#!/usr/bin/env bash
# Sync allowlisted paths from the private repo to the public Gitea repo (no full source).
# Usage:
#   export GITEA_TOKEN='<token>'
#   ./proxmox/sync-public.sh --gitea-url https://gitea.example.com --owner org --repo myoffice-public --push
#
# Allowlist: proxmox/, Docker/, README.md, LICENSE (if present).

set -euo pipefail

script_dir="$(cd "$(dirname "$0")" && pwd)"
repo_root="$(cd "$script_dir/.." && pwd)"
cd "$repo_root"

gitea_url="${GITEA_URL:-}"
owner="${GITEA_OWNER:-}"
repo="${GITEA_REPO:-myoffice-public}"
branch="${BRANCH:-main}"
token="${GITEA_TOKEN:-}"
work_dir="${WORK_DIR:-}"
do_push=false

usage() {
	echo "Usage: $0 --gitea-url URL --owner OWNER [--repo REPO] [--branch BRANCH] [--push]" >&2
	exit 1
}

while [[ $# -gt 0 ]]; do
	case "$1" in
		--gitea-url)
			gitea_url="$2"
			shift 2
			;;
		--owner)
			owner="$2"
			shift 2
			;;
		--repo)
			repo="$2"
			shift 2
			;;
		--branch)
			branch="$2"
			shift 2
			;;
		--work-dir)
			work_dir="$2"
			shift 2
			;;
		--push)
			do_push=true
			shift
			;;
		-h | --help)
			usage
			;;
		*)
			echo "Unknown argument: $1" >&2
			usage
			;;
	esac
done

if [[ -z "$gitea_url" || -z "$owner" ]]; then
	usage
fi

gitea_url="${gitea_url%/}"

if [[ -z "$work_dir" ]]; then
	work_dir="${TMPDIR:-/tmp}/myoffice-public-sync"
fi

allow_dirs=(proxmox Docker)
allow_files=(README.md LICENSE LICENSE.md)
exclude_names=('.git' '_Published' 'myoffice-publish.tar.gz' 'node_modules' 'data' '.env' 'env.local')

is_excluded() {
	local name="$1"
	for x in "${exclude_names[@]}"; do
		[[ "$name" == "$x" ]] && return 0
	done
	return 1
}

if [[ -n "$token" ]]; then
	host_part="${gitea_url#https://}"
	host_part="${host_part#http://}"
	if [[ "$gitea_url" == http://* ]]; then
		scheme=http
	else
		scheme=https
	fi
	remote="${scheme}://oauth2:${token}@${host_part}/${owner}/${repo}.git"
else
	remote="${gitea_url}/${owner}/${repo}.git"
	echo "No token — using remote as-is (SSH URL recommended): $remote"
fi

echo "-----------------------------------------------"
echo "Sync allowlist -> $owner/$repo ($branch)"
echo "WorkDir: $work_dir"
echo "-----------------------------------------------"

rm -rf "$work_dir"
mkdir -p "$work_dir"

if git clone --depth 1 --branch "$branch" "$remote" "$work_dir" 2>/dev/null; then
	:
else
	echo "Clone failed or empty repo — initializing new git repo..."
	git -C "$work_dir" init -b "$branch" 2>/dev/null || {
		git -C "$work_dir" init
		git -C "$work_dir" checkout -b "$branch" 2>/dev/null || true
	}
	git -C "$work_dir" remote remove origin 2>/dev/null || true
	git -C "$work_dir" remote add origin "$remote"
fi

find "$work_dir" -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +

for dir in "${allow_dirs[@]}"; do
	src="$repo_root/$dir"
	if [[ ! -d "$src" ]]; then
		echo "Skip missing dir: $dir"
		continue
	fi
	dest="$work_dir/$dir"
	mkdir -p "$dest"
	while IFS= read -r -d '' item; do
		name="$(basename "$item")"
		if is_excluded "$name"; then
			continue
		fi
		if [[ "$dir" == Docker && "$name" == data ]]; then
			continue
		fi
		cp -a "$item" "$dest/"
	done < <(find "$src" -mindepth 1 -maxdepth 1 -print0)
	echo "Synced $dir/"
done

for file in "${allow_files[@]}"; do
	src="$repo_root/$file"
	if [[ -f "$src" ]]; then
		cp -a "$src" "$work_dir/$file"
		echo "Synced $file"
	fi
done

cat >"$work_dir/PUBLIC.md" <<'EOF'
# MyOffice public tree

This repository is a **filtered** mirror for Proxmox CT install scripts and Docker demo files.
Application **source** stays in the private developer repository.
Runnable app binaries are published as **Gitea Releases** (`myoffice-publish.tar.gz`).

See [proxmox/README.md](proxmox/README.md).

EOF

git -C "$work_dir" add -A
if [[ -z "$(git -C "$work_dir" status --porcelain)" ]]; then
	echo "No changes to commit."
else
	git -C "$work_dir" -c user.email='myoffice-sync@local' -c user.name='myoffice-sync' \
		commit -m "sync public allowlist from private myoffice"
	echo "Committed allowlist snapshot."
fi

if [[ "$do_push" == true ]]; then
	echo "Pushing to origin $branch..."
	git -C "$work_dir" push -u origin "HEAD:$branch"
	echo "Pushed."
else
	echo "Dry run (no push). Re-run with --push to publish."
	echo "Work tree left at: $work_dir"
fi

echo ""
echo "Raw base for CT install:"
echo "  $gitea_url/$owner/$repo/raw/branch/$branch"
echo ""