#!/bin/bash
set -e

# --- CONFIGURATION ---
# The registry domain and base path for @mintel packages
DOMAINS=("git.infra.mintel.me" "registry.infra.mintel.me")
REGISTRY_PATH="/api/packages/mmintel/npm"
# Package used for functional connectivity test (URL encoded)
TEST_PACKAGE_ENCODED="%40mintel%2Fmail"

echo "🚀 Starting Hardened Registry Authentication Discovery..."

# --- TOKEN DISCOVERY ---
# We try various candidate secrets. Gitea environment might have different names.
CANDIDATES=(
    "NPM_TOKEN"
    "GITEA_PAT"
    "MINTEL_PRIVATE_TOKEN"
    "MINTEL_REGISTRY_TOKEN"
    "GITHUB_TOKEN"
    "GITEA_TOKEN"
)

WORKING_TOKEN=""
WORKING_DOMAIN=""

for DOMAIN in "${DOMAINS[@]}"; do
    echo "🔍 Testing connectivity to ${DOMAIN}..."
    
    for VAR_NAME in "${CANDIDATES[@]}"; do
        TOKEN_VAL="${!VAR_NAME}"
        [ -z "${TOKEN_VAL}" ] && continue
        
        echo "  Testing ${VAR_NAME} (len: ${#TOKEN_VAL})..."
        
        # Method 1: Bearer
        STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${TOKEN_VAL}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
        if [ "$STATUS" == "200" ]; then
            echo "    ✅ ${VAR_NAME} verified via Bearer on ${DOMAIN}"
            WORKING_TOKEN="${TOKEN_VAL}"
            WORKING_DOMAIN="${DOMAIN}"
            break 2
        fi
        
        # Method 2: Basic (Token as user, empty password)
        AUTH_BASIC=$(echo -n "${TOKEN_VAL}:" | base64)
        STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Basic ${AUTH_BASIC}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
        if [ "$STATUS" == "200" ]; then
            echo "    ✅ ${VAR_NAME} verified via Basic on ${DOMAIN}"
            WORKING_TOKEN="${TOKEN_VAL}"
            WORKING_DOMAIN="${DOMAIN}"
            break 2
        fi

        # Method 3: Basic (User 'token', Token as password - Gitea standard)
        AUTH_GITEA=$(echo -n "token:${TOKEN_VAL}" | base64)
        STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Basic ${AUTH_GITEA}" "https://${DOMAIN}${REGISTRY_PATH}/${TEST_PACKAGE_ENCODED}" || echo "000")
        if [ "$STATUS" == "200" ]; then
            echo "    ✅ ${VAR_NAME} verified via Gitea-Token-Basic on ${DOMAIN}"
            WORKING_TOKEN="${TOKEN_VAL}"
            WORKING_DOMAIN="${DOMAIN}"
            break 2
        fi
    done
done

if [ -z "${WORKING_TOKEN}" ]; then
    echo "⚠️ ALL functional tests failed for all domains."
    if [ -n "${NPM_TOKEN}" ]; then
        echo "Falling back to NPM_TOKEN (unverified) and git.infra.mintel.me"
        WORKING_TOKEN="${NPM_TOKEN}"
        WORKING_DOMAIN="git.infra.mintel.me"
    else
        echo "❌ CRITICAL: No usable token found and NPM_TOKEN is empty."
        exit 1
    fi
fi

# --- .npmrc GENERATION ---
# We generate a .npmrc that matches the local pattern exactly to avoid resolution drift.
# Local pattern:
# @mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm
# //git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${TOKEN}

cat > .npmrc << EOF
@mintel:registry=https://${WORKING_DOMAIN}${REGISTRY_PATH}
//${WORKING_DOMAIN}${REGISTRY_PATH}/:_authToken=${WORKING_TOKEN}
//${WORKING_DOMAIN}${REGISTRY_PATH}/:always-auth=true
EOF

# Add secondary domain if we found one working
for DOMAIN in "${DOMAINS[@]}"; do
    if [ "${DOMAIN}" != "${WORKING_DOMAIN}" ]; then
        cat >> .npmrc << EOF
//${DOMAIN}${REGISTRY_PATH}/:_authToken=${WORKING_TOKEN}
//${DOMAIN}${REGISTRY_PATH}/:always-auth=true
EOF
    fi
done

echo "✅ .npmrc hardened with verified token on ${WORKING_DOMAIN}."
echo "--- Generated .npmrc (masked) ---"
sed 's/_authToken=.*/_authToken=********/' .npmrc
echo "--------------------------------"

# --- OUTPUT FOR CI ---
if [ -n "$GITHUB_OUTPUT" ]; then
    echo "working_token=${WORKING_TOKEN}" >> "$GITHUB_OUTPUT"
    echo "working_domain=${WORKING_DOMAIN}" >> "$GITHUB_OUTPUT"
fi