pipeline {
    agent { label 'appdev' }

    options {
        disableConcurrentBuilds()
        timestamps()
    }

    environment {
        PATH = "C:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\wbin;${env.PATH}"
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Restore & Build') {
            steps {
                bat 'dotnet restore PowderCoatingApp.sln'
                bat 'dotnet build PowderCoatingApp.sln -c Release --no-restore'
            }
        }

        stage('Run Migrations') {
            steps {
                bat 'dotnet tool install --global dotnet-ef 2>nul || dotnet tool update --global dotnet-ef 2>nul'
                withCredentials([string(credentialsId: 'pcl-prod-sql', variable: 'SQL_CONN')]) {
                    bat '"%USERPROFILE%\\.dotnet\\tools\\dotnet-ef.exe" database update --project src\\PowderCoating.Infrastructure --startup-project src\\PowderCoating.Web --configuration Release --no-build --context ApplicationDbContext --connection "%SQL_CONN%"'
                }
            }
        }

        stage('Publish') {
            steps {
                bat 'dotnet publish src\\PowderCoating.Web\\PowderCoating.Web.csproj -c Release --self-contained false -o publish'
                bat 'xcopy /E /Y /I src\\PowderCoating.Web\\wwwroot publish\\wwwroot\\'
            }
        }

        stage('Deploy to Azure') {
            steps {
                bat 'powershell -Command "Add-Type -Assembly System.IO.Compression.FileSystem; if (Test-Path deploy.zip) { Remove-Item deploy.zip }; [System.IO.Compression.ZipFile]::CreateFromDirectory(\'publish\', \'deploy.zip\')"'
                withCredentials([azureServicePrincipal(
                    credentialsId:          'azure-pcl',
                    subscriptionIdVariable: 'AZ_SUB_ID',
                    clientIdVariable:       'AZ_CLIENT_ID',
                    clientSecretVariable:   'AZ_CLIENT_SECRET',
                    tenantIdVariable:       'AZ_TENANT_ID'
                )]) {
                    bat 'az login --service-principal -u "%AZ_CLIENT_ID%" -p "%AZ_CLIENT_SECRET%" --tenant "%AZ_TENANT_ID%" --output none'
                    bat 'az account set --subscription "%AZ_SUB_ID%"'
                    bat 'az webapp deploy --resource-group rg-powdercoatinglogix-prod --name linuxpcl --src-path deploy.zip --type zip --async true'
                    bat 'az logout'
                }
            }
        }
    }

    post {
        success {
            echo "Production deployment #${BUILD_NUMBER} completed successfully."
        }
        failure {
            echo "Pipeline #${BUILD_NUMBER} FAILED — review the stage logs above."
        }
        always {
            cleanWs()
        }
    }
}