#!/usr/bin/env bash
# Public tunnel for testing the Helcim payment flow locally.
#
# Why a production build (not `nuxt dev`): dev mode serves the client as 100+
# individual ESM modules, which a cloudflared quick tunnel delivers unreliably
# (sporadic 503s on the page-load burst abort hydration — the page renders but
# is dead to clicks). A production bundle is a handful of hashed assets, served
# rock-solid through the tunnel.
#
# BASE_URL + NUXT_PUBLIC_APP_URL are set to the tunnel URL at launch — the Helcim
# signup route requires the request Origin to exactly match BASE_URL. All other
# secrets load from .env via Node's --env-file (shell-set vars take precedence,
# so the tunnel URL wins). .env itself is never modified.
#
# Trade-off: no HMR. Re-run this script after code changes to rebuild.
#
# Usage: ./scripts/helcim-tunnel.sh   (Ctrl-C stops the server and the tunnel)

set -euo pipefail
cd "$(dirname "$0")/.."

if [ ! -f .env ]; then
  echo "ERROR: .env not found in $(pwd)" >&2
  exit 1
fi

LOG="$(mktemp)"
CF_PID=""
SRV_PID=""

cleanup() {
  echo ""
  echo "Stopping server and tunnel..."
  [ -n "$SRV_PID" ] && kill "$SRV_PID" 2>/dev/null || true
  [ -n "$CF_PID" ] && kill "$CF_PID" 2>/dev/null || true
  rm -f "$LOG"
}
trap cleanup EXIT
trap 'exit 130' INT TERM

echo "Starting cloudflared quick tunnel -> http://localhost:3000 ..."
cloudflared tunnel --url http://localhost:3000 >"$LOG" 2>&1 &
CF_PID=$!

TUNNEL_URL=""
for _ in $(seq 1 30); do
  TUNNEL_URL="$(grep -oE 'https://[a-zA-Z0-9.-]+\.trycloudflare\.com' "$LOG" | head -1 || true)"
  [ -n "$TUNNEL_URL" ] && break
  sleep 1
done

if [ -z "$TUNNEL_URL" ]; then
  echo "ERROR: could not obtain a tunnel URL. cloudflared output:" >&2
  cat "$LOG" >&2
  exit 1
fi
echo "Tunnel live: $TUNNEL_URL"

echo "Building production bundle (npm run build)..."
npm run build

echo ""
echo "  Serving .output through the tunnel."
echo "  Open the app at: $TUNNEL_URL   (NOT localhost — Helcim origin check requires it)"
echo "  Ctrl-C stops the server and the tunnel."
echo ""

PORT=3000 \
HOST=127.0.0.1 \
BASE_URL="$TUNNEL_URL" \
NUXT_PUBLIC_APP_URL="$TUNNEL_URL" \
  node --env-file=.env .output/server/index.mjs &
SRV_PID=$!
wait "$SRV_PID"