#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
HF_TOKEN_FILE="${HF_TOKEN_FILE:-$HOME/.cache/huggingface/token}"
RESTORE_HF_LOGIN_REQUIRED=0
RESTORE_HF_LOGIN_TOKEN=""
RESTORE_HF_LOGIN_USERNAME=""

trim() {
  printf '%s' "$1" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'
}

info() {
  printf '%s\n' "$*"
}

error() {
  printf 'error: %s\n' "$*" >&2
}

die() {
  error "$1"
  exit 1
}

prompt_line() {
  local prompt="$1"
  local default_value="${2:-}"
  local value=""

  if [[ -n "$default_value" ]]; then
    read -r -p "$prompt [$default_value]: " value || true
  else
    read -r -p "$prompt: " value || true
  fi

  value="$(trim "${value:-}")"
  if [[ -z "$value" ]]; then
    value="$default_value"
  fi
  printf '%s' "$value"
}

prompt_required() {
  local prompt="$1"
  local default_value="${2:-}"
  local value=""

  while [[ -z "$value" ]]; do
    value="$(prompt_line "$prompt" "$default_value")"
    value="$(trim "$value")"
    if [[ -z "$value" ]]; then
      printf 'This value is required.\n' >&2
    fi
  done
  printf '%s' "$value"
}

prompt_secret_optional() {
  local prompt="$1"
  local value=""
  local char=""

  if [[ -t 0 && -t 1 ]]; then
    printf '%s: ' "$prompt" >&2
    while IFS= read -r -s -n 1 char; do
      if [[ -z "$char" ]]; then
        break
      fi
      case "$char" in
        $'\177'|$'\b')
          if [[ -n "$value" ]]; then
            value="${value%?}"
            printf '\b \b' >&2
          fi
          ;;
        *)
          value+="$char"
          printf '*' >&2
          ;;
      esac
    done
    printf '\n' >&2
  else
    read -r -p "$prompt: " value || true
  fi
  printf '%s' "$(trim "${value:-}")"
}

prompt_secret_required() {
  local prompt="$1"
  local value=""

  while [[ -z "$value" ]]; do
    value="$(prompt_secret_optional "$prompt")"
    value="$(trim "$value")"
    if [[ -z "$value" ]]; then
      printf 'This value is required.\n' >&2
    fi
  done
  printf '%s' "$value"
}

prompt_yes_no() {
  local prompt="$1"
  local default_value="${2:-n}"
  local answer=""
  local hint="[y/N]"

  if [[ "$default_value" == "y" ]]; then
    hint="[Y/n]"
  fi

  while true; do
    read -r -p "$prompt $hint: " answer || true
    answer="$(trim "${answer:-}")"
    answer="$(printf '%s' "$answer" | tr '[:upper:]' '[:lower:]')"
    if [[ -z "$answer" ]]; then
      answer="$default_value"
    fi

    case "$answer" in
      y|yes)
        printf 'yes'
        return 0
        ;;
      n|no)
        printf 'no'
        return 0
        ;;
      *)
        printf 'Please enter y or n.\n' >&2
        ;;
    esac
  done
}

login_with_hf_token() {
  local token="$1"

  hf auth login --token "$token" >/dev/null 2>&1 || die "hf auth login with token failed."
}

restore_previous_hf_login_if_needed() {
  if [[ "$RESTORE_HF_LOGIN_REQUIRED" -ne 1 ]]; then
    return 0
  fi
  if [[ -z "$RESTORE_HF_LOGIN_TOKEN" ]]; then
    error "Skip restoring previous HF login because backup token is empty."
    RESTORE_HF_LOGIN_REQUIRED=0
    return 0
  fi

  local display_user="${RESTORE_HF_LOGIN_USERNAME:-unknown}"
  info "Restoring previous HF login for user: $display_user"
  if hf auth login --token "$RESTORE_HF_LOGIN_TOKEN" >/dev/null 2>&1; then
    info "Previous HF login restored."
  else
    error "Failed to restore previous HF login. Please run: hf auth login"
  fi

  RESTORE_HF_LOGIN_REQUIRED=0
}

ensure_git() {
  command -v git >/dev/null 2>&1 || die "git is required. Please install git first."
}

ensure_hf_cli() {
  local os_name

  if command -v hf >/dev/null 2>&1; then
    return 0
  fi

  os_name="$(uname -s)"
  case "$os_name" in
    Darwin|Linux)
      info "hf CLI not found. Installing via https://hf.co/cli/install.sh ..."
      curl -LsSf https://hf.co/cli/install.sh | bash
      ;;
    *)
      die "hf CLI not found. For Windows use: powershell -ExecutionPolicy ByPass -c \"irm https://hf.co/cli/install.ps1 | iex\""
      ;;
  esac

