#!/bin/bash
set -e

# Configuration
REGISTRY_URL="https://git.infra.mintel.me/api/packages/mmintel/npm/"
REGISTRY_DOMAIN="git.infra.mintel.me"
REGISTRY_PATH="/api/packages/mmintel/npm/"
SCOPE="@mintel"

echo "🔍 Starting functional registry discovery..."

# Discover token
token=""
token_src=""
if [ -n "$NPM_TOKEN" ]; then
    token="$NPM_TOKEN"
    token_src="NPM_TOKEN"
elif [ -n "$GITEA_PAT" ]; then
    token="$GITEA_PAT"
    token_src="GITEA_PAT"
elif [ -n "$MINTEL_PRIVATE_TOKEN" ]; then
    token="$MINTEL_PRIVATE_TOKEN"
    token_src="MINTEL_PRIVATE_TOKEN"
fi

if [ -z "$token" ]; then
    echo "❌ No registry token found (checked NPM_TOKEN, GITEA_PAT, MINTEL_PRIVATE_TOKEN)"
    exit 1
fi

echo "Found token from $token_src (length: ${#token})"

# Functional check against the registry
test_pkg="@mintel/mail"
test_url="${REGISTRY_URL}${test_pkg//\//@}"
echo "Testing registry access for $test_pkg..."

# Try Bearer (standard for _authToken)
echo "Trying Bearer auth..."
status_bearer=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $token" "$test_url")
echo "Bearer status: $status_bearer"

# Try Basic (standard for _auth or user:pass)
echo "Trying Basic auth..."
status_basic=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Basic $token" "$test_url")
echo "Basic status: $status_basic"

# Try Token (Gitea specific sometimes)
echo "Trying Token auth..."
status_token=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $token" "$test_url")
echo "Token status: $status_token"

best_auth=""
if [ "$status_bearer" -eq 200 ]; then
    echo "✅ Bearer auth worked!"
    best_auth="authToken"
elif [ "$status_basic" -eq 200 ]; then
    echo "✅ Basic auth worked!"
    best_auth="auth"
elif [ "$status_token" -eq 200 ]; then
    echo "✅ Token auth worked! (Using Bearer for pnpm)"
    best_auth="authToken"
else
    echo "❌ All auth methods failed."
    # Check if it's base64 encoded user:pass and maybe we should decode it then use Bearer?
    # Or maybe it's a raw PAT and we should base64 it for Basic?
fi

# Generate .npmrc
echo "Generating .npmrc..."

cat << EOF > .npmrc
$SCOPE:registry=$REGISTRY_URL
always-auth=true
EOF

# If none worked, default to authToken as it's most common
if [ -z "$best_auth" ] || [ "$best_auth" = "authToken" ]; then
    echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_authToken=$token" >> .npmrc
    echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH%/}:_authToken=$token" >> .npmrc
else
    echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_auth=$token" >> .npmrc
    echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH%/}:_auth=$token" >> .npmrc
fi

echo "progress=false" >> .npmrc
echo "verify-store-integrity=false" >> .npmrc

echo "✅ .npmrc hardened and generated."