#!/usr/bin/env bash

set +x
set -Eeuo pipefail

WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
config_token_file="${WATERMAPS_GITEA_CONFIG_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-actions-config-token}"
registry_token_file="${WATERMAPS_GITEA_REGISTRY_TOKEN_FILE:-$WM_DEPLOY_DIR/.gitea-registry-publish-token}"
gitea_url="${WATERMAPS_GITEA_URL:-https://gitea.incoso.eu}"
repository="${WATERMAPS_GITEA_REPOSITORY:-kevin_janssen/watermaps}"

jq_command="$(command -v jq 2>/dev/null || true)"
if [[ -z "$jq_command" && -x "$WM_ROOT_DIR/.tools/bin/jq" ]]; then
  jq_command="$WM_ROOT_DIR/.tools/bin/jq"
fi
[[ -n "$jq_command" ]] || {
  printf 'jq fehlt; bitte jq installieren oder unter .tools/bin/jq bereitstellen.\n' >&2
  exit 1
}

cleanup_secrets() {
  unset config_token registry_token token_payload
}
trap cleanup_secrets EXIT

read_secret_file() {
  local label="$1"
  local path="$2"
  local mode
  local value

  [[ -f "$path" && ! -L "$path" ]] || {
    printf '%s fehlt oder ist keine reguläre Datei: %s\n' "$label" "$path" >&2
    return 1
  }
  mode="$(stat --format=%a -- "$path")"
  [[ "$mode" == "600" ]] || {
    printf '%s muss Dateimodus 600 haben (chmod 600 %s; aktuell: %s).\n' \
      "$label" "$path" "$mode" >&2
    return 1
  }

  value="$(<"$path")"
  [[ -n "$value" && "$value" != *[[:space:]]* ]] || {
    printf '%s ist leer oder enthält Leerzeichen beziehungsweise Zeilenumbrüche.\n' \
      "$label" >&2
    return 1
  }
  printf '%s' "$value"
}

config_token="$(
  read_secret_file \
    "Lokaler Gitea-Konfigurations-PAT" \
    "$config_token_file"
)"
registry_token="$(
  read_secret_file \
    "Gitea-Registry-Publish-PAT" \
    "$registry_token_file"
)"
[[ ! "$config_token_file" -ef "$registry_token_file" ]] || {
  printf 'Konfigurations- und Registry-PAT müssen in zwei getrennten Dateien liegen.\n' >&2
  exit 1
}
[[ "$config_token" != "$registry_token" ]] || {
  printf 'Konfigurations- und Registry-PAT müssen zwei unterschiedliche Tokens sein.\n' >&2
  exit 1
}
[[ "$repository" =~ ^([A-Za-z0-9_.-]+)/([A-Za-z0-9_.-]+)$ ]] || {
  printf 'Ungültiges Gitea-Repository: %s\n' "$repository" >&2
  exit 1
}
registry_username="${BASH_REMATCH[1]}"
[[ "$gitea_url" =~ ^https://[^/?#]+(:[0-9]+)?$ ]] || {
  printf 'Die Gitea-URL muss eine HTTPS-Origin ohne Pfad sein: %s\n' "$gitea_url" >&2
  exit 1
}

api_request() {
  local method="$1"
  local endpoint="$2"
  local payload="${3:-}"
  local auth_header="Authorization: token $config_token"
  local args=(
    --proto '=https'
    --tlsv1.2
    --fail
    --silent
    --show-error
    --connect-timeout 10
    --max-time 30
    --request "$method"
    --header @/dev/fd/3
  )
  if [[ -n "$payload" ]]; then
    args+=(
      --header "Content-Type: application/json"
      --data-binary @/dev/fd/4
    )
    curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
      3<<<"$auth_header" \
      4<<<"$payload"
  else
    curl "${args[@]}" "$gitea_url/api/v1/$endpoint" \
      3<<<"$auth_header"
  fi
}

username_payload="$(
  printf '%s' "$registry_username" |
    "$jq_command" --raw-input --slurp '{data: .}'
)"
token_payload="$(
  printf '%s' "$registry_token" |
    "$jq_command" --raw-input --slurp '{data: .}'
)"
api_request \
  PUT \
  "repos/$repository/actions/secrets/REGISTRY_USERNAME" \
  "$username_payload" \
  >/dev/null
api_request \
  PUT \
  "repos/$repository/actions/secrets/REGISTRY_TOKEN" \
  "$token_payload" \
  >/dev/null

unset config_token registry_token token_payload
printf 'Gitea Actions Registry-Secrets wurden für %s aktualisiert.\n' "$repository"