#!/usr/bin/env bash
#
# One-shot Gitea setup for KisaniCal:
#   1. Creates the `develop` branch on the server (from main) if missing.
#   2. Sets `develop` as the repo's default branch.
#   3. Adds branch protection on `main` (require PR + 1 approval + status check,
#      block direct pushes / force pushes / deletion).
#
# USAGE:
#   export GITEA_TOKEN=xxxxxxxxxxxxxxxxxxxx      # a Gitea access token with repo scope
#   ./scripts/gitea-setup.sh
#
# Create the token in Gitea: click your avatar → Settings → Applications →
#   "Generate New Token"  (scopes: at least  write:repository ).
#
set -euo pipefail

GITEA_URL="http://10.10.1.21:3002"
OWNER="kutesir"
REPO="KisaniCal"

# The commit-status context that must pass before merge into main.
# For Gitea Actions this is the JOB name from ci.yml ("build-and-test").
# After your first CI run, confirm the exact context string at:
#   ${GITEA_URL}/${OWNER}/${REPO}/commits  (hover the check) and adjust if needed.
STATUS_CONTEXT="build-and-test"

: "${GITEA_TOKEN:?Set GITEA_TOKEN env var first (see header).}"

API="${GITEA_URL}/api/v1"
AUTH=(-H "Authorization: token ${GITEA_TOKEN}" -H "Content-Type: application/json")

echo "==> 1/3  Ensuring 'develop' branch exists on server..."
if curl -fsS "${AUTH[@]}" "${API}/repos/${OWNER}/${REPO}/branches/develop" >/dev/null 2>&1; then
  echo "    develop already exists."
else
  curl -fsS -X POST "${AUTH[@]}" \
    "${API}/repos/${OWNER}/${REPO}/branches" \
    -d '{"new_branch_name":"develop","old_branch_name":"main"}' >/dev/null
  echo "    created develop from main."
fi

echo "==> 2/3  Setting default branch to 'develop'..."
curl -fsS -X PATCH "${AUTH[@]}" \
  "${API}/repos/${OWNER}/${REPO}" \
  -d '{"default_branch":"develop"}' >/dev/null
echo "    default branch = develop."

echo "==> 3/3  Applying branch protection on 'main'..."
# If a rule already exists this POST returns 409; we then PUT-update it.
PROTECT_PAYLOAD=$(cat <<JSON
{
  "branch_name": "main",
  "rule_name": "main",
  "enable_push": false,
  "enable_push_whitelist": false,
  "required_approvals": 1,
  "enable_approvals_whitelist": false,
  "block_on_rejected_reviews": true,
  "dismiss_stale_approvals": true,
  "enable_status_check": true,
  "status_check_contexts": ["${STATUS_CONTEXT}"],
  "block_on_outdated_branch": true
}
JSON
)

if curl -fsS -X POST "${AUTH[@]}" \
     "${API}/repos/${OWNER}/${REPO}/branch_protections" \
     -d "${PROTECT_PAYLOAD}" >/dev/null 2>&1; then
  echo "    created protection rule for main."
else
  echo "    rule may already exist — updating it..."
  curl -fsS -X PATCH "${AUTH[@]}" \
    "${API}/repos/${OWNER}/${REPO}/branch_protections/main" \
    -d "${PROTECT_PAYLOAD}" >/dev/null
  echo "    updated protection rule for main."
fi

echo ""
echo "Done. Note: Gitea automatically blocks force-pushes and deletion of a"
echo "protected branch, so 'main' is now safe from both."