name: Deploy to server

on:
  push:
    branches:
      - main
      - beta

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}

          script: |

            REPO="https://github.com/Johnnybegood90/GridTV.git"

            PROD="${{ secrets.DEPLOY_PATH }}"
            DEMO="${{ secrets.DEMO_DEPLOY_PATH }}"
            BETA="${{ secrets.BETA_DEPLOY_PATH }}"

            # Hash SHA256 des chemins autorisés
            H1="d6b79f6d0d7c0e7f3d44f79e4a71e1f19df24d3b1f3e2a4b4a9b0a6e7d5b8a12"
            H2="4a5f6c8d1a4d5e0b4c2e6d3f7a9c1b2d5f6a8c4d3e1f7b2a6d8c9e0f1b2c3d4"
            H3="0f2c4e6a8b1d3f5c7e9a2b4d6f8c0e1a3d5f7c9b1e2d4f6a8c0b2d4e6f8a0c2"

            is_allowed () {

              HASH=$(printf "%s" "$1" | sha256sum | awk '{print $1}')

              if [ "$HASH" = "$H1" ] || \
                 [ "$HASH" = "$H2" ] || \
                 [ "$HASH" = "$H3" ]; then
                return 0
              else
                return 1
              fi
            }

            safe_deploy () {

              TARGET="$1"
              BRANCH="$2"

              echo "Deploy $BRANCH"

              if [ -z "$TARGET" ]; then
                echo "ERROR: empty path"
                exit 1
              fi

              if ! is_allowed "$TARGET"; then
                echo "ERROR: unauthorized path"
                exit 1
              fi

              mkdir -p "$TARGET"
              cd "$TARGET" || exit 1

              if [ ! -d ".git" ]; then
                echo "Repo missing → reclone"

                rm -rf ./* ./.??* 2>/dev/null || true

                git clone "$REPO" .
              fi

              git fetch origin
              git checkout -B "$BRANCH" "origin/$BRANCH"
              git reset --hard "origin/$BRANCH"
              git clean -fd

              echo "Deploy finished"
            }

            if [ "${{ github.ref }}" = "refs/heads/main" ]; then

              safe_deploy "$PROD" main
              safe_deploy "$DEMO" main

            fi

            if [ "${{ github.ref }}" = "refs/heads/beta" ]; then

              safe_deploy "$BETA" beta

            fi