  if [[ -d "$HOME/.local/bin" ]]; then
    PATH="$HOME/.local/bin:$PATH"
  fi

  command -v hf >/dev/null 2>&1 || die "hf CLI install failed. Please install manually and rerun."
}

ensure_huggingface_hub_py() {
  python3 -c "import huggingface_hub" >/dev/null 2>&1 || die "python3 package 'huggingface_hub' is required. Install with: python3 -m pip install --user 'huggingface_hub[cli]'"
}

resolve_latest_openclaw_version() {
  local version
  version="$(
    python3 - <<'PY' 2>/dev/null || true
import json
import urllib.request

url = "https://registry.npmjs.org/openclaw/latest"
try:
    with urllib.request.urlopen(url, timeout=8) as response:
        payload = response.read().decode("utf-8", errors="replace")
    data = json.loads(payload)
    version = str(data.get("version", "")).strip()
    if version:
        print(version)
except Exception:
    pass
PY
  )"
  version="$(trim "$version")"
  if [[ -z "$version" ]]; then
    version="latest"
  fi
  printf '%s' "$version"
}

read_current_hf_token() {
  if [[ -n "${HUGGINGFACE_HUB_TOKEN:-}" ]]; then
    printf '%s' "${HUGGINGFACE_HUB_TOKEN}" | tr -d '\r\n'
    return 0
  fi
  if [[ -n "${HF_TOKEN:-}" ]]; then
    printf '%s' "${HF_TOKEN}" | tr -d '\r\n'
    return 0
  fi
  if [[ -f "$HF_TOKEN_FILE" ]]; then
    head -n 1 "$HF_TOKEN_FILE" | tr -d '\r\n'
    return 0
  fi
  printf ''
}

get_hf_username() {
  local whoami_output
  local username
  local token_from_cache

  whoami_output="$(hf auth whoami 2>&1 || true)"
  username="$(printf '%s\n' "$whoami_output" | sed -nE 's/^[[:space:]]*user:[[:space:]]*([^[:space:]]+).*$/\1/p' | head -n 1)"
  if [[ -z "$username" ]]; then
    username="$(printf '%s\n' "$whoami_output" | sed -nE 's/.*[Ll]ogged in as[[:space:]]+([^[:space:]]+).*$/\1/p' | head -n 1)"
  fi
  if [[ -z "$username" ]]; then
    token_from_cache="$(read_current_hf_token)"
    if [[ -n "$token_from_cache" ]]; then
      username="$(
        HF_API_TOKEN="$token_from_cache" python3 - <<'PY' 2>/dev/null || true
from huggingface_hub import HfApi
import os

token = (os.environ.get("HF_API_TOKEN") or "").strip() or None
api = HfApi(token=token)
data = api.whoami(token=token)
name = data.get("name", "") if isinstance(data, dict) else ""
print((name or "").strip())
PY
      )"
    fi
  fi
  username="$(printf '%s' "$username" | tr -d '\r\n')"
  printf '%s' "$username"
}

set_space_variable() {
  local space_repo_id="$1"
  local key="$2"
  local value="$3"
  local api_token="$4"

  SPACE_REPO_ID="$space_repo_id" \
  SPACE_VARIABLE_KEY="$key" \
  SPACE_VARIABLE_VALUE="$value" \
  HF_API_TOKEN="$api_token" \
  python3 - <<'PY'
from huggingface_hub import HfApi
import os

token = (os.environ.get("HF_API_TOKEN") or "").strip() or None
api = HfApi(token=token)
try:
    api.add_space_variable(
        repo_id=os.environ["SPACE_REPO_ID"],
        key=os.environ["SPACE_VARIABLE_KEY"],
        value=os.environ["SPACE_VARIABLE_VALUE"],
    )
except Exception as exc:
    key = os.environ.get("SPACE_VARIABLE_KEY", "")
    repo_id = os.environ.get("SPACE_REPO_ID", "")
    raise SystemExit(f"failed to set space variable {key} on {repo_id}: {exc}")
PY
}

set_space_secret() {
  local space_repo_id="$1"
  local key="$2"
  local value="$3"
  local api_token="$4"

  SPACE_REPO_ID="$space_repo_id" \
  SPACE_SECRET_KEY="$key" \
  SPACE_SECRET_VALUE="$value" \
  HF_API_TOKEN="$api_token" \
  python3 - <<'PY'
from huggingface_hub import HfApi
import os

token = (os.environ.get("HF_API_TOKEN") or "").strip() or None
api = HfApi(token=token)
try:
    api.add_space_secret(
        repo_id=os.environ["SPACE_REPO_ID"],
        key=os.environ["SPACE_SECRET_KEY"],
        value=os.environ["SPACE_SECRET_VALUE"],
    )
except Exception as exc:
    key = os.environ.get("SPACE_SECRET_KEY", "")
    repo_id = os.environ.get("SPACE_REPO_ID", "")
    raise SystemExit(f"failed to set space secret {key} on {repo_id}: {exc}")
PY
}

restart_space() {
  local space_repo_id="$1"
  local api_token="$2"

