#!/bin/bash
# Deployment-skript: Säkerhetshårdning av aamos-ledger
# Kör med: sudo bash /home/bernt/.openclaw/workspace/aamos-ledger/deploy-security-fixes.sh

set -euo pipefail

echo "=== AAMOS Ledger Security Deployment ==="

# ── Backup ───────────────────────────────────────────────────────────────────
BACKUP_DIR="/opt/amos/services/aamos-ledger/.backup-$(date +%s)"
mkdir -p "$BACKUP_DIR"
cp /opt/amos/services/aamos-ledger/index.mjs "$BACKUP_DIR/"
cp /opt/amos/services/aamos-ledger/auth.mjs "$BACKUP_DIR/"
echo "✅ Backup skapad: $BACKUP_DIR"

# ── Kopiera nya filer ────────────────────────────────────────────────────────
cp /home/bernt/.openclaw/workspace/aamos-ledger/.env.example /opt/amos/services/aamos-ledger/.env.example
cp /home/bernt/.openclaw/workspace/aamos-ledger/SECURITY.md /opt/amos/services/aamos-ledger/SECURITY.md
echo "✅ .env.example och SECURITY.md kopierade"

# ── Uppdatera index.mjs med requireRole ──────────────────────────────────────
# Lägg till import av requireRole och ROLES
sed -i "s/import { authMiddleware } from '.\/auth.mjs';/import { authMiddleware, requireRole, ROLES } from '.\/auth.mjs';/" /opt/amos/services/aamos-ledger/index.mjs

# Lägg till requireRole på muterande endpoints
# POST /api/ledger/accounts
sed -i "/app.post('\/api\/ledger\/accounts', async (req, res) => {/c\
app.post('\/api\/ledger\/accounts', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs

# POST /api/ledger/journal
sed -i "/app.post('\/api\/ledger\/journal', async (req, res) => {/c\
app.post('\/api\/ledger\/journal', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs

# POST /api/ledger/journal/:id/post
sed -i "/app.post('\/api\/ledger\/journal\/:id\/post', async (req, res) => {/c\
app.post('\/api\/ledger\/journal\/:id\/post', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs

# POST /api/ledger/journal/:id/void
sed -i "/app.post('\/api\/ledger\/journal\/:id\/void', async (req, res) => {/c\
app.post('\/api\/ledger\/journal\/:id\/void', requireRole(ROLES.ADMIN), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs

echo "✅ requireRole() tillagt på muterande endpoints"

# ── Verifiera att filen är giltig JavaScript ─────────────────────────────────
cd /opt/amos/services/aamos-ledger
node --check index.mjs 2>/dev/null || {
  echo "❌ Syntax error i index.mjs — återställer backup"
  cp "$BACKUP_DIR/index.mjs" index.mjs
  exit 1
}
echo "✅ Syntax check OK"

# ── Starta om tjänsten ───────────────────────────────────────────────────────
systemctl restart aamos-ledger
sleep 2
systemctl is-active aamos-ledger && echo "✅ aamos-ledger aktiv" || {
  echo "❌ aamos-ledger startade inte — återställer backup"
  cp "$BACKUP_DIR/index.mjs" index.mjs
  systemctl restart aamos-ledger
  exit 1
}

# ── Health check ─────────────────────────────────────────────────────────────
curl -s http://localhost:3250/health | grep -q '"ok":true' && echo "✅ Health check OK" || echo "⚠️ Health check misslyckades"

echo ""
echo "=== Deployment klar ==="
echo "Backup: $BACKUP_DIR"
echo "För att återställa: sudo cp $BACKUP_DIR/* /opt/amos/services/aamos-ledger/"