#!/bin/bash
set -e

# --- Configuration ---
REGISTRY_URL="https://git.infra.mintel.me/api/packages/mmintel/npm/"
TEST_PACKAGE="@mintel/mail"

echo "🔍 Starting functional registry discovery..."

# Function to test a specific header
test_auth() {
    local label=$1
    local header=$2
    local url=$3
    
    echo "Trying $label..."
    # Capture both status code and body
    # Using -k because sometimes internal registries have cert issues in CI
    RESPONSE=$(curl -s -k -w "\n%{http_code}" -H "$header" "$url")
    STATUS=$(echo "$RESPONSE" | tail -n1)
    BODY=$(echo "$RESPONSE" | head -n -1)
    
    echo "$label status: $STATUS"
    if [ "$STATUS" == "200" ]; then
        return 0
    else
        if [ -n "$BODY" ]; then
            echo "Response snippet: $(echo "$BODY" | head -c 200)"
        fi
        return 1
    fi
}

# 1. Discover Tokens
TOKEN=""
TOKEN_SRC=""
if [ -n "$NPM_TOKEN" ]; then
    TOKEN=$NPM_TOKEN
    TOKEN_SRC="NPM_TOKEN"
elif [ -n "$GITEA_PAT" ]; then
    TOKEN=$GITEA_PAT
    TOKEN_SRC="GITEA_PAT"
elif [ -n "$MINTEL_PRIVATE_TOKEN" ]; then
    TOKEN=$MINTEL_PRIVATE_TOKEN
    TOKEN_SRC="MINTEL_PRIVATE_TOKEN"
fi

if [ -z "$TOKEN" ]; then
    echo "❌ No token found (NPM_TOKEN, GITEA_PAT, MINTEL_PRIVATE_TOKEN are empty)."
    exit 1
fi

echo "Found token from $TOKEN_SRC (length: ${#TOKEN})"

# 2. Functional Test
# In Gitea, the NPM package URL for discovery can be different.
# Try both @mintel/mail and mmintel/mail just in case.
TEST_URL="${REGISTRY_URL}@mintel/mail"

AUTH_TYPE=""
if test_auth "Bearer" "Authorization: Bearer $TOKEN" "$TEST_URL"; then
    AUTH_TYPE="Bearer"
elif test_auth "Basic (raw)" "Authorization: Basic $(echo -n "token:$TOKEN" | base64)" "$TEST_URL"; then
    AUTH_TYPE="Basic"
elif test_auth "Basic (token:pass)" "Authorization: Basic $(echo -n "$TOKEN:" | base64)" "$TEST_URL"; then
    AUTH_TYPE="Basic"
elif test_auth "Gitea Token" "Authorization: token $TOKEN" "$TEST_URL"; then
    AUTH_TYPE="Token"
fi

if [ -z "$AUTH_TYPE" ]; then
    echo "❌ All auth methods failed for $TEST_URL."
    echo "Trying alternative URL format..."
    TEST_URL_ALT="${REGISTRY_URL}mmintel/mail"
    if test_auth "Bearer (Alt)" "Authorization: Bearer $TOKEN" "$TEST_URL_ALT"; then
        AUTH_TYPE="Bearer"
    fi
fi

# 3. Generate .npmrc
echo "Generating .npmrc..."
{
    echo "always-auth=true"
    echo "@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/"
    echo "//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=$TOKEN"
    # Fallback without trailing slash
    echo "//git.infra.mintel.me/api/packages/mmintel/npm:_authToken=$TOKEN"
} > .npmrc

echo "✅ .npmrc hardened and generated (Detected Type: ${AUTH_TYPE:-None})."