#!/bin/bash
set -euo pipefail

GITEA_URL="https://git.timothykim.net"
GITEA_ORG="hantim"

if [ -z "${1:-}" ]; then
    echo "Usage: ./tools/remove-app.sh <domain>"
    echo "  Example: ./tools/remove-app.sh example.com"
    echo ""
    echo "Removes: local files (compose, workflow, nginx conf), Gitea repo."
    echo "Does NOT remove: DNS records, SSL certs."
    exit 1
fi

APP="$1"
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

if ! [[ "$APP" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]; then
    echo "Error: app name must be alphanumeric (hyphens, dots, underscores allowed)."
    exit 1
fi

# --- Check dependencies ---

if ! command -v bws &>/dev/null; then
    echo "Error: Bitwarden Secrets Manager CLI (bws) is not installed."
    echo "  https://github.com/bitwarden/sdk-sm/releases"
    exit 1
fi

# --- Get bws access token ---

BWS_TOKEN_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/hantim/bws-token"

if [ -z "${BWS_ACCESS_TOKEN:-}" ]; then
    if [ -f "$BWS_TOKEN_FILE" ]; then
        BWS_ACCESS_TOKEN=$(cat "$BWS_TOKEN_FILE")
    else
        echo "==> Bitwarden Secrets Manager access token required."
        echo "    Generate one for your machine account at:"
        echo "    https://vault.bitwarden.com/#/sm/machine-accounts"
        read -rp "    Paste access token: " BWS_ACCESS_TOKEN
        if [ -z "$BWS_ACCESS_TOKEN" ]; then
            echo "ERROR: Access token cannot be empty."
            exit 1
        fi
        mkdir -p "$(dirname "$BWS_TOKEN_FILE")"
        echo "$BWS_ACCESS_TOKEN" > "$BWS_TOKEN_FILE"
        chmod 600 "$BWS_TOKEN_FILE"
    fi
fi
export BWS_ACCESS_TOKEN

# --- Fetch secrets from Bitwarden Secrets Manager ---

echo "==> Fetching secrets from Bitwarden Secrets Manager..."
GITEA_TOKEN=$(bws secret list 2>/dev/null | jq -r '.[] | select(.key == "hantim-new-app-script") | .value')
if [ -z "$GITEA_TOKEN" ]; then
    echo "ERROR: Secret 'hantim-new-app-script' not found in Bitwarden Secrets Manager."
    exit 1
fi

# --- Delete Gitea repo ---

echo "==> Deleting Gitea repo $GITEA_ORG/$APP..."
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    -X DELETE "$GITEA_URL/api/v1/repos/$GITEA_ORG/$APP" \
    -H "Authorization: token $GITEA_TOKEN")

if [ "$HTTP_CODE" = "204" ]; then
    echo "  Deleted."
elif [ "$HTTP_CODE" = "404" ]; then
    echo "  Repo does not exist, skipping."
else
    echo "  Warning: unexpected response (HTTP $HTTP_CODE)."
fi

# --- Remove local files ---

echo "==> Removing local files..."
REMOVED=()

for f in "docker/$APP" ".gitea/workflows/deploy-$APP.yml" "docker/nginx/conf.d/$APP.conf"; do
    if [ -e "$REPO_ROOT/$f" ]; then
        git -C "$REPO_ROOT" rm -rf "$f"
        REMOVED+=("$f")
    fi
done

if [ ${#REMOVED[@]} -gt 0 ]; then
    echo "==> Committing and pushing..."
    cd "$REPO_ROOT"
    git commit -m "remove $APP"
    git push
else
    echo "  No local files to remove."
fi

echo "Done. DNS records and SSL certs were left in place."