#!/usr/bin/env bash
# Root diagnostic for the preview.rankwizai.com 500.
# Run anywhere as root:  sudo bash /path/to/rankwiz/scripts/debug/as-root.sh
# Writes /tmp/debug-onboarding-500-root-<ts>.txt
#
# READ-ONLY: locates PHP-FPM pool config, error logs, vhost overrides;
# tails logs for 30s while you hit the URL in a browser; prints suggested
# (NOT-executed) restart/repair commands.

set -u
[[ $EUID -eq 0 ]] || { echo "ERROR: this script must be run as root."; exit 1; }

DOMAIN="${DEBUG_DOMAIN:-preview.rankwizai.com}"
USER_NAME="${DEBUG_USER:-rankwiz}"
APP_PATH="${DEBUG_APP_PATH:-/home/rankwiz/www/preview}"
TS=$(date -u +%Y-%m-%dT%H-%M-%SZ)
ARTIFACT="/tmp/debug-onboarding-500-root-${TS}.txt"
WATCH_SECS="${DEBUG_WATCH_SECS:-30}"

{
echo "================================================================"
echo "  Root diagnostic for $DOMAIN — $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "  cPanel user: $USER_NAME"
echo "  App path:    $APP_PATH"
echo "  Hostname:    $(hostname)"
echo "================================================================"

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R1] Apache vhost config for $DOMAIN"
echo "================================================================"
LINES=$(grep -n "ServerName $DOMAIN" /etc/apache2/conf/httpd.conf 2>/dev/null \
        | awk -F: '{print $1}')
if [ -z "$LINES" ]; then
    echo "(No vhost found in /etc/apache2/conf/httpd.conf — check distro)"
else
    for L in $LINES; do
        END=$((L + 50))
        echo "--- /etc/apache2/conf/httpd.conf:${L}..${END} ---"
        sed -n "${L},${END}p" /etc/apache2/conf/httpd.conf | head -50
        echo ""
    done
fi

echo ""
echo "--- cPanel userdata for $DOMAIN ---"
ls -la /var/cpanel/userdata/$USER_NAME/ 2>/dev/null | grep -i "$DOMAIN\|preview"
for f in "/var/cpanel/userdata/${USER_NAME}/${DOMAIN}" \
         "/var/cpanel/userdata/${USER_NAME}/${DOMAIN}.cache" \
         "/var/cpanel/userdata/${USER_NAME}/${DOMAIN}_SSL" \
         "/var/cpanel/userdata/${USER_NAME}/${DOMAIN}_SSL.cache" \
         "/var/cpanel/userdata/${USER_NAME}/${DOMAIN}.php-fpm.yaml"; do
    [ -f "$f" ] || continue
    echo ""
    echo "--- $f ---"
    cat "$f" | head -40
done

echo ""
echo "--- Per-vhost Apache include overrides ---"
for d in /etc/apache2/conf.d/userdata/std/2_4/$USER_NAME/$DOMAIN \
         /etc/apache2/conf.d/userdata/ssl/2_4/$USER_NAME/$DOMAIN; do
    [ -d "$d" ] || continue
    echo "--- $d ---"
    ls -la "$d"
    for f in "$d"/*.conf; do
        [ -f "$f" ] || continue
        echo ""
        echo "  $f:"
        sed 's/^/    /' "$f"
    done
done

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R2] PHP-FPM pool config + log paths"
echo "================================================================"

# cPanel EA-PHP-FPM pool config — the canonical path
FPM_POOL=""
for cand in /opt/cpanel/ea-php84/root/etc/php-fpm.d/${USER_NAME}*${DOMAIN}*.conf \
            /opt/cpanel/ea-php84/root/etc/php-fpm.d/${DOMAIN}*.conf \
            /opt/cpanel/ea-php83/root/etc/php-fpm.d/${USER_NAME}*${DOMAIN}*.conf \
            /opt/cpanel/ea-php82/root/etc/php-fpm.d/${USER_NAME}*${DOMAIN}*.conf; do
    if [ -f "$cand" ]; then
        FPM_POOL="$cand"
        break
    fi
done

if [ -z "$FPM_POOL" ]; then
    # Broader scan
    FPM_POOL=$(grep -rl "$DOMAIN" /opt/cpanel/ea-php*/root/etc/php-fpm.d/ 2>/dev/null | head -1)
fi

