#!/usr/bin/env bash
# delete-projects-bulk.sh — Elimina múltiples cuentas cPanel y sus registros Airtable
# Uso: ./scripts/delete-projects-bulk.sh <user1,user2,user3> [--dry-run] [--keep-airtable] [--yes] [--skip-backup]
#
# Acepta uno o más usuarios separados por comas.
# Cada usuario se procesa secuencialmente con la lógica de delete-project.sh.

set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"

########################################
# CONFIGURACIÓN DUAL VPS
########################################

VPS1_IP="72.61.45.136"
VPS2_IP="179.43.124.219"
VPS2_PORT="5633"
VPS1_NAME="VPS Hostinger 1"
VPS2_NAME="VPS Donweb 1"

########################################
# FLAGS
########################################

DRY_RUN=false
KEEP_AIRTABLE=false
AUTO_CONFIRM=false
CPANEL_USERS_RAW=""

usage() {
  cat <<'EOF'
Uso:
  ./scripts/delete-projects-bulk.sh <user1,user2,user3> [--dry-run] [--keep-airtable] [--yes] [--skip-backup]

Opciones:
  --dry-run        Muestra qué se borraría sin ejecutar cambios.
  --keep-airtable  Borra solo las cuentas cPanel, mantiene Airtable.
  --yes            No pide confirmación interactiva (aplica a todos los usuarios).
  --skip-backup    Omite el backup previo a Backblaze (no recomendado).
  -h, --help       Muestra esta ayuda.

Variables de entorno opcionales:
  BACKUP_STAGING_DIR   Directorio temporal para mysqldump en cada VPS (default: /backup/pre-delete)

Ejemplos:
  ./scripts/delete-projects-bulk.sh user1,user2,user3
  ./scripts/delete-projects-bulk.sh user1,user2 --dry-run
  ./scripts/delete-projects-bulk.sh user1,user2,user3 --yes --skip-backup
EOF
}

while (($#)); do
  case "$1" in
    --dry-run)       DRY_RUN=true;        shift ;;
    --keep-airtable) KEEP_AIRTABLE=true;  shift ;;
    --yes)           AUTO_CONFIRM=true;   shift ;;
    --skip-backup)   SKIP_BACKUP=true;    shift ;;
    -h|--help)       usage; exit 0 ;;
    -*)
      echo "Opción no reconocida: $1" >&2
      usage; exit 1
      ;;
    *)
      if [[ -z "$CPANEL_USERS_RAW" ]]; then
        CPANEL_USERS_RAW="$1"
      else
        echo "Parámetro inesperado: $1" >&2
        usage; exit 1
      fi
      shift
      ;;
  esac
done

if [[ -z "$CPANEL_USERS_RAW" ]]; then
  echo "Debes indicar al menos un usuario cPanel." >&2
  usage; exit 1
fi

# Parsear lista separada por comas → array, limpiando espacios y entradas vacías
IFS=',' read -ra CPANEL_USERS_RAW_ARRAY <<< "$CPANEL_USERS_RAW"
CPANEL_USERS=()
for u in "${CPANEL_USERS_RAW_ARRAY[@]}"; do
  # Trim espacios
  u="$(echo "$u" | tr -d '[:space:]')"
  [[ -n "$u" ]] && CPANEL_USERS+=("$u")
done

if [[ ${#CPANEL_USERS[@]} -eq 0 ]]; then
  echo "Lista de usuarios vacía tras parsear '${CPANEL_USERS_RAW}'." >&2
  exit 1
fi

########################################
# CARGAR CONFIG
########################################

CONFIG_FILE="/root/scripts/.airtable.env"
if [[ -f "$CONFIG_FILE" ]]; then
  source "$CONFIG_FILE"
elif [[ -f "${PROJECT_ROOT}/.env" ]]; then
  source "${PROJECT_ROOT}/.env"
fi

AIRTABLE_TOKEN="${AIRTABLE_TOKEN:-}"
AIRTABLE_BASE_ID="${AIRTABLE_BASE_ID:-}"
AIRTABLE_PROJECTS_TABLE="${AIRTABLE_SUBSCRIPTIONS_TABLE:-${AIRTABLE_TABLE_ID:-}}"
AIRTABLE_SUBS_TABLE="${AIRTABLE_SUBSCRIPTIONS_TRACKING_TABLE:-tblnpr52JhFBBi2Mg}"
HOSTINGER_TOKEN="${HOSTINGER_TOKEN:-}"

