#!/usr/bin/env bash
# git-guard.sh — Ensures the compose-files working tree is in sync with Gitea
# before any deploy proceeds. Called automatically by stack-deploy.sh.
#
# Behavior:
#   - Clean + up to date        -> pass silently
#   - Clean + behind (ff-only)  -> auto `git pull --ff-only`, then pass
#   - Ahead only (unpushed)     -> interactive: offer to push; non-interactive: BLOCK
#   - Dirty tracked changes     -> offer to commit + push right now
#                                   (auto in non-interactive/CI runs, after a
#                                   secret-pattern scan of the staged diff)
#   - Diverged (local AND       -> REFUSE. Never auto-resolves. Prints the
#     remote both moved)           backup/stash/reset recovery steps and exits.
#
# Exit codes: 0 = safe to deploy, 1 = blocked, needs human intervention

set -euo pipefail

DIR="/volume1/docker/compose-files"
cd "$DIR"

# Non-interactive detection (Woodpecker/cron have no TTY on stdin)
INTERACTIVE=0
[ -t 0 ] && INTERACTIVE=1

echo "==> git-guard: checking repo sync state"

git fetch origin --quiet

LOCAL="$(git rev-parse main)"
REMOTE="$(git rev-parse origin/main)"
BASE="$(git merge-base main origin/main)"

DIRTY=0
git status --porcelain | grep -q . && DIRTY=1

SECRET_PATTERN='(-----BEGIN [A-Z]+ PRIVATE KEY-----|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9a-zA-Z-]+|password[[:space:]]*[:=][[:space:]]*[^$ ]|api[_-]?key[[:space:]]*[:=][[:space:]]*[^$ ])'

# ---- Case: dirty tracked changes ----
if [ "$DIRTY" -eq 1 ]; then
  echo "!! WORKING TREE DIRTY — uncommitted changes detected:"
  git status --short
  echo

  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Commit and push these changes to origin/main now? [y/N] " ans
  else
    ans="y"
    echo "(non-interactive session — auto-committing and pushing)"
  fi

  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git add -A

    if git diff --cached | grep -Eiq "$SECRET_PATTERN"; then
      echo "ERROR: possible secret detected in staged changes. Refusing to auto-commit."
      echo "Review manually: git diff --cached"
      git reset
      exit 1
    fi

    git commit -m "chore(auto): git-guard autofix - commit local changes before deploy $(date -u +%Y-%m-%dT%H:%M:%SZ)"

    if git push origin main; then
      echo "==> Pushed. Re-checking sync state..."
      exec "$0" "$@"
    else
      echo "ERROR: push failed (likely diverged from origin). Aborting deploy."
      echo "Run: cd $DIR && git status"
      exit 1
    fi
  else
    echo "Aborting deploy - commit or stash changes manually, then retry."
    exit 1
  fi
fi

# ---- Case: fully in sync ----
if [ "$LOCAL" = "$REMOTE" ]; then
  echo "==> In sync with origin/main ($LOCAL). OK to deploy."
  exit 0
fi

# ---- Case: behind only (fast-forwardable) ----
if [ "$LOCAL" = "$BASE" ]; then
  echo "!! Local main is behind origin/main."
  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Fast-forward pull now? [y/N] " ans
  else
    ans="y"
    echo "(non-interactive session — auto fast-forwarding)"
  fi
  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git pull --ff-only origin main
    echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
    exit 0
  else
    echo "Aborting deploy - pull manually, then retry."
    exit 1
  fi
fi

# ---- Case: ahead only (local commits not yet pushed) ----
if [ "$REMOTE" = "$BASE" ]; then
  echo "!! Local main is AHEAD of origin/main (unpushed commits):"
  git log --oneline "origin/main..main"
  echo
  if [ "$INTERACTIVE" -eq 1 ]; then
    read -rp "Push local commits to origin/main now? [y/N] " ans
  else
    ans="n"
    echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
  fi
  if [[ "$ans" =~ ^[Yy]$ ]]; then
    git push origin main
    echo "==> Pushed. OK to deploy."
    exit 0
  else
    echo "Aborting deploy. Review with: git log origin/main..main"
    exit 1
  fi
fi

# ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
echo "!! DIVERGED: local main and origin/main have both moved independently."
echo "!!"
echo "!!   Local-only commits:"
git log --oneline "$BASE..main" | sed 's/^/!!     /'
echo "!!"
echo "!!   Remote-only commits:"
git log --oneline "$BASE..origin/main" | sed 's/^/!!     /'
echo "!!"
echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
echo "!! Recommended recovery:"
echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
echo "!!   3. stash all state: git stash push -u -m 'pre-reset-snapshot'"
echo "!!   4. reset to origin: git reset --hard origin/main"
echo "!!   5. selectively restore needed files from the stash/backup branch"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
exit 1