#!/usr/bin/env bash
# Create the Gitea PATs the build-docs workflow needs and store them as action
# secrets on leeworks-agents/api-company:
#   - SIBLING_REPOS_TOKEN : read:repository  (clone the sibling API repos)
#   - REGISTRY_TOKEN      : write:package + read:package
#                           (push the docs-site image to gitea.leeworks.dev)
#
# Why this script exists:
#   - The auto-injected GITEA_TOKEN is scoped to THIS repo only (can't read
#     sibling repos) and has no package-registry scope (can't push images).
#     GITEA_TOKEN is also a reserved secret name that cannot be overridden.
#   - `tea` cannot CREATE a PAT (no such command), and Gitea's token-creation
#     API requires BASIC AUTH (your password) — a token cannot mint a token.
#   - `tea` CAN set the action secrets using its existing login.
#
# So: this prompts for your password ONCE, mints both PATs via the API, and
# pipes each straight into `tea`. Token values are never written to disk.
#
# Usage:  bash scripts/setup-sibling-repos-token.sh
set -euo pipefail

GITEA_URL="https://gitea.leeworks.dev"
GITEA_USER="0xWheatyz"
REPO="leeworks-agents/api-company"
STAMP="$(date +%Y%m%d)"

command -v curl >/dev/null || { echo "curl required"; exit 1; }
command -v tea  >/dev/null || { echo "tea required";  exit 1; }
command -v python3 >/dev/null || { echo "python3 required"; exit 1; }

echo "Gitea user: $GITEA_USER  ($GITEA_URL)"
read -r -s -p "Gitea password (for $GITEA_USER): " GITEA_PASS
echo

# mint_token <token-name> <json-scopes-array> <secret-name>
mint_token() {
  local token_name="$1" scopes="$2" secret_name="$3" resp pat
  resp="$(curl -fsS -X POST \
    -u "${GITEA_USER}:${GITEA_PASS}" \
    -H 'Content-Type: application/json' \
    -d "{\"name\":\"${token_name}\",\"scopes\":${scopes}}" \
    "${GITEA_URL}/api/v1/users/${GITEA_USER}/tokens")" || {
      echo "Token '${token_name}' creation failed. Check password / 2FA (2FA blocks basic-auth token creation)." >&2
      return 1
    }
  pat="$(printf '%s' "$resp" | python3 -c 'import sys,json; print(json.load(sys.stdin)["sha1"])')"
  [ -n "$pat" ] || { echo "Could not parse token from: $resp" >&2; return 1; }
  printf '%s' "$pat" | tea actions secrets create "$secret_name" --repo "$REPO" --stdin
  echo "  ✓ ${secret_name} set (PAT '${token_name}')"
}

mint_token "sibling-repos-readonly-${STAMP}" '["read:repository"]'                "SIBLING_REPOS_TOKEN"
mint_token "docs-registry-${STAMP}"          '["write:package","read:package"]'   "REGISTRY_TOKEN"

unset GITEA_PASS
echo "Done. Verify:  tea actions secrets list --repo ${REPO}"
echo "Then re-run build-docs (push to main, or: tea actions workflows dispatch build-docs.yaml)"