$PROJ/$f" ]; then
    mkdir -p $BASE/backup/files_secfix/$(dirname "$f")
    cp -a "$PROJ/$f" "$BASE/backup/files_secfix/$f"
  fi
done
echo "完成"

echo "=== [4/6] 複製新檔 ==="
cp -a $BASE/extract_secfix/. $PROJ/
echo "完成"

echo "=== [5/6] 權限 + migration + 清快取 ==="
chown -R www:www $PROJ/app $PROJ/resources $PROJ/database $PROJ/tests
cd $PROJ
sudo -u www /usr/bin/php artisan migrate --force 2>&1 | tail -3
sudo -u www /usr/bin/php artisan optimize:clear 2>&1 | tail -1
sudo -u www /usr/bin/php artisan view:cache 2>&1 | tail -1

echo "=== [6/6] 驗證 ==="
sudo -u www /usr/bin/php artisan tinker --execute="
echo 'pages.css: '.(strpos(file_get_contents(base_path('resources/views/dormitories.blade.php')),'set: !clear')!==false?'OK':'MISSING').PHP_EOL;
echo 'perm fix: '.(strpos(file_get_contents(base_path('app/Http/Middleware/EnsurePagePermission.php')),'EXTRA_PREFIXES')!==false?'OK':'MISSING').PHP_EOL;
echo 'companies unique: '.(collect(Schema::getIndexes('companies'))->contains(fn(\$i)=>in_array('name',\$i['columns'])&&(\$i['unique']??false))?'OK':'MISSING').PHP_EOL;
echo 'branch dup check: '.DB::table('branches')->selectRaw('count(*) c, count(distinct company_id, name) d')->first()->c.'/'.DB::table('branches')->selectRaw('count(distinct company_id, name) d')->first()->d.PHP_EOL;
echo 'admin count: '.App\Models\User::where('role','admin')->count().PHP_EOL;
" 2>/dev/null | tail -5
echo "=== 全部完成，請重新整理測試站 ==="