#!/usr/bin/env bash
# Idempotent bootstrap for AndyTranscribe Gitea Actions secrets on z00.
# Requires an already-running Gitea + act_runner (see airports setup).
set -euo pipefail

GITEA_DIR="${GITEA_DIR:-${HOME}/gitea}"
REPO_OWNER="${REPO_OWNER:-ben}"
REPO_NAME="${REPO_NAME:-AndyTranscribe}"
REGISTRY_HOST="${REGISTRY_HOST:-gitea.z00.nu}"
DEPLOY_PATH="${DEPLOY_PATH:-${HOME}/andyTranscibe}"
CREDENTIALS_FILE="${GITEA_DIR}/.credentials"

if [[ ! -f "${CREDENTIALS_FILE}" ]]; then
    echo "Missing ${CREDENTIALS_FILE}" >&2
    exit 1
fi

# shellcheck disable=SC1090
source "${CREDENTIALS_FILE}"

API="https://${REGISTRY_HOST}/api/v1"
AUTH=(-u "${ADMIN_USERNAME}:${ADMIN_PASSWORD}")

if ! curl -fsS "${AUTH[@]}" "${API}/repos/${REPO_OWNER}/${REPO_NAME}" >/dev/null 2>&1; then
    echo "Repository ${REPO_OWNER}/${REPO_NAME} not found on ${REGISTRY_HOST}" >&2
    exit 1
fi

CI_TOKEN="$(
    docker exec -u git gitea gitea admin user generate-access-token \
        -u "${ADMIN_USERNAME}" \
        -t "ci-${REPO_NAME}-$(date +%Y%m%d%H%M%S)" \
        --scopes "write:package,read:package,write:repository,read:repository" \
        --raw
)"

PULL_TOKEN="$(
    docker exec -u git gitea gitea admin user generate-access-token \
        -u "${ADMIN_USERNAME}" \
        -t "pull-${REPO_NAME}-$(date +%Y%m%d%H%M%S)" \
        --scopes "read:package" \
        --raw
)"

set_secret() {
    local name="$1"
    local value="$2"
    local tmp
    tmp="$(mktemp)"
    python3 -c 'import json,sys; json.dump({"data": sys.argv[1]}, open(sys.argv[2], "w"))' "${value}" "${tmp}"
    curl -fsS "${AUTH[@]}" -X PUT \
        "${API}/repos/${REPO_OWNER}/${REPO_NAME}/actions/secrets/${name}" \
        -H "Content-Type: application/json" \
        --data-binary @"${tmp}" >/dev/null
    rm -f "${tmp}"
}

set_secret "REGISTRY_TOKEN" "${CI_TOKEN}"
set_secret "DEPLOY_PATHS" "${DEPLOY_PATH}"

printf '%s' "${PULL_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${ADMIN_USERNAME}" --password-stdin

REPO_LC="$(echo "${REPO_OWNER}/${REPO_NAME}" | tr '[:upper:]' '[:lower:]')"
if [[ -f "${DEPLOY_PATH}/.env" ]]; then
    if grep -q '^APP_IMAGE=' "${DEPLOY_PATH}/.env"; then
        sed -i "s|^APP_IMAGE=.*|APP_IMAGE=${REGISTRY_HOST}/${REPO_LC}:latest|" "${DEPLOY_PATH}/.env"
    else
        printf '\nAPP_IMAGE=%s/%s:latest\n' "${REGISTRY_HOST}" "${REPO_LC}" >> "${DEPLOY_PATH}/.env"
    fi
fi

# Ensure the existing host runner is up (shared with airports).
if systemctl --user is-enabled gitea-act-runner.service >/dev/null 2>&1; then
    systemctl --user restart gitea-act-runner.service || true
    systemctl --user --no-pager --lines=5 status gitea-act-runner.service || true
fi

echo "Gitea CI secrets configured for ${REGISTRY_HOST}/${REPO_OWNER}/${REPO_NAME}"
echo "Deploy path: ${DEPLOY_PATH}"
echo "Push to main to build, push the image, and deploy."