#!/usr/bin/env bash
#
# D005 — supervisor-agnostic restart shim.
#
# Restarts the intrusion-detection service after a deploy, preferring systemd
# (Linux), with a fallback message for other environments (Windows dev).
#
# It first waits for any in-flight background scan to finish so a checkout
# change never interleaves with a live scan (belt-and-suspenders; the runtime
# isolation guarantee already means scans only write gitignored files).
#
# Usage:
#   deploy/restart-service.sh [production]
#   ENV=production deploy/restart-service.sh
set -euo pipefail
cd "$(dirname "$0")/.."

ENV="${1:-${ENV:-production}}"
UNIT="ids@${ENV}.service"

# Wait for an in-flight scan to finish (~0..120s). We probe the web UI status
# endpoint if it is reachable; a failure to reach it just means no web UI is up.
web_host="${WEB_HOST:-127.0.0.1}"
web_port="${WEB_PORT:-54666}"
status_url="http://${web_host}:${web_port}/api/scan/status"
for _ in $(seq 1 60); do
  running=$(curl -fsS --max-time 2 "$status_url" 2>/dev/null \
    | python3 -c 'import sys,json;print(json.load(sys.stdin).get("running",False))' 2>/dev/null \
    || echo false)
  [[ "$running" == "false" ]] && break
  echo "  waiting for running scan to finish..."
  sleep 2
done

if command -v systemctl >/dev/null 2>&1; then
  # Installed unit is <unit>.service.template; the enabled name includes env.
  if systemctl list-unit-files "${UNIT}" >/dev/null 2>&1; then
    echo "== systemctl restart ${UNIT} =="
    systemctl restart "${UNIT}"
    systemctl --no-pager status "${UNIT}" --lines=0 || true
  elif systemctl list-unit-files "ids.service" >/dev/null 2>&1; then
    echo "== systemctl restart ids.service =="
    systemctl restart ids.service
    systemctl --no-pager status ids.service --lines=0 || true
  else
    echo "No ids systemd unit found; restart manually." >&2
    exit 2
  fi
else
  echo "No systemd available (Windows dev?). Restart the app manually." >&2
  echo "  python app.py   # in a terminal, or via your dev runner" >&2
  exit 2
fi