#!/usr/bin/env bash

# Who this machine belongs to: git identity, GitHub, and an SSH key.
#
# Runs last, because gh and git-all arrive with install-packages. Everything here
# is driven by answers the interview collected before the run started, so nothing
# in this stage blocks waiting for input -- except `gh auth login`, which is an
# interactive browser flow by nature and only runs when it was asked for.
#
# Every value is optional. A blank answer means "keep whatever is already set",
# which is what makes this safe to re-run: the interview's prompts start empty
# every time by design, and an empty answer must never erase a correct name.

set -uo pipefail

log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }

git_name="${PANAMA_GIT_NAME:-}"
git_email="${PANAMA_GIT_EMAIL:-}"
git_editor="${PANAMA_GIT_EDITOR:-}"

if [[ -n "$git_name" ]]; then
    git config --global user.name "$git_name"
    log "git user.name set to $git_name"
fi
if [[ -n "$git_email" ]]; then
    git config --global user.email "$git_email"
    log "git user.email set to $git_email"
fi
if [[ -n "$git_editor" ]]; then
    git config --global core.editor "$git_editor"
    log "git core.editor set to $git_editor"
fi

# Aliases and pull behaviour, carried over from sunhat. Setting these is
# idempotent, so they are applied unconditionally rather than asked about.
git config --global alias.co checkout
git config --global alias.br branch
git config --global alias.ci commit
git config --global alias.st status
git config --global pull.rebase true
log "git aliases and pull.rebase applied"

# Text-expansion identity. The :fn/:em triggers used to hardcode the repository
# owner's name and email in the shared match file; each machine now writes its
# own from the interview's answers. Per-machine and gitignored -- espanso loads
# every file under match/, so it sits beside base.yml without being shared.
# Kept when it already exists: the file is the user's to edit, and a re-run
# must not erase what they added.
espanso_identity="${XDG_CONFIG_HOME:-$HOME/.config}/espanso/match/identity.yml"
if [[ -d "$(dirname "$espanso_identity")" && ! -e "$espanso_identity" ]] \
    && [[ -n "$git_name" || -n "$git_email" ]]; then
    {
        printf '# Personal expansion triggers, seeded from the install interview.\n'
        printf '# Per-machine and untracked: add your own freely.\n'
        printf 'matches:\n'
        [[ -n "$git_name" ]] && printf '  - trigger: ":fn"\n    replace: "%s"\n' "$git_name"
        [[ -n "$git_email" ]] && printf '  - trigger: ":em"\n    replace: "%s"\n' "$git_email"
        :
    } > "$espanso_identity"
    log "Seeded espanso identity triggers at $espanso_identity"
fi

if [[ "${PANAMA_GH_LOGIN:-no}" == yes ]]; then
    if command -v gh >/dev/null 2>&1; then
        log "Signing in to GitHub"
        gh auth login || log "GitHub sign-in did not complete; run 'gh auth login' later"
    else
        log "gh is not installed; skipping GitHub sign-in"
    fi
fi

if [[ "${PANAMA_SSH_KEY:-no}" == yes ]]; then
    key="$HOME/.ssh/id_ed25519"
    if [[ -e "$key" ]]; then
        log "An SSH key already exists at $key; leaving it alone"
    else
        mkdir -p "$HOME/.ssh"
        chmod 700 "$HOME/.ssh"
        # No passphrase prompt: this stage runs inside an install that was
        # promised to need no attention. A key can be given a passphrase later
        # with ssh-keygen -p.
        ssh-keygen -t ed25519 -N "" -C "${git_email:-$USER@$(hostname)}" -f "$key" >/dev/null
        log "SSH key generated at $key"
        log "Public key: $(cat "$key.pub")"
    fi
fi