#!/bin/bash
# Hardened Registry Authentication Discovery & Hardening
# Standard: mmintel/klz-2026

set -e

REGISTRY_DOMAIN="git.infra.mintel.me"
REGISTRY_PATH="/api/packages/mmintel/npm/"
TEST_PACKAGE_ENCODED="%40mintel%2Fmail"
TEST_URL="https://${REGISTRY_DOMAIN}${REGISTRY_PATH}${TEST_PACKAGE_ENCODED}"

echo "🔍 Starting robust functional registry discovery..."

# Collect candidate tokens from environment
# We try them all because NPM_TOKEN might be stale while GITEA_PAT is fresh
CANDIDATES=""
[ -n "$NPM_TOKEN" ] && CANDIDATES="${CANDIDATES} NPM_TOKEN"
[ -n "$GITEA_PAT" ] && CANDIDATES="${CANDIDATES} GITEA_PAT"
[ -n "$MINTEL_PRIVATE_TOKEN" ] && CANDIDATES="${CANDIDATES} MINTEL_PRIVATE_TOKEN"

if [ -z "$CANDIDATES" ]; then
    echo "❌ No registry tokens found in environment (NPM_TOKEN, GITEA_PAT, MINTEL_PRIVATE_TOKEN are empty)."
    exit 1
fi

AUTH_TYPE="None"
WORKING_TOKEN=""

# Function to test connectivity
check_url() {
    local label=$1
    local auth_header=$2
    local url=$3
    
    # Using -k for internal cert resilience
    local code=$(curl -s -k -o /tmp/reg_body -w "%{http_code}" -H "$auth_header" "$url")
    if [ "$code" = "200" ]; then
        return 0
    else
        local body=$(cat /tmp/reg_body | head -c 100)
        echo "    $label failed ($code): $body"
        return 1
    fi
}

for CANDIDATE_NAME in $CANDIDATES; do
    TOKEN_VAL=$(eval echo "\$$CANDIDATE_NAME")
    echo "Testing token from $CANDIDATE_NAME (length: ${#TOKEN_VAL})..."

    # 1. Try Bearer
    if check_url "Bearer" "Authorization: Bearer ${TOKEN_VAL}" "${TEST_URL}"; then
        echo "✅ Working Bearer token found in $CANDIDATE_NAME."
        AUTH_TYPE="Bearer"
        WORKING_TOKEN="${TOKEN_VAL}"
        break
    fi

    # 2. Try Basic (token:x-oauth-basic) - Gitea Standard
    # Encode token:x-oauth-basic
    BASIC_AUTH=$(echo -n "${TOKEN_VAL}:x-oauth-basic" | base64 | tr -d '\n')
    if check_url "Basic (token:x-oauth-basic)" "Authorization: Basic ${BASIC_AUTH}" "${TEST_URL}"; then
        echo "✅ Working Basic (token:x-oauth-basic) found in $CANDIDATE_NAME."
        AUTH_TYPE="Bearer" # Still use _authToken
        WORKING_TOKEN="${TOKEN_VAL}"
        break
    fi

    # 3. Try Basic (token:empty)
    BASIC_AUTH_EMPTY=$(echo -n "${TOKEN_VAL}:" | base64 | tr -d '\n')
    if check_url "Basic (token:)" "Authorization: Basic ${BASIC_AUTH_EMPTY}" "${TEST_URL}"; then
        echo "✅ Working Basic (token:) found in $CANDIDATE_NAME."
        AUTH_TYPE="Bearer"
        WORKING_TOKEN="${TOKEN_VAL}"
        break
    fi
    
    # 4. Try Gitea 'token' header
    if check_url "Token Header" "Authorization: token ${TOKEN_VAL}" "${TEST_URL}"; then
        echo "✅ Working Gitea Token header found in $CANDIDATE_NAME."
        AUTH_TYPE="Bearer"
        WORKING_TOKEN="${TOKEN_VAL}"
        break
    fi
done

# Generate .npmrc
echo "Generating .npmrc..."
{
    echo "always-auth=true"
    echo "@mintel:registry=https://${REGISTRY_DOMAIN}${REGISTRY_PATH}"
    
    if [ "$AUTH_TYPE" != "None" ]; then
        echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_authToken=${WORKING_TOKEN}"
        echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:always-auth=true"
        # Fallback without trailing slash for some versions of npm/pnpm
        CLEAN_PATH=$(echo "${REGISTRY_PATH}" | sed 's/\/$//')
        echo "//${REGISTRY_DOMAIN}${CLEAN_PATH}:_authToken=${WORKING_TOKEN}"
        echo "✅ .npmrc hardened with verified $CANDIDATE_NAME."
    else
        echo "❌ ALL functional tests failed. Falling back to NPM_TOKEN (unverified)."
        echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_authToken=${NPM_TOKEN}"
    fi
} > .npmrc

# Debug summary
echo "Final .npmrc configuration (masked):"
cat .npmrc | sed 's/_authToken=.*/_authToken=********/'