if [ -z "$FPM_POOL" ]; then
    echo "(No PHP-FPM pool config found — searching for any pool referencing $USER_NAME)"
    grep -rl "user.*=.*$USER_NAME" /opt/cpanel/ea-php*/root/etc/php-fpm.d/ 2>/dev/null | head -3
else
    echo "PHP-FPM pool config: $FPM_POOL"
    echo ""
    echo "--- Pool settings (filtered) ---"
    grep -E "^[^;]*(error_log|access_log|slowlog|listen|user|group|pm\.|catch_workers_output|php_value|php_admin_value|php_admin_flag|chdir)" "$FPM_POOL" \
        | head -50
fi

echo ""
echo "--- /var/cpanel/userdata/$USER_NAME yaml configs ---"
find /var/cpanel/userdata/$USER_NAME -name '*.yaml' 2>/dev/null | while read f; do
    echo "  $f"
done
cat /var/cpanel/userdata/$USER_NAME/${DOMAIN}.php-fpm.yaml 2>/dev/null

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R3] Web SAPI php.ini + active overrides"
echo "================================================================"

WEB_INI=""
for cand in /opt/cpanel/ea-php84/root/etc/php.ini \
            /opt/cpanel/ea-php83/root/etc/php.ini; do
    [ -f "$cand" ] && { WEB_INI="$cand"; break; }
done

if [ -n "$WEB_INI" ]; then
    echo "Web SAPI php.ini: $WEB_INI"
    echo ""
    echo "--- Relevant settings ---"
    grep -E "^(memory_limit|max_execution_time|max_input_time|post_max_size|upload_max_filesize|error_log|display_errors|log_errors|error_reporting|opcache\.|session\.gc|session\.save_handler|session\.save_path|session\.serialize_handler|session\.cookie|date\.timezone)" "$WEB_INI" \
        | head -40
else
    echo "(No web SAPI php.ini found at expected EA-PHP path)"
fi

echo ""
echo "--- ALL php_value/php_admin_value overrides for $USER_NAME ---"
grep -rH "php_value\|php_admin_value\|php_admin_flag" \
    /etc/apache2/conf.d/userdata/ \
    /etc/apache2/conf/userdata/ \
    /opt/cpanel/ea-php*/root/etc/php-fpm.d/ \
    2>/dev/null | grep -E "$USER_NAME|$DOMAIN" | head -30

echo ""
echo "--- session.gc_divisor warnings (filling the per-app error_log!) ---"
echo "Looking for the source of 'session.gc_divisor must be greater than 0'..."
grep -rH "session\.gc_divisor" \
    /opt/cpanel/ea-php*/root/etc/ \
    /etc/apache2/conf.d/userdata/ \
    /var/cpanel/userdata/$USER_NAME/ \
    2>/dev/null | head -10
echo "(if a value of 0 or empty is set anywhere above, that explains the warning spam)"

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R4] PHP-FPM running processes for $USER_NAME"
echo "================================================================"
ps auxf 2>/dev/null | grep -E "php-fpm.*$USER_NAME|^$USER_NAME.*php-fpm" | grep -v grep | head -10
if command -v systemctl >/dev/null 2>&1; then
    echo ""
    echo "--- systemd FPM services ---"
    systemctl list-units --type=service 2>/dev/null | grep -i php-fpm | head -5
fi

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R5] PHP-FPM error logs (any modified in last 24h)"
echo "================================================================"
LOG_DIRS=(
    /var/log/php-fpm
    /usr/local/cpanel/logs/php-fpm
    /opt/cpanel/ea-php84/root/var/log
    /opt/cpanel/ea-php83/root/var/log
    /var/log/php
    /home/$USER_NAME/logs
    "$APP_PATH"
)
for d in "${LOG_DIRS[@]}"; do
    [ -d "$d" ] || continue
    found=$(find "$d" -maxdepth 3 -name '*.log' -mtime -1 2>/dev/null)
    [ -z "$found" ] && continue
    while IFS= read -r f; do
        echo "--- $f ($(stat -c '%y, %s bytes' "$f" 2>/dev/null)) ---"
        echo "  Last 30 lines (skipping session.gc_divisor warning spam):"
        tail -200 "$f" 2>/dev/null | grep -v "session\.gc_divisor must be greater than 0" | tail -30
        echo ""
        echo "  Last fatal/error in this file:"
        grep -E "PHP Fatal|PHP Parse|Allowed memory|Maximum execution|Uncaught|Stack trace|onboarding|scribe-config" "$f" 2>/dev/null | tail -5
        echo ""
    done <<< "$found"
done