API_BASE=""
if [[ -n "$AIRTABLE_TOKEN" && -n "$AIRTABLE_BASE_ID" ]]; then
  API_BASE="https://api.airtable.com/v0/${AIRTABLE_BASE_ID}"
fi

########################################
# FUNCIONES REMOTE EXEC
########################################

remote_exec() {
  local server_name="$1"; shift
  local cmd="$*"

  if [[ "$server_name" == "$VPS1_NAME" ]]; then
    bash -c "$cmd"
  else
    ssh -p "${VPS2_PORT}" \
        -o StrictHostKeyChecking=no \
        -o ConnectTimeout=10 \
        root@${VPS2_IP} \
        "$cmd"
  fi
}

remote_test_file() {
  local server_name="$1"
  local filepath="$2"

  if [[ "$server_name" == "$VPS1_NAME" ]]; then
    [[ -f "$filepath" ]]
  else
    ssh -p "${VPS2_PORT}" \
        -o StrictHostKeyChecking=no \
        -o ConnectTimeout=10 \
        root@${VPS2_IP} \
        "test -f '${filepath}'"
  fi
}

########################################
# BACKUP PRE-DELETE (MySQL only)
########################################

run_pre_delete_backup() {
  local server_name="$1"
  local CPANEL_USER="$2"
  local DUMP_TIMEOUT=1800
  local POLL_INTERVAL=5

  echo "  ── Pre-delete backup (MySQL only) ─────────"

  remote_exec "$server_name" "mkdir -p '${BACKUP_STAGING_DIR}'" 2>/dev/null || true

  local dump_file="${BACKUP_STAGING_DIR}/${CPANEL_USER}_mysql_$(date +%Y%m%d_%H%M%S).sql.gz"
  local REMOTE_LOG="${BACKUP_STAGING_DIR}/.mysqldump-${CPANEL_USER}.log"
  local REMOTE_PID="${BACKUP_STAGING_DIR}/.mysqldump-${CPANEL_USER}.pid"
  local REMOTE_DONE="${BACKUP_STAGING_DIR}/.mysqldump-${CPANEL_USER}.done"

  remote_exec "$server_name" \
    "rm -f '${REMOTE_LOG}' '${REMOTE_PID}' '${REMOTE_DONE}'" 2>/dev/null || true

  local db_list
  db_list="$(remote_exec "$server_name" "
    mysql -N -e \"SHOW DATABASES;\" 2>/dev/null \
    | grep -E '^${CPANEL_USER}_|^${CPANEL_USER}$'
  " || echo "")"

  if [[ -z "$db_list" ]]; then
    echo "  WARN: No MySQL databases found for '${CPANEL_USER}' — skipping DB backup"
    return 0
  fi

  local db_count
  db_count="$(echo "$db_list" | wc -l | tr -d ' ')"
  echo "  Databases found: ${db_count}"
  echo "$db_list" | while read -r db; do echo "    - ${db}"; done

  echo "  Running mysqldump on ${server_name}..."

  local db_args
  db_args="$(echo "$db_list" | tr '\n' ' ')"

  remote_exec "$server_name" "bash -c '
    nohup bash -c \"mysqldump --single-transaction --routines --triggers \
      --databases ${db_args} 2>>${REMOTE_LOG} | gzip > ${dump_file}
      echo \\\$? > ${REMOTE_DONE}\" > ${REMOTE_LOG} 2>&1 &
    echo \$! > ${REMOTE_PID}
  '" 2>/dev/null || true

  sleep 2

  local elapsed=0
  local spinner_chars='|/-\'
  local spinner_idx=0

  while [[ $elapsed -lt $DUMP_TIMEOUT ]]; do
    if remote_exec "$server_name" "test -f '${REMOTE_DONE}'" 2>/dev/null; then
      break
    fi
    printf "\r  %s Dumping databases..." "${spinner_chars:$((spinner_idx % ${#spinner_chars})):1}"
    spinner_idx=$((spinner_idx + 1))
    sleep $POLL_INTERVAL
    elapsed=$((elapsed + POLL_INTERVAL))
  done

  printf "\r%-60s\n" ""

  if [[ $elapsed -ge $DUMP_TIMEOUT ]]; then
    echo "  ✗ mysqldump timeout (${DUMP_TIMEOUT}s)" >&2
    local remote_pid
    remote_pid="$(remote_exec "$server_name" "cat '${REMOTE_PID}' 2>/dev/null" || echo "")"
    [[ -n "$remote_pid" ]] && remote_exec "$server_name" "kill ${remote_pid} 2>/dev/null" || true
    remote_exec "$server_name" "rm -f '${REMOTE_LOG}' '${REMOTE_PID}' '${REMOTE_DONE}' '${dump_file}'" 2>/dev/null || true
    return 1
  fi

