#!/usr/bin/env bash
# Invoked by server.js after a verified webhook push to master.
#
# This checkout is deploy-only: it exists purely so this script can update
# it. Never edit files directly in /opt/audit-endpoint - `git reset --hard`
# below throws away anything that isn't committed upstream.
set -euo pipefail

REPO_DIR="${REPO_DIR:-/opt/audit-endpoint}"

cd "$REPO_DIR"
git fetch --quiet origin master
git reset --hard origin/master

cd "$REPO_DIR/backend"
npm install --omit=dev --no-audit --no-fund

# Restarting audit-endpoint needs root; the audit-webhook service runs as an
# unprivileged user, so this relies on the narrow sudoers grant from
# backend/deploy/audit-deploy-sudoers (restart of this exact unit only).
sudo /usr/bin/systemctl restart audit-endpoint

echo "Deployed $(git -C "$REPO_DIR" rev-parse --short HEAD)"

# Deliberately not restarting audit-webhook itself here: a process cannot
# cleanly restart its own systemd unit mid-script (systemd would SIGTERM this
# script's parent while it is still running). Changes to backend/webhook/
# take effect on the next manual `sudo systemctl restart audit-webhook` -
# see DEPLOYMENT.md. That code changes far less often than the audit
# endpoint's own logic, so this is a fair trade for the simplicity.