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R6] Live log watch — hit the URL in your browser NOW"
echo "================================================================"
echo "Tailing all relevant logs for ${WATCH_SECS} seconds."
echo ""
echo ">>> OPEN https://$DOMAIN/sites/1/onboarding IN YOUR BROWSER NOW <<<"
echo ""
echo "(Tailing started at $(date -u +%H:%M:%SZ) — will auto-stop in ${WATCH_SECS}s)"
echo ""

# Build the tail list
TAIL_LIST=()
for f in \
    "$APP_PATH/error_log" \
    "$APP_PATH/storage/logs/laravel.log" \
    /var/log/apache2/error_log \
    /home/$USER_NAME/logs/${DOMAIN}.error.log \
    /home/$USER_NAME/logs/error.log; do
    [ -f "$f" ] && TAIL_LIST+=("$f")
done
# Add any recently-modified PHP-FPM logs found above
for d in "${LOG_DIRS[@]}"; do
    [ -d "$d" ] || continue
    while IFS= read -r f; do
        TAIL_LIST+=("$f")
    done < <(find "$d" -maxdepth 3 -name '*.log' -mtime -1 2>/dev/null | head -3)
done
# Dedupe
TAIL_LIST=($(printf '%s\n' "${TAIL_LIST[@]}" | sort -u))

if [ ${#TAIL_LIST[@]} -eq 0 ]; then
    echo "(No log files found to watch — skipping)"
else
    echo "Watching:"
    printf '  %s\n' "${TAIL_LIST[@]}"
    echo ""
    echo "--- captured during ${WATCH_SECS}s window ---"
    timeout "$WATCH_SECS" tail -F -n 0 "${TAIL_LIST[@]}" 2>&1 \
        | grep -v "session\.gc_divisor must be greater than 0" \
        || true
fi

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R7] Server-side curl test (no auth — should be 302 to /login)"
echo "================================================================"
curl -sk -D - "https://$DOMAIN/sites/1/onboarding" \
     -o /tmp/server-curl-body.html \
     -m 10 \
     -w "\n--- meta ---\nhttp_code=%{http_code}\nremote_ip=%{remote_ip}\nsize=%{size_download}\nelapsed=%{time_total}s\n" 2>&1 \
     | head -25
echo ""
echo "--- body first 30 lines ---"
head -30 /tmp/server-curl-body.html 2>/dev/null
rm -f /tmp/server-curl-body.html

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R8] OPcache (web SAPI) state"
echo "================================================================"
# OPcache is per-SAPI; web's state is invisible from CLI. Best we can do:
echo "Web SAPI opcache settings (from $WEB_INI):"
[ -n "$WEB_INI" ] && grep -E "^opcache\." "$WEB_INI" | head -15
echo ""
echo "If 'opcache.validate_timestamps=0' is set, code changes do NOT take"
echo "effect until PHP-FPM is restarted."

# ----------------------------------------------------------------------------
echo ""
echo "================================================================"
echo "  [R9] Suggested fix commands (NOT auto-run — copy if needed)"
echo "================================================================"
cat <<EOF

# Restart PHP-FPM (clears OPcache, re-reads php.ini):
systemctl restart ea-php84-php-fpm
# or, on cPanel: /scripts/restartsrv_apache_php_fpm

# Restart Apache:
systemctl restart httpd
# or: systemctl restart apache2

# Force-clear Laravel caches as the rankwiz user:
sudo -u $USER_NAME -H bash -c "cd $APP_PATH && \\
    rm -f bootstrap/cache/*.php && \\
    php artisan config:clear && \\
    php artisan optimize:clear && \\
    php artisan view:clear && \\
    php artisan route:clear"

# Drop the user's session in Redis (if session-corruption is the cause):
redis-cli FLUSHDB    # warning: drops ALL keys in default DB
# OR scope to sessions only (Laravel default key prefix):
redis-cli --scan --pattern '*:session:*' | xargs -r redis-cli DEL

EOF

echo ""
echo "================================================================"
echo "  Done — $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "  Artifact: $ARTIFACT"
echo "================================================================"
} | tee "$ARTIFACT"

echo ""
echo "Paste the contents of $ARTIFACT back."