  local dump_exit
  dump_exit="$(remote_exec "$server_name" "cat '${REMOTE_DONE}' 2>/dev/null" || echo "1")"
  dump_exit="${dump_exit//[^0-9]/}"
  dump_exit="${dump_exit:-1}"

  if [[ "$dump_exit" -ne 0 ]]; then
    echo "  ✗ mysqldump failed (exit ${dump_exit}):" >&2
    remote_exec "$server_name" "cat '${REMOTE_LOG}' 2>/dev/null" >&2 || true
    remote_exec "$server_name" "rm -f '${REMOTE_LOG}' '${REMOTE_PID}' '${REMOTE_DONE}' '${dump_file}'" 2>/dev/null || true
    return 1
  fi

  if ! remote_exec "$server_name" "test -f '${dump_file}'" 2>/dev/null; then
    echo "  ✗ mysqldump completed but file not found: ${dump_file}" >&2
    return 1
  fi

  local dump_size
  dump_size="$(remote_exec "$server_name" "du -sh '${dump_file}' 2>/dev/null | cut -f1" || echo "?")"
  echo "  ✓ mysqldump completed: $(basename "${dump_file}") (${dump_size})"

  remote_exec "$server_name" "rm -f '${REMOTE_LOG}' '${REMOTE_PID}' '${REMOTE_DONE}'" 2>/dev/null || true

  echo "  Uploading to Backblaze via WHM transport..."

  local dest_info
  dest_info="$(remote_exec "$server_name" "
    whmapi1 backup_destination_list --output=json 2>/dev/null \
    | python3 -c \"
import json,sys
data=json.load(sys.stdin)
for d in data.get('data',{}).get('destination_list',[]):
    if str(d.get('disabled','1')) == '0':
        print(d.get('id','') + '|' + d.get('name','') + '|' + d.get('path',''))
        break
\" 2>/dev/null
  " || echo "")"

  local transport_id transport_name transport_path_remote
  transport_id="${dest_info%%|*}"
  transport_name="$(echo "$dest_info" | cut -d'|' -f2)"
  transport_path_remote="$(echo "$dest_info" | cut -d'|' -f3)"

  if [[ -z "$transport_id" ]]; then
    echo "  ✗ No active WHM backup destination found" >&2
    echo "  WARN: Dump kept at ${dump_file} — upload manually" >&2
    return 1
  fi

  echo "  Destination  : ${transport_name} (ID: ${transport_id})"
  echo "  Remote path  : ${transport_path_remote}/manual_backup/$(basename "${dump_file}")"

  local transport_output transport_exit
  transport_output="$(remote_exec "$server_name" "
    /scripts/cpbackup_transport_file \
      --transport '${transport_id}' \
      --upload '${dump_file}' 2>&1
  ")"
  transport_exit=$?

  local upload_failed=false
  if [[ $transport_exit -ne 0 ]]; then
    upload_failed=true
  elif echo "$transport_output" | grep -qi "upload attempt failed\|storage_cap_exceeded\|403 Forbidden\|Exception::HTTP"; then
    upload_failed=true
  fi

  if [[ "$upload_failed" == "false" ]]; then
    echo "  ✓ Uploaded to Backblaze: ${transport_path_remote}/manual_backup/$(basename "${dump_file}")"
    remote_exec "$server_name" "rm -f '${dump_file}'" 2>/dev/null || true
    echo "  ✓ Local copy removed"
    return 0
  else
    echo "  ✗ Upload failed (exit ${transport_exit}):" >&2
    echo "$transport_output" | grep -i "warn\|error\|failed\|storage_cap\|403" | head -5 >&2
    echo "  WARN: Dump kept at ${dump_file} — fix Backblaze cap and upload manually" >&2
    echo "  CMD:  /scripts/cpbackup_transport_file --transport ${transport_id} --upload ${dump_file}" >&2
    return 1
  fi
}

########################################
# FUNCIÓN HOSTINGER DNS
########################################

HOSTINGER_DNS_ZONE="bewpro.com"

delete_hostinger_dns() {
  local subdomain="$1"   # solo el subdominio, sin .bewpro.com

  if [[ -z "${HOSTINGER_TOKEN:-}" ]]; then
    echo "  WARN: HOSTINGER_TOKEN no configurado — DNS no eliminado"
    return 0
  fi

  echo "  Deleting DNS record: ${subdomain}.${HOSTINGER_DNS_ZONE}..."

