#!/usr/bin/env bash
# Preserve original upstream commits; never force-push or write to KEMT/zpwiki.
set -euo pipefail
set +x
umask 077

fork_url='git@git.kemt.fei.tuke.sk:jp170na/zpwiki.git'
upstream_url='git@git.kemt.fei.tuke.sk:KEMT/zpwiki.git'
script_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
check_only=false
local_key=''

case "${1:-}" in
  --check) check_only=true ;;
  --key-file)
    [[ $# -eq 2 && -f "$2" ]] || { echo "Chyba platny lokalny SSH kluc." >&2; exit 64; }
    local_key="$2"
    ;;
  '') ;;
  -h|--help)
    echo "Pouzitie: bash tools/git_runner/sync_fork.sh [--check | --key-file /cesta/ku/klucu]"
    echo "--check iba porovna vetvy bez zