compass_teams_nhs/scripts/morning-brief.sh

#!/usr/bin/env bash
# Phase 7: the morning run (AGENTS.md §4 FR-9, FR-14, §11 Phase 7).
#
# This is the bounded command the 6:00am n8n schedule runs:
#   1. scan Compass for both children (read-only; skipped with --no-scan),
#   2. write the day's periods, due work, overdue work and school events to
#      Sam's Home Assistant School calendar (idempotent; skipped with --no-calendar),
#   3. build one brief per boy and one combined brief to Jo and Sam,
#   4. deliver them through the house Apprise API on `.35:8210`,
#   5. record every delivery in `notifications` and every exit code loudly.
#
# A failed scan is never reported as "nothing due" (FR-12): the brief opens with
# the failure, and this script exits non-zero so the n8n execution is visibly
# failed.
#
# Secrets: no address, phone number or password is passed on the command line.
# The Apprise configuration key comes from environment.d/school-service.env and
# is only exported into the container environment.
#
# Usage:
#   scripts/morning-brief.sh                 # scan, calendar, then send
#   scripts/morning-brief.sh --no-scan       # calendar and send from the latest scan
#   scripts/morning-brief.sh --no-scan --no-calendar  # send only
#   scripts/morning-brief.sh --dry-run       # build and print, send nothing
#   scripts/morning-brief.sh --channel email # limit the channels
#
# Environment overrides:
#   IMAGE                image tag                  (default 0.6.2-phase6b7b)
#   VOLUME               SQLite volume             (default compass-teams-nhs_compass-teams-nhs-data)
#   ENV_FILE             service env file          (default environment.d/school-service.env)
#   SCHOOL_TIMEZONE      family timezone           (default Australia/Sydney)
#   DOCKER_TIMEOUT       per docker command timeout (default 600)
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

IMAGE="${IMAGE:-compass-teams-nhs/school:0.6.2-phase6b7b}"
VOLUME="${VOLUME:-compass-teams-nhs_compass-teams-nhs-data}"
ENV_FILE="${ENV_FILE:-$REPO_ROOT/environment.d/school-service.env}"
SCHOOL_TIMEZONE="${SCHOOL_TIMEZONE:-Australia/Sydney}"
DOCKER_TIMEOUT="${DOCKER_TIMEOUT:-600}"

NO_SCAN=0
NO_CALENDAR=0
NOTIFY_ARGS=()
while [[ $# -gt 0 ]]; do
  case "$1" in
    --no-scan) NO_SCAN=1; shift ;;
    --no-calendar) NO_CALENDAR=1; shift ;;
    --dry-run) NOTIFY_ARGS+=(--dry-run); NO_CALENDAR=1; shift ;;
    --channel) NOTIFY_ARGS+=(--channel "$2"); shift 2 ;;
    --only) NOTIFY_ARGS+=(--only "$2"); shift 2 ;;
    *) echo "unknown argument: $1" >&2; exit 2 ;;
  esac
done

# Take only the notification variables from the service env file, so the
# service's bcrypt hash (which contains "$$") is never re-expanded here.
if [[ -f "$ENV_FILE" ]]; then
  while IFS= read -r line; do
    case "$line" in
      SCHOOL_APPRISE_URL=*|SCHOOL_APPRISE_KEY=*|SCHOOL_APPRISE_TOKEN=*|SCHOOL_APPRISE_TIMEOUT=*|\
      SCHOOL_APPRISE_CHANNELS=*|SCHOOL_APPRISE_TAGS=*|SCHOOL_APPRISE_PARENTS=*|SCHOOL_NOTIFY_TOKEN=*|\
      SCHOOL_HA_URL=*|SCHOOL_HA_TOKEN=*|SCHOOL_HA_CALENDAR_ENTITY=*|SCHOOL_HA_INSECURE=*|SCHOOL_HA_TIMEOUT=*)
        key="${line%%=*}"
        val="${line#*=}"
        if [[ -z "${!key:-}" ]]; then
          export "$key=$val"
        fi
        ;;
    esac
  done < "$ENV_FILE"
fi

if [[ -z "${SCHOOL_APPRISE_KEY:-}" ]]; then
  echo "SCHOOL_APPRISE_KEY is not set in $ENV_FILE: the briefs cannot be sent" >&2
  exit 2
fi

run_school() {
  timeout "$DOCKER_TIMEOUT" docker run --rm --network host \
    -v "$VOLUME:/data" \
    -e SCHOOL_DB_PATH=/data/school.db \
    -e SCHOOL_TIMEZONE="$SCHOOL_TIMEZONE" \
    -e SCHOOL_APPRISE_URL="${SCHOOL_APPRISE_URL:-}" \
    -e SCHOOL_APPRISE_KEY="${SCHOOL_APPRISE_KEY:-}" \
    -e SCHOOL_APPRISE_TOKEN="${SCHOOL_APPRISE_TOKEN:-}" \
    -e SCHOOL_APPRISE_TIMEOUT="${SCHOOL_APPRISE_TIMEOUT:-}" \
    -e SCHOOL_APPRISE_CHANNELS="${SCHOOL_APPRISE_CHANNELS:-}" \
    -e SCHOOL_APPRISE_TAGS="${SCHOOL_APPRISE_TAGS:-}" \
    -e SCHOOL_APPRISE_PARENTS="${SCHOOL_APPRISE_PARENTS:-}" \
    -e SCHOOL_HA_URL="${SCHOOL_HA_URL:-}" \
    -e SCHOOL_HA_TOKEN="${SCHOOL_HA_TOKEN:-}" \
    -e SCHOOL_HA_CALENDAR_ENTITY="${SCHOOL_HA_CALENDAR_ENTITY:-}" \
    -e SCHOOL_HA_INSECURE="${SCHOOL_HA_INSECURE:-}" \
    -e SCHOOL_HA_TIMEOUT="${SCHOOL_HA_TIMEOUT:-}" \
    "$IMAGE" "$@"
}

# 1. Scan both children. A failed scan is already loud in the scan log; keep
#    going so the brief can carry the failure notice instead of silence.
scan_rc=0
if [[ "$NO_SCAN" -eq 0 ]]; then
  echo "== scan both children =="
  if ! IMAGE="$IMAGE" VOLUME="$VOLUME" timeout "$DOCKER_TIMEOUT" "$REPO_ROOT/scripts/scan-compass.sh"; then
    scan_rc=$?
    echo "scan reported a failure (exit $scan_rc); the briefs will say so" >&2
  fi
fi

# 2. Write the calendar for every child. The write is idempotent: the same
#    item is checked on every pass and never re-inserted (FR-8). A failure is
#    loud and makes the run exit non-zero.
calendar_rc=0
if [[ "$NO_CALENDAR" -eq 0 ]]; then
  echo "== write the School calendar (periods + due + overdue + events) =="
  if [[ -n "${SCHOOL_HA_URL:-}" && -n "${SCHOOL_HA_TOKEN:-}" ]]; then
    if ! run_school calendar push; then
      calendar_rc=$?
      echo "calendar push failed (exit $calendar_rc)" >&2
    fi
  else
    echo "SCHOOL_HA_URL/SCHOOL_HA_TOKEN are not set: the calendar was not written" >&2
  fi
fi

# 3. Build and send the briefs.
echo "== send the morning briefs =="
notify_rc=0
if ! run_school notify run "${NOTIFY_ARGS[@]+"${NOTIFY_ARGS[@]}"}"; then
  notify_rc=$?
fi

if [[ "$scan_rc" -ne 0 || "$calendar_rc" -ne 0 || "$notify_rc" -ne 0 ]]; then
  echo "morning brief FAILED: scan_rc=$scan_rc calendar_rc=$calendar_rc notify_rc=$notify_rc" >&2
  exit 1
fi
echo "morning brief complete: both boys + the combined brief to Jo and Sam"