#!/usr/bin/env bash
set -Eeuo pipefail

project_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
domain="approval.justconn.top"
service_name="dingtalk-approval-mcp.service"
unit_file="${XDG_CONFIG_HOME:-${HOME}/.config}/systemd/user/${service_name}"
nginx_site="/etc/nginx/conf.d/${domain}.conf"
web_root="/var/www/${domain}"

if [[ "${nginx_site}" != "/etc/nginx/conf.d/approval.justconn.top.conf" || "${web_root}" != "/var/www/approval.justconn.top" ]]; then
  echo "拒绝卸载：部署目标校验失败。" >&2
  exit 1
fi

if [[ "${1:-}" != "--yes" ]]; then
  read -r -p "卸载 ${domain} 网关和公开文件？凭证、OAuth 数据及证书会保留。[y/N] " answer
  [[ "${answer}" == "y" || "${answer}" == "Y" ]] || exit 0
fi

systemctl --user disable --now "${service_name}" >/dev/null 2>&1 || true
rm -f "${unit_file}"
systemctl --user daemon-reload
systemctl --user reset-failed "${service_name}" >/dev/null 2>&1 || true

sudo rm -f "${nginx_site}"
sudo rm -rf "${web_root}"
sudo nginx -t
sudo systemctl reload nginx

echo "卸载完成。"
echo "已保留：${project_root}/.secrets、${project_root}/.runtime 和 ${domain} 的证书。"