  SPACE_RESTART_REPO_ID="$space_repo_id" \
  HF_API_TOKEN="$api_token" \
  python3 - <<'PY'
from huggingface_hub import HfApi
import os

token = (os.environ.get("HF_API_TOKEN") or "").strip() or None
api = HfApi(token=token)
try:
    api.restart_space(repo_id=os.environ["SPACE_RESTART_REPO_ID"])
except Exception as exc:
    repo_id = os.environ.get("SPACE_RESTART_REPO_ID", "")
    raise SystemExit(f"failed to restart space {repo_id}: {exc}")
PY
}
main() {
  local hf_username
  local use_current_hf_user
  local current_hf_username
  local switch_hf_token
  local space_name
  local dataset_name
  local space_repo_id
  local dataset_repo_id
  local default_openclaw_version
  local openclaw_version
  local gateway_token
  local gateway_password
  local generated_gateway_token=0
  local generated_gateway_password=0
  local hf_token_for_backup
  local configure_llm
  local llm_base_url=""
  local llm_model=""
  local llm_api_key=""
  local enable_sshx="no"
  local sshx_auto_start_value="false"
  local proceed_with_deploy
  local api_token
  local space_page_url
  local space_host
  local app_url
  local health_url

  cd "$REPO_ROOT"

  info "OpenClaw Hugging Face bootstrap (interactive)"
  ensure_git
  ensure_hf_cli
  ensure_huggingface_hub_py
  git --version
  hf version
  python3 --version

  trap 'restore_previous_hf_login_if_needed' EXIT

  if ! hf auth whoami >/dev/null 2>&1; then
    info "HF CLI is not logged in."
    hf_token_for_backup="$(prompt_secret_required "HF_TOKEN (required for hf auth login)")"
    login_with_hf_token "$hf_token_for_backup"
  else
    current_hf_username="$(trim "$(get_hf_username)")"
    if [[ -n "$current_hf_username" ]]; then
      use_current_hf_user="$(prompt_yes_no "HF CLI is already logged in as '$current_hf_username'. Use this user?" "y")"
    else
      use_current_hf_user="$(prompt_yes_no "HF CLI is already logged in. Use current user?" "y")"
    fi

    if [[ "$use_current_hf_user" == "yes" ]]; then
      hf_token_for_backup="$(read_current_hf_token)"
      if [[ -z "$hf_token_for_backup" ]]; then
        hf_token_for_backup="$(prompt_secret_required "Cannot read current token. Enter HF_TOKEN")"
        login_with_hf_token "$hf_token_for_backup"
      fi
    else
      RESTORE_HF_LOGIN_TOKEN="$(read_current_hf_token)"
      [[ -n "$RESTORE_HF_LOGIN_TOKEN" ]] || die "Cannot backup current HF token. Ensure current token is readable before switching users."
      RESTORE_HF_LOGIN_REQUIRED=1
      RESTORE_HF_LOGIN_USERNAME="$current_hf_username"

      switch_hf_token="$(prompt_secret_required "HF_TOKEN for switching HF user")"
      login_with_hf_token "$switch_hf_token"
      hf_token_for_backup="$switch_hf_token"
    fi
  fi
  [[ -n "$hf_token_for_backup" ]] || die "HF_TOKEN is required to configure Space secret HF_TOKEN."

  hf_username="$(get_hf_username)"
  hf_username="$(trim "$hf_username")"
  if [[ -z "$hf_username" ]]; then
    hf_username="$(prompt_required "HF username (cannot parse from hf auth whoami)")"
  fi
  info "HF user: $hf_username"

  space_name="$(prompt_required "Space name (without username)" "openclaw-hf")"
  dataset_name="$(prompt_required "Dataset name (without username)" "${space_name}-backup")"
  default_openclaw_version="$(trim "${OPENCLAW_VERSION:-}")"
  if [[ -z "$default_openclaw_version" ]]; then
    default_openclaw_version="$(resolve_latest_openclaw_version)"
  fi
  openclaw_version="$(prompt_required "OPENCLAW_VERSION (press Enter to use detected latest)" "$default_openclaw_version")"
  space_repo_id="${hf_username}/${space_name}"
  dataset_repo_id="${hf_username}/${dataset_name}"

  gateway_token="$(prompt_secret_optional "OPENCLAW_GATEWAY_TOKEN (optional, leave empty to auto-generate 32 chars)")"
  if [[ -z "$gateway_token" ]]; then
    gateway_token="$(openssl rand -hex 16)"
    generated_gateway_token=1
  fi