  local result http_code body
  result=$(curl -sS -w "\n%{http_code}" -X DELETE \
    -H "Authorization: Bearer ${HOSTINGER_TOKEN}" \
    -H "Content-Type: application/json" \
    -d "{\"filters\": [{\"name\": \"${subdomain}\", \"type\": \"A\"}]}" \
    "https://developers.hostinger.com/api/dns/v1/zones/${HOSTINGER_DNS_ZONE}")

  http_code=$(echo "$result" | tail -1)
  body=$(echo "$result" | head -n -1)

  if [[ "$http_code" =~ ^2 ]]; then
    echo "  ✓ DNS record deleted: ${subdomain}.${HOSTINGER_DNS_ZONE}"
  else
    echo "  WARN: DNS delete returned HTTP ${http_code}: ${body}" >&2
  fi
}

########################################
# FUNCIONES AIRTABLE
########################################

urlencode() {
  python3 - "$1" <<'PYEOF'
import sys, urllib.parse
print(urllib.parse.quote(sys.argv[1], safe=""))
PYEOF
}

extract_project_info() {
  python3 - "$1" <<'PYEOF'
import json, sys
raw = sys.argv[1]
try:
    data = json.loads(raw)
except Exception:
    print("||")
    raise SystemExit(0)
records = data.get("records", [])
if not records:
    print("||")
    raise SystemExit(0)
record = records[0]
rid    = record.get("id", "")
fields = record.get("fields", {})
name   = fields.get("Name", "")
server = fields.get("Server", "").strip()
print(f"{rid}|{name}|{server}")
PYEOF
}

extract_subscription_ids() {
  python3 - "$1" <<'PYEOF'
import json, sys
raw = sys.argv[1]
try:
    data = json.loads(raw)
except Exception:
    raise SystemExit(0)
for rec in data.get("records", []):
    rid = rec.get("id")
    if rid:
        print(rid)
PYEOF
}

airtable_get() {
  local table="$1" formula="$2" max_records="${3:-}"
  local encoded_formula url
  encoded_formula="$(urlencode "$formula")"
  url="${API_BASE}/${table}?filterByFormula=${encoded_formula}"
  [[ -n "$max_records" ]] && url="${url}&maxRecords=${max_records}"
  curl -sS -H "Authorization: Bearer ${AIRTABLE_TOKEN}" "$url"
}

airtable_delete_record() {
  local table="$1" record_id="$2"
  curl -sS -X DELETE \
    -H "Authorization: Bearer ${AIRTABLE_TOKEN}" \
    "${API_BASE}/${table}/${record_id}" > /dev/null
}

########################################
# FUNCIÓN: procesar un solo usuario
# Retorna 0 = OK, 1 = falló (p.ej. backup)
########################################

process_single_user() {
  local CPANEL_USER="$1"

  echo ""
  echo "========================================"
  echo "  DELETE PROJECT: ${CPANEL_USER}"
  echo "========================================"
  echo ""

  # ── Buscar en Airtable ──
  local PROJECT_ID="" PROJECT_NAME="" SERVER_NAME=""
  local SUB_IDS=()

  if [[ -n "$API_BASE" && -n "$AIRTABLE_PROJECTS_TABLE" ]]; then
    local PROJECT_JSON PROJECT_INFO
    PROJECT_JSON="$(airtable_get "$AIRTABLE_PROJECTS_TABLE" "{Cpanel_User}=\"${CPANEL_USER}\"" "1")"
    PROJECT_INFO="$(extract_project_info "$PROJECT_JSON")"

    PROJECT_ID="${PROJECT_INFO%%|*}"
    local _rest="${PROJECT_INFO#*|}"
    PROJECT_NAME="${_rest%%|*}"
    SERVER_NAME="${_rest#*|}"

    if [[ -n "$PROJECT_ID" ]]; then
      echo "  Airtable Project : ${PROJECT_NAME:-?} (${PROJECT_ID})"
      echo "  Server           : ${SERVER_NAME:-NOT SET}"

      local SUBS_JSON
      SUBS_JSON="$(airtable_get "$AIRTABLE_SUBS_TABLE" "SEARCH(\"${PROJECT_NAME}\",{Project})")"
      while IFS= read -r rid; do
        [[ -n "$rid" ]] && SUB_IDS+=("$rid")
      done < <(extract_subscription_ids "$SUBS_JSON")
      echo "  Subscriptions    : ${#SUB_IDS[@]} record(s)"
    else
      echo "  Airtable Project : NOT FOUND (Cpanel_User=${CPANEL_USER})"
    fi
  else
    echo "  Airtable         : NOT CONFIGURED"
  fi

