#!/usr/bin/env bash
# Publish a built artifact into the `releases` collection (issue #16).
#
# The collection is superuser-only, so this authenticates as a PocketBase
# superuser and uploads the artifact + metadata via the admin REST API. Run it
# on the machine that built the artifact (it computes the SHA-256 + size that the
# app verifies before installing).
#
# Auth (pick one, via env — never pass secrets on the command line):
#   PB_ADMIN_TOKEN=<superuser token>            # preferred; nothing sensitive stored
#   PB_ADMIN_EMAIL + PB_ADMIN_PASSWORD          # script exchanges them for a token
#
# Usage:
#   PB_ADMIN_TOKEN=... ./scripts/publish-release.sh \
#     --platform linux --variant clean --version 1.0.1 --build 2 \
#     --file build/amber-linux-clean.zip --notes "Bug fixes"
#
# --pb-url defaults to https://pb.petruzalekr.cz (override for a local/stage PB).
set -euo pipefail

PB_URL="https://pb.petruzalekr.cz"
PLATFORM="" VARIANT="" VERSION="" BUILD="" FILE="" NOTES=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --platform) PLATFORM="$2"; shift 2 ;;
    --variant)  VARIANT="$2";  shift 2 ;;
    --version)  VERSION="$2";  shift 2 ;;
    --build)    BUILD="$2";    shift 2 ;;
    --file)     FILE="$2";     shift 2 ;;
    --notes)    NOTES="$2";    shift 2 ;;
    --pb-url)   PB_URL="$2";   shift 2 ;;
    *) echo "unknown arg: $1" >&2; exit 2 ;;
  esac
done

die() { echo "error: $*" >&2; exit 1; }
[[ -n "$PLATFORM" && -n "$VARIANT" && -n "$VERSION" && -n "$BUILD" && -n "$FILE" ]] \
  || die "need --platform --variant --version --build --file"
[[ "$PLATFORM" =~ ^(windows|linux|android)$ ]] || die "platform must be windows|linux|android"
[[ "$VARIANT"  =~ ^(clean|adult)$ ]]           || die "variant must be clean|adult"
[[ "$BUILD" =~ ^[0-9]+$ ]]                     || die "build must be an integer"
[[ -f "$FILE" ]]                               || die "file not found: $FILE"

# ---- auth: reuse a provided token, else exchange email+password for one -------
TOKEN="${PB_ADMIN_TOKEN:-}"
if [[ -z "$TOKEN" ]]; then
  [[ -n "${PB_ADMIN_EMAIL:-}" && -n "${PB_ADMIN_PASSWORD:-}" ]] \
    || die "set PB_ADMIN_TOKEN, or PB_ADMIN_EMAIL + PB_ADMIN_PASSWORD"
  TOKEN=$(curl -sf -X POST "$PB_URL/api/collections/_superusers/auth-with-password" \
    -H 'Content-Type: application/json' \
    -d "{\"identity\":\"$PB_ADMIN_EMAIL\",\"password\":\"$PB_ADMIN_PASSWORD\"}" \
    | grep -oE '"token":"[^"]+"' | head -1 | sed 's/"token":"//;s/"//') \
    || die "superuser auth failed"
  [[ -n "$TOKEN" ]] || die "superuser auth returned no token"
fi

SHA=$(sha256sum "$FILE" | cut -d' ' -f1)
SIZE=$(stat -c%s "$FILE")
echo "publishing: $PLATFORM/$VARIANT v$VERSION (build $BUILD)"
echo "  file: $FILE  size: $SIZE  sha256: $SHA"

# ---- multipart upload to the releases collection -----------------------------
HTTP=$(curl -s -o /tmp/publish_resp.json -w '%{http_code}' \
  -X POST "$PB_URL/api/collections/releases/records" \
  -H "Authorization: $TOKEN" \
  -F "platform=$PLATFORM" \
  -F "variant=$VARIANT" \
  -F "version=$VERSION" \
  -F "buildNumber=$BUILD" \
  -F "sha256=$SHA" \
  -F "size=$SIZE" \
  -F "notes=$NOTES" \
  -F "file=@$FILE")

if [[ "$HTTP" == "200" ]]; then
  echo "✓ published (record $(grep -oE '"id":"[^"]+"' /tmp/publish_resp.json | head -1 | sed 's/"id":"//;s/"//'))"
  rm -f /tmp/publish_resp.json
else
  echo "✗ publish failed (HTTP $HTTP):" >&2
  cat /tmp/publish_resp.json >&2; echo >&2
  rm -f /tmp/publish_resp.json
  exit 1
fi