#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${root}"

host="${EVERY_CHANNEL_FORGE_HOST:-https://git.every.channel}"
repo="${EVERY_CHANNEL_FORGE_REPO:-every-channel/every.channel}"
secret_name="${EVERY_CHANNEL_FORGE_CLOUDFLARE_SECRET_NAME:-CLOUDFLARE_API_TOKEN}"
token_file="${1:-}"

token="${CLOUDFLARE_API_TOKEN:-}"
if [[ -z "${token}" && -n "${token_file}" ]]; then
  if [[ ! -f "${token_file}" ]]; then
    echo "error: token file not found: ${token_file}" >&2
    exit 2
  fi
  token="$(<"${token_file}")"
fi
if [[ -z "${token}" && ! -t 0 ]]; then
  token="$(cat)"
fi
token="$(printf '%s' "${token}" | tr -d '\r\n')"

if [[ -z "${token}" ]]; then
  echo "error: provide CLOUDFLARE_API_TOKEN, a token file path, or token on stdin" >&2
  exit 2
fi

if ! command -v fj >/dev/null 2>&1; then
  echo "error: fj not found in PATH (run: nix develop)" >&2
  exit 2
fi

"${root}/scripts/fj-auth-forge.sh" >/dev/null

# Upsert by delete/create because fj currently exposes create/delete.
fj -H "${host}" actions -r "${repo}" secrets delete "${secret_name}" >/dev/null 2>&1 || true
fj -H "${host}" actions -r "${repo}" secrets create "${secret_name}" "${token}" >/dev/null

echo "ok: set ${secret_name} on ${repo} via ${host}"