name: Snapshot Admin Web Validation

on:
  workflow_dispatch:
  push:
    paths:
      - "src/quant_engine/snapshot_admin_server_v1.py"
      - "src/quant_engine/snapshot_admin_store_v1.py"
      - "tools/run_snapshot_admin_server_v1.py"
      - "tools/validate_snapshot_admin_workflow_v1.py"
      - "tools/validate_snapshot_admin_web_v1.py"
      - "spec/15_account_snapshot_contract.yaml"
      - "spec/18_settings_contract.yaml"
      - "GatherTradingData.json"

jobs:
  validate-snapshot-admin-smoke:
    if: github.event_name == 'push'
    runs-on: self-hosted
    steps:
      - name: Checkout Code
        run: |
          if [ -d .git ]; then
            git remote set-url origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          else
            git init
            git remote add origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          fi
          git fetch origin main --depth=1
          git reset --hard FETCH_HEAD

      - name: Setup Python Environment
        run: |
          VENV_BASE=/volume1/gitea/python_venv
          REQ_HASH=$(md5sum tools/validate_snapshot_admin_workflow_v1.py 2>/dev/null | cut -d' ' -f1 || echo "snapshot-admin-default")
          VENV="$VENV_BASE/$REQ_HASH"
          if [ ! -f "$VENV/bin/python" ]; then
            mkdir -p "$VENV_BASE"
            /usr/bin/python3 -m venv "$VENV"
            "$VENV/bin/pip" install --upgrade pip --quiet
          fi
          "$VENV/bin/pip" install pyyaml --quiet
          echo "$VENV/bin" >> $GITHUB_PATH

      - name: Validate Snapshot Admin Workflow
        run: python3 tools/validate_snapshot_admin_workflow_v1.py

  validate-snapshot-admin-full:
    if: github.event_name == 'workflow_dispatch'
    runs-on: self-hosted
    steps:
      - name: Checkout Code
        run: |
          if [ -d .git ]; then
            git remote set-url origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          else
            git init
            git remote add origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          fi
          git fetch origin main --depth=1
          git reset --hard FETCH_HEAD

      - name: Setup Python Environment
        run: |
          VENV_BASE=/volume1/gitea/python_venv
          REQ_HASH=$(md5sum tools/validate_snapshot_admin_workflow_v1.py 2>/dev/null | cut -d' ' -f1 || echo "snapshot-admin-default")
          VENV="$VENV_BASE/$REQ_HASH"
          if [ ! -f "$VENV/bin/python" ]; then
            mkdir -p "$VENV_BASE"
            /usr/bin/python3 -m venv "$VENV"
            "$VENV/bin/pip" install --upgrade pip --quiet
          fi
          "$VENV/bin/pip" install pyyaml --quiet
          echo "$VENV/bin" >> $GITHUB_PATH

      - name: Validate Snapshot Admin Workflow
        run: python3 tools/validate_snapshot_admin_workflow_v1.py

      - name: Validate Snapshot Admin Web UI
        run: python3 tools/validate_snapshot_admin_web_v1.py

      - name: Notify Run Result
        if: always()
        run: |
          STATUS="${{ job.status }}"
          echo "=== Snapshot Admin Web Validation ==="
          echo "status: $STATUS"
          echo "workflow validation: Temp/snapshot_admin_workflow_v1.json"
          echo "web validation: Temp/snapshot_admin_web_validation_v1.json"

  deploy-snapshot-admin:
    if: github.event_name == 'workflow_dispatch'
    needs:
      - validate-snapshot-admin-full
    runs-on: self-hosted
    steps:
      - name: Checkout Code
        run: |
          if [ -d .git ]; then
            git remote set-url origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          else
            git init
            git remote add origin http://x-access-token:${{ secrets.GITHUB_TOKEN }}@192.168.123.100:8418/KimJaeHyun/myfinance.git
          fi
          git fetch origin main --depth=1
          git reset --hard FETCH_HEAD

