#!/usr/bin/env bash
set -Eeuo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=lib/common.sh
source "$ROOT/lib/common.sh"

VERIFY=0
while [[ $# -gt 0 ]]; do
    case "$1" in
        --verify) VERIFY=1; shift ;;
        -h | --help)
            echo "Usage: init-machine.sh [--verify]"
            exit 0
            ;;
        *) die "unknown option: $1" ;;
    esac
done

load_workspace_env

log "профиль: ${MACHINE_PROFILE:-?}, OS: $(detect_os)"

# --- SSH key ---
KEY_PATH=$(ssh_key_path)
mkdir -p "$(ssh_home)"
if [[ ! -f $KEY_PATH ]]; then
    log "создаю ключ $KEY_PATH"
    ssh-keygen -t ed25519 -C "${SSH_KEY_COMMENT:-papatramp}@$(hostname -s 2>/dev/null || hostname)" -f "$KEY_PATH" -N ""
    log "добавьте публичный ключ в Gitea (kalinamall + home) и GitHub:"
    echo "----------"
    cat "${KEY_PATH}.pub"
    echo "----------"
else
    log "ключ уже есть: $KEY_PATH"
fi

# --- ssh config ---
TMP_BLOCK=$(mktemp)
render_template "$ROOT/config/ssh-config.template" "$TMP_BLOCK"
merge_ssh_config "$TMP_BLOCK"
rm -f "$TMP_BLOCK"
log "обновлён $(ssh_home)/config"

# --- known_hosts ---
for target in "${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}" \
    "${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}" "github.com"; do
    host=${target%%:*}
    port=${target##*:}
    if [[ $host == $port ]]; then port=22; fi
    log "ssh-keyscan $host:$port"
    ssh-keyscan -p "$port" "$host" 2>/dev/null >>"$(ssh_home)/known_hosts" || true
done

# --- git global: только SSH, без credential prompts ---
if [[ -n ${GIT_USER_NAME:-} ]]; then
    git config --global user.name "$GIT_USER_NAME"
fi
if [[ -n ${GIT_USER_EMAIL:-} ]]; then
    git config --global user.email "$GIT_USER_EMAIL"
fi
git config --global credential.helper ""
git config --global url."git@github.com:".insteadOf "https://github.com/"
git config --global url."ssh://git@${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}/".insteadOf "https://${GITEA_KALINAMALL_HOST_PUBLIC}/"
git config --global url."ssh://git@${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}/".insteadOf "https://${GITEA_HOME_HOST_PUBLIC}/"
log "git global: SSH-only, credential.helper отключён"

# --- hosts (optional) ---
if [[ ${UPDATE_HOSTS:-no} == yes ]]; then
    HOSTS_TMP=$(mktemp)
    sed \
        -e "s|__GITEA_KALINAMALL_IP__|${GITEA_KALINAMALL_IP}|g" \
        -e "s|__GITEA_KALINAMALL_HOST__|${GITEA_KALINAMALL_HOST}|g" \
        -e "s|__GITEA_KALINAMALL_HOST_PUBLIC__|${GITEA_KALINAMALL_HOST_PUBLIC}|g" \
        "$ROOT/config/hosts.template" >"$HOSTS_TMP"
    if [[ $(detect_os) == mac ]]; then
        log "добавление в /etc/hosts (нужен sudo)"
        while read -r line; do
            [[ -z $line || $line == \#* ]] && continue
            grep -qF "$line" /etc/hosts 2>/dev/null || echo "$line" | sudo tee -a /etc/hosts >/dev/null
        done <"$HOSTS_TMP"
    elif [[ $(detect_os) == win ]]; then
        log "Windows: добавьте вручную в C:\\Windows\\System32\\drivers\\etc\\hosts:"
        cat "$HOSTS_TMP"
    fi
    rm -f "$HOSTS_TMP"
fi

# --- clone + remotes ---
PROJ=$(projects_dir)
mkdir -p "$PROJ"
while read -r repo has_gh; do
    [[ -z $repo ]] && continue
    dest="$PROJ/$repo"
    if [[ ! -d $dest/.git ]]; then
        log "клонирование $repo"
        git clone "$(kalinamall_remote_url "$repo")" "$dest" || log "клон не удался (сеть/ключ?) — настройте ключ и повторите"
    fi
    if [[ -d $dest/.git ]]; then
        bash "$ROOT/scripts/Set-GitRemotes.sh" --repo-dir "$dest" "$repo" "$has_gh"
        # pre-push hook для github
        if [[ $has_gh == 1 && -f $ROOT/hooks/pre-push ]]; then
            install -m 755 "$ROOT/hooks/pre-push" "$dest/.git/hooks/pre-push"
        fi
    fi
done < <(each_repo)

if [[ $VERIFY == 1 ]]; then
    log "проверка SSH (BatchMode — без запроса пароля)"
    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_KALINAMALL_SSH_PORT" -T "git@${GITEA_KALINAMALL_HOST}" 2>&1 | head -3 || true
    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_HOME_SSH_PORT" -T "git@${GITEA_HOME_HOST}" 2>&1 | head -3 || true
    ssh -o BatchMode=yes -o ConnectTimeout=8 -T git@github.com 2>&1 | head -3 || true
    log "если выше «Permission denied» — добавьте .pub в Gitea/GitHub и повторите --verify"
fi

log "готово"