  gateway_password="$(prompt_secret_optional "OPENCLAW_GATEWAY_PASSWORD (optional, leave empty to auto-generate 16 chars)")"
  if [[ -z "$gateway_password" ]]; then
    gateway_password="$(openssl rand -hex 8)"
    generated_gateway_password=1
  fi

  configure_llm="$(prompt_yes_no "Configure custom LLM now?" "n")"
  if [[ "$configure_llm" == "yes" ]]; then
    llm_base_url="$(prompt_required "OPENCLAW_LLM_BASE_URL")"
    llm_model="$(prompt_required "OPENCLAW_LLM_MODEL")"
    llm_api_key="$(prompt_secret_optional "OPENCLAW_LLM_API_KEY")"
    [[ -n "$llm_api_key" ]] || die "OPENCLAW_LLM_API_KEY is required when enabling custom LLM config."
  else
    enable_sshx="$(prompt_yes_no "Set OPENCLAW_SSHX_AUTO_START=true for later sshx setup?" "y")"
  fi
  if [[ "$enable_sshx" == "yes" ]]; then
    sshx_auto_start_value="true"
  fi

  info ""
  info "Planned deployment configuration:"
  info "Space repo: $space_repo_id"
  info "Dataset repo: $dataset_repo_id"
  info "OPENCLAW_VERSION: $openclaw_version"
  info "OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH=false"
  info "OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH=false"
  info "OPENCLAW_SSHX_AUTO_START=$sshx_auto_start_value"
  if [[ "$configure_llm" == "yes" ]]; then
    info "Custom LLM config: enabled"
  else
    info "Custom LLM config: disabled"
  fi
  proceed_with_deploy="$(prompt_yes_no "Proceed with these settings?" "y")"
  if [[ "$proceed_with_deploy" != "yes" ]]; then
    info "Cancelled by user before creating/updating Space or Dataset."
    return 0
  fi

  info "Creating private Space and Dataset..."
  hf repo create "$space_repo_id" --repo-type space --space-sdk docker --private --exist-ok
  hf repo create "$dataset_repo_id" --repo-type dataset --private --exist-ok

  info "Uploading repository to Space..."
  hf upload "$space_repo_id" . --repo-type space --exclude '.git/**' --exclude '.git' \
    --commit-message "feat: deploy openclaw to hf space"

  api_token="$(read_current_hf_token)"
  if [[ -z "$api_token" ]]; then
    api_token="$hf_token_for_backup"
  fi

  info "Configuring Space variables and secrets..."
  set_space_variable "$space_repo_id" "OPENCLAW_BACKUP_DATASET_REPO" "$dataset_repo_id" "$api_token"
  set_space_variable "$space_repo_id" "OPENCLAW_VERSION" "$openclaw_version" "$api_token"
  set_space_variable "$space_repo_id" "OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH" "false" "$api_token"
  set_space_variable "$space_repo_id" "OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH" "false" "$api_token"
  set_space_secret "$space_repo_id" "OPENCLAW_GATEWAY_TOKEN" "$gateway_token" "$api_token"
  set_space_secret "$space_repo_id" "OPENCLAW_GATEWAY_PASSWORD" "$gateway_password" "$api_token"
  set_space_secret "$space_repo_id" "HF_TOKEN" "$hf_token_for_backup" "$api_token"

  if [[ "$configure_llm" == "yes" ]]; then
    set_space_variable "$space_repo_id" "OPENCLAW_LLM_BASE_URL" "$llm_base_url" "$api_token"
    set_space_variable "$space_repo_id" "OPENCLAW_LLM_MODEL" "$llm_model" "$api_token"
    set_space_secret "$space_repo_id" "OPENCLAW_LLM_API_KEY" "$llm_api_key" "$api_token"
  fi

  set_space_variable "$space_repo_id" "OPENCLAW_SSHX_AUTO_START" "$sshx_auto_start_value" "$api_token"

  space_page_url="https://huggingface.co/spaces/${space_repo_id}"
  space_host="${space_repo_id/\//-}.hf.space"
  app_url="https://${space_host}"
  health_url="${app_url}/healthz"

  info ""
  info "Deployment complete."
  info "Space repo: $space_repo_id"
  info "Hugging Face Space: $space_page_url"
  info "Dataset repo: $dataset_repo_id"
  info "OPENCLAW_VERSION: $openclaw_version"
  info "Space URL: $app_url"
  info "Health URL: $health_url"

  if [[ "$generated_gateway_token" -eq 1 ]]; then
    info "Generated OPENCLAW_GATEWAY_TOKEN=$gateway_token"
  fi
  if [[ "$generated_gateway_password" -eq 1 ]]; then
    info "Generated OPENCLAW_GATEWAY_PASSWORD=$gateway_password"
  fi
}

main "$@"