# Sync allowlisted paths from the private repo to the public Gitea repo (no full source).
# Usage:
#   $env:GITEA_TOKEN = '<token>'   # optional if using SSH remote
#   .\proxmox\sync-public.ps1 -GiteaUrl https://gitea.example.com -Owner org -Repo myoffice-public -Push
#
# Allowlist: proxmox/, Docker/, README.md, LICENSE (if present).
# Never syncs MyOffice.* source, _Published, secrets, node_modules, etc.

[CmdletBinding()]
param(
	[Parameter(Mandatory = $true)]
	[string]$GiteaUrl,

	[Parameter(Mandatory = $true)]
	[string]$Owner,

	[string]$Repo = 'myoffice-public',

	[string]$Branch = 'main',

	[string]$Token = $env:GITEA_TOKEN,

	[string]$WorkDir = '',

	[switch]$Push
)

$ErrorActionPreference = 'Stop'

$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$repoRoot = Resolve-Path (Join-Path $scriptDir '..')
Set-Location $repoRoot

$GiteaUrl = $GiteaUrl.TrimEnd('/')

if (-not $WorkDir) {
	$WorkDir = Join-Path $env:TEMP 'myoffice-public-sync'
}

$allowDirs = @('proxmox', 'Docker')
$allowFiles = @('README.md', 'LICENSE', 'LICENSE.md')
$excludeNames = @('.git', '_Published', 'myoffice-publish.tar.gz', 'node_modules', 'data', '.env', 'env.local')

function Test-Excluded([string]$Name) {
	return $excludeNames -contains $Name
}

function Copy-Allowlisted {
	param([string]$DestRoot)

	foreach ($dir in $allowDirs) {
		$src = Join-Path $repoRoot $dir
		if (-not (Test-Path $src)) {
			Write-Host "Skip missing dir: $dir"
			continue
		}
		$dest = Join-Path $DestRoot $dir
		if (Test-Path $dest) {
			Remove-Item -Recurse -Force $dest
		}
		New-Item -ItemType Directory -Path $dest -Force | Out-Null

		Get-ChildItem -Path $src -Force | Where-Object { -not (Test-Excluded $_.Name) } | ForEach-Object {
			if ($dir -eq 'Docker' -and $_.Name -eq 'data') { return }
			Copy-Item $_.FullName -Destination (Join-Path $dest $_.Name) -Recurse -Force
		}
		Write-Host "Synced $dir/"
	}

	foreach ($file in $allowFiles) {
		$src = Join-Path $repoRoot $file
		if (Test-Path $src) {
			Copy-Item $src -Destination (Join-Path $DestRoot $file) -Force
			Write-Host "Synced $file"
		}
	}

	$publicNote = Join-Path $DestRoot 'PUBLIC.md'
	@(
		'# MyOffice public tree',
		'',
		'This repository is a **filtered** mirror for Proxmox CT install scripts and Docker demo files.',
		'Application **source** stays in the private developer repository.',
		'Runnable app binaries are published as **Gitea Releases** (`myoffice-publish.tar.gz`).',
		'',
		'See [proxmox/README.md](proxmox/README.md).',
		''
	) | Set-Content -Path $publicNote -Encoding utf8
}

if ($Token) {
	$hostPart = $GiteaUrl -replace '^https://', '' -replace '^http://', ''
	$scheme = if ($GiteaUrl -match '^http://') { 'http' } else { 'https' }
	$remote = "${scheme}://oauth2:${Token}@${hostPart}/${Owner}/${Repo}.git"
}
else {
	$remote = "${GiteaUrl}/${Owner}/${Repo}.git"
	Write-Host "No token — using remote as-is (SSH URL recommended): $remote"
}

Write-Host "-----------------------------------------------"
Write-Host "Sync allowlist -> $Owner/$Repo ($Branch)"
Write-Host "WorkDir: $WorkDir"
Write-Host "-----------------------------------------------"

if (Test-Path $WorkDir) {
	Remove-Item -Recurse -Force $WorkDir
}
New-Item -ItemType Directory -Path $WorkDir | Out-Null

$cloned = $false
git clone --depth 1 --branch $Branch $remote $WorkDir 2>$null
if ($LASTEXITCODE -eq 0) {
	$cloned = $true
}

if (-not $cloned) {
	Write-Host "Clone failed or empty repo — initializing new git repo..."
	git -C $WorkDir init -b $Branch
	if ($LASTEXITCODE -ne 0) {
		git -C $WorkDir init
		git -C $WorkDir checkout -b $Branch 2>$null
	}
	git -C $WorkDir remote remove origin 2>$null
	git -C $WorkDir remote add origin $remote
}

Get-ChildItem -Path $WorkDir -Force | Where-Object { $_.Name -ne '.git' } | ForEach-Object {
	Remove-Item $_.FullName -Recurse -Force
}

Copy-Allowlisted -DestRoot $WorkDir

git -C $WorkDir add -A
$status = git -C $WorkDir status --porcelain
if (-not $status) {
	Write-Host "No changes to commit."
}
else {
	git -C $WorkDir -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' `
		commit -m "sync public allowlist from private myoffice"
	Write-Host "Committed allowlist snapshot."
}

if ($Push) {
	Write-Host "Pushing to origin $Branch..."
	git -C $WorkDir push -u origin "HEAD:$Branch"
	if ($LASTEXITCODE -ne 0) {
		throw "git push failed with exit code $LASTEXITCODE"
	}
	Write-Host "Pushed."
}
else {
	Write-Host "Dry run (no push). Re-run with -Push to publish."
	Write-Host "Work tree left at: $WorkDir"
}

Write-Host ""
Write-Host "Raw base for CT install:"
Write-Host "  $GiteaUrl/$Owner/$Repo/raw/branch/$Branch"
Write-Host ""