      - name: Setup Python Environment
        run: |
          VENV_BASE=/volume1/gitea/python_venv
          REQ_HASH=$(md5sum tools/validate_snapshot_admin_workflow_v1.py 2>/dev/null | cut -d' ' -f1 || echo "snapshot-admin-default")
          VENV="$VENV_BASE/$REQ_HASH"
          if [ ! -f "$VENV/bin/python" ]; then
            mkdir -p "$VENV_BASE"
            /usr/bin/python3 -m venv "$VENV"
            "$VENV/bin/pip" install --upgrade pip --quiet
          fi
          "$VENV/bin/pip" install pyyaml --quiet
          echo "$VENV/bin" >> $GITHUB_PATH

      - name: Deploy Snapshot Admin Runtime
        env:
          SNAPSHOT_ADMIN_AUTH_USER: ${{ vars.SNAPSHOT_ADMIN_AUTH_USER }}
          SNAPSHOT_ADMIN_AUTH_PASSWORD: ${{ secrets.SNAPSHOT_ADMIN_AUTH_PASSWORD }}
        run: |
          export ROOT_DIR="$PWD"
          export SNAPSHOT_ADMIN_HOST=127.0.0.1
          export SNAPSHOT_ADMIN_PORT=8787
          export SNAPSHOT_ADMIN_PID_FILE="$PWD/Temp/snapshot_admin.pid"
          export SNAPSHOT_ADMIN_LOG_FILE="$PWD/Temp/snapshot_admin.log"
          export SNAPSHOT_ADMIN_STATE_URL="http://127.0.0.1:8787/api/state"
          export SNAPSHOT_ADMIN_PUBLIC_STATE_URL="https://admin.example.com/api/state"
          export SNAPSHOT_ADMIN_AUTH_USER="${SNAPSHOT_ADMIN_AUTH_USER:-}"
          export SNAPSHOT_ADMIN_AUTH_PASSWORD="${SNAPSHOT_ADMIN_AUTH_PASSWORD:-}"
          bash tools/run_snapshot_admin_synology.sh restart

      - name: Verify Snapshot Admin Runtime
        env:
          SNAPSHOT_ADMIN_AUTH_USER: ${{ vars.SNAPSHOT_ADMIN_AUTH_USER }}
          SNAPSHOT_ADMIN_AUTH_PASSWORD: ${{ secrets.SNAPSHOT_ADMIN_AUTH_PASSWORD }}
        run: |
          export ROOT_DIR="$PWD"
          export SNAPSHOT_ADMIN_HOST=127.0.0.1
          export SNAPSHOT_ADMIN_PORT=8787
          export SNAPSHOT_ADMIN_PID_FILE="$PWD/Temp/snapshot_admin.pid"
          export SNAPSHOT_ADMIN_LOG_FILE="$PWD/Temp/snapshot_admin.log"
          export SNAPSHOT_ADMIN_STATE_URL="http://127.0.0.1:8787/api/state"
          export SNAPSHOT_ADMIN_AUTH_USER="${SNAPSHOT_ADMIN_AUTH_USER:-}"
          export SNAPSHOT_ADMIN_AUTH_PASSWORD="${SNAPSHOT_ADMIN_AUTH_PASSWORD:-}"
          bash tools/run_snapshot_admin_synology.sh healthcheck
          if [ -n "$SNAPSHOT_ADMIN_AUTH_USER" ] && [ -n "$SNAPSHOT_ADMIN_AUTH_PASSWORD" ]; then
            curl -fsS -u "${SNAPSHOT_ADMIN_AUTH_USER}:${SNAPSHOT_ADMIN_AUTH_PASSWORD}" http://127.0.0.1:8787/api/state | python3 -c "import json,sys; print(json.load(sys.stdin)['version']['app'])"
          else
            curl -fsS http://127.0.0.1:8787/api/state | python3 -c "import json,sys; print(json.load(sys.stdin)['version']['app'])"
          fi