  # ── Verificar cuenta cPanel en VPS ──
  local USER_EXISTS=false ACTUAL_SERVER=""

  find_user_on_server() {
    local sname="$1"
    if remote_test_file "$sname" "/var/cpanel/users/${CPANEL_USER}" 2>/dev/null; then return 0; fi
    if remote_exec "$sname" "test -d '/home/${CPANEL_USER}'" 2>/dev/null; then return 0; fi
    return 1
  }

  local SEARCH_ORDER
  if [[ "$SERVER_NAME" == "$VPS2_NAME" ]]; then
    SEARCH_ORDER=("$VPS2_NAME" "$VPS1_NAME")
  else
    SEARCH_ORDER=("$VPS1_NAME" "$VPS2_NAME")
  fi

  for vps in "${SEARCH_ORDER[@]}"; do
    if find_user_on_server "$vps"; then
      USER_EXISTS=true
      ACTUAL_SERVER="$vps"
      echo "  cPanel account   : EXISTS on ${vps}"
      if [[ -n "$SERVER_NAME" && "$vps" != "$SERVER_NAME" ]]; then
        echo "  WARN: Airtable dice '${SERVER_NAME}' pero la cuenta está en '${vps}'"
      fi
      break
    else
      echo "  cPanel account   : not found on ${vps}"
    fi
  done

  [[ "$USER_EXISTS" == "false" ]] && echo "  cPanel account   : NOT FOUND on any VPS"
  [[ "$SKIP_BACKUP" == "true" ]]  && echo "  Backup           : SKIPPED (--skip-backup)"

  echo ""

  # ── Dry run ──
  if [[ "$DRY_RUN" == "true" ]]; then
    echo "DRY RUN — nothing deleted."
    if [[ "$USER_EXISTS" == "true" ]]; then
      [[ "$SKIP_BACKUP" == "false" ]] && \
        echo "  Would backup: mysqldump '${CPANEL_USER}' on ${ACTUAL_SERVER} → Backblaze"
      echo "  Would delete: cPanel account '${CPANEL_USER}' on ${ACTUAL_SERVER}"
    else
      echo "  cPanel account not found — would skip backup and cPanel deletion"
    fi
    [[ -n "$PROJECT_ID" ]] && echo "  Would delete: Airtable Project ${PROJECT_ID}"
    for sub_id in "${SUB_IDS[@]}"; do
      echo "  Would delete: Airtable Subscription ${sub_id}"
    done
    return 0
  fi

  # ── Confirmación individual (solo si no hay --yes) ──
  if [[ "$AUTO_CONFIRM" != "true" ]]; then
    local CONFIRM_MSG="Delete '${CPANEL_USER}'"
    if [[ "$USER_EXISTS" == "true" ]]; then
      [[ "$SKIP_BACKUP" == "false" ]] && CONFIRM_MSG+=" (backup → Backblaze first)"
      CONFIRM_MSG+=" on ${ACTUAL_SERVER}"
    fi
    [[ -n "$PROJECT_ID" ]] && CONFIRM_MSG+=" + Airtable records"
    local reply
    read -r -p "${CONFIRM_MSG}? [y/N/a(ll)/q(uit)]: " reply
    case "$reply" in
      [Yy])  : ;;                        # continuar con este usuario
      [Aa])  AUTO_CONFIRM=true ;;        # aprobar todos los restantes
      [Qq])  echo "Aborted by user."; exit 0 ;;
      *)     echo "  Skipping '${CPANEL_USER}'."; return 0 ;;
    esac
  fi

  # ── Backup pre-delete ──
  local BACKUP_OK=false

  if [[ "$USER_EXISTS" == "true" && "$SKIP_BACKUP" == "false" ]]; then
    if run_pre_delete_backup "$ACTUAL_SERVER" "$CPANEL_USER"; then
      BACKUP_OK=true
    else
      echo ""
      echo "  ✗ Backup falló. '${CPANEL_USER}' NO será eliminado por seguridad." >&2
      echo "    Para forzar el borrado sin backup usa: --skip-backup" >&2
      return 1
    fi
  else
    BACKUP_OK=true
  fi

