#!/bin/sh
# Run the SQLite pipeline with the repository's dedicated Gitea credential.
set -eu

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
PYTHON_BIN=${PYTHON_BIN:-python3}
CREDENTIALS_FILE=${HOME:?}/.config/gitea/credentials.env

if [ ! -r "$CREDENTIALS_FILE" ]; then
    printf '%s\n' "Credential file is not readable: $CREDENTIALS_FILE" >&2
    exit 1
fi
if [ "$(stat -f '%Lp' "$CREDENTIALS_FILE")" != 600 ]; then
    printf '%s\n' "Credential file must have mode 600: $CREDENTIALS_FILE" >&2
    exit 1
fi

credential_value() {
    awk -F= -v wanted="$1" '$1 ~ "^[[:space:]]*" wanted "[[:space:]]*$" { sub(/^[[:space:]]*/, "", $2); sub(/[[:space:]]*$/, "", $2); print $2; exit }' "$CREDENTIALS_FILE"
}

AGENTSTAGE_USER=$(credential_value GITEA_USER)
AGENTSTAGE_TOKEN=$(credential_value GITEA_TOKEN)
missing=''
[ -n "$AGENTSTAGE_USER" ] || missing="$missing AGENTSTAGE_USER"
[ -n "$AGENTSTAGE_TOKEN" ] || missing="$missing AGENTSTAGE_TOKEN"
if [ -n "$missing" ]; then
    printf 'Missing required .env variable(s):%s\n' "$missing" >&2
    exit 1
fi
if [ "$AGENTSTAGE_USER" != "liuji" ]; then
    printf '%s\n' "AGENTSTAGE_USER must be liuji" >&2
    exit 1
fi
export AGENTSTAGE_USER AGENTSTAGE_TOKEN

# Override Git only for this process tree: never read osxkeychain and never alter .git/config.
REMOTE_URL=$(git -C "$PROJECT_ROOT" config --get remote.origin.url || true)
case "$REMOTE_URL" in
    https://*)
        REMOTE_TARGET=${REMOTE_URL#https://}
        REMOTE_TARGET=${REMOTE_TARGET#*@}
        REMOTE_URL="https://liuji@$REMOTE_TARGET"
        ;;
    *)
        printf '%s\n' "remote.origin.url must use HTTPS" >&2
        exit 1
        ;;
esac
export GIT_CONFIG_COUNT=3
export GIT_CONFIG_KEY_0=credential.helper
export GIT_CONFIG_VALUE_0=
export GIT_CONFIG_KEY_1=remote.origin.url
export GIT_CONFIG_VALUE_1="$REMOTE_URL"
export GIT_CONFIG_KEY_2=remote.origin.pushurl
export GIT_CONFIG_VALUE_2="$REMOTE_URL"

umask 077
ASKPASS=$(mktemp "${TMPDIR:-/tmp}/af-click-gap-askpass.XXXXXX")
cleanup() {
    rm -f -- "$ASKPASS"
}
trap cleanup EXIT HUP INT TERM

cat >"$ASKPASS" <<'ASKPASS_SCRIPT'
#!/bin/sh
case "$1" in
    *[Uu]sername*) printf '%s\n' "$AGENTSTAGE_USER" ;;
    *[Pp]assword*) printf '%s\n' "$AGENTSTAGE_TOKEN" ;;
    *) exit 1 ;;
esac
ASKPASS_SCRIPT
chmod 700 "$ASKPASS"

export GIT_ASKPASS="$ASKPASS"
export GIT_TERMINAL_PROMPT=0
"$PYTHON_BIN" "$PROJECT_ROOT/scripts/af_click_gap_pipeline.py" --push "$@"
exit $?