  # ── Eliminar cuenta cPanel ──
  if [[ "$USER_EXISTS" == "true" ]]; then
    echo "  Deleting cPanel account on ${ACTUAL_SERVER}..."
    local REMOVE_OUTPUT REMOVE_EXIT
    REMOVE_OUTPUT="$(remote_exec "$ACTUAL_SERVER" \
      "/scripts/removeacct ${CPANEL_USER} --force" 2>&1)"
    REMOVE_EXIT=$?

    if [[ $REMOVE_EXIT -eq 0 ]]; then
      remote_exec "$ACTUAL_SERVER" \
        "[ -d /home/${CPANEL_USER} ] && rm -rf /home/${CPANEL_USER} || true" 2>/dev/null
      echo "  ✓ cPanel account deleted on ${ACTUAL_SERVER}"
    else
      echo "  ✗ removeacct failed: ${REMOVE_OUTPUT}" >&2
    fi
  else
    echo "  cPanel: no account found — skipping removeacct"
  fi

  # ── Eliminar registro DNS en Hostinger ──
  # Solo aplica a subdominios *.bewpro.com (el cpanel_user ES el subdominio)
  delete_hostinger_dns "${CPANEL_USER}"

  # ── Eliminar registros Airtable ──
  if [[ "$KEEP_AIRTABLE" != "true" && -n "$API_BASE" ]]; then
    for sub_id in "${SUB_IDS[@]}"; do
      airtable_delete_record "$AIRTABLE_SUBS_TABLE" "$sub_id"
      echo "  ✓ Subscription deleted: ${sub_id}"
    done

    if [[ -n "$PROJECT_ID" ]]; then
      airtable_delete_record "$AIRTABLE_PROJECTS_TABLE" "$PROJECT_ID"
      echo "  ✓ Project deleted: ${PROJECT_ID}"
    fi
  fi

  echo ""
  echo "  ✓ Project '${CPANEL_USER}' deleted completely."
  return 0
}

########################################
# RESUMEN INICIAL
########################################

TOTAL=${#CPANEL_USERS[@]}

echo ""
echo "════════════════════════════════════════════"
echo "  BULK DELETE — ${TOTAL} user(s)"
echo "  Users: ${CPANEL_USERS[*]}"
[[ "$DRY_RUN"      == "true" ]] && echo "  Mode : DRY RUN"
[[ "$SKIP_BACKUP"  == "true" ]] && echo "  WARN : backup skipped (--skip-backup)"
[[ "$KEEP_AIRTABLE" == "true" ]] && echo "  INFO : Airtable records will be kept"
echo "════════════════════════════════════════════"

# Confirmación global (solo si --yes no fue pasado y hay más de 1 usuario)
if [[ "$AUTO_CONFIRM" != "true" && $TOTAL -gt 1 && "$DRY_RUN" != "true" ]]; then
  read -r -p "Proceder con ${TOTAL} usuarios? [y/N]: " global_reply
  if [[ ! "$global_reply" =~ ^[Yy]$ ]]; then
    echo "Cancelled."
    exit 0
  fi
fi

########################################
# LOOP PRINCIPAL
########################################

SUCCEEDED=()
FAILED=()
SKIPPED=()

for CPANEL_USER in "${CPANEL_USERS[@]}"; do
  if process_single_user "$CPANEL_USER"; then
    SUCCEEDED+=("$CPANEL_USER")
  else
    FAILED+=("$CPANEL_USER")
  fi
done

########################################
# RESUMEN FINAL
########################################

echo ""
echo "════════════════════════════════════════════"
echo "  BULK DELETE SUMMARY"
echo "════════════════════════════════════════════"
echo "  Total    : ${TOTAL}"
echo "  OK       : ${#SUCCEEDED[@]}  $(IFS=', '; [[ ${#SUCCEEDED[@]} -gt 0 ]] && echo "(${SUCCEEDED[*]})" || echo "")"
echo "  Failed   : ${#FAILED[@]}  $(IFS=', ';  [[ ${#FAILED[@]}    -gt 0 ]] && echo "(${FAILED[*]})"    || echo "")"
[[ ${#SKIPPED[@]} -gt 0 ]] && \
echo "  Skipped  : ${#SKIPPED[@]}  ($(IFS=', '; echo "${SKIPPED[*]}"))"

if [[ ${#FAILED[@]} -gt 0 ]]; then
  echo ""
  echo "  Some users failed — review output above."
  exit 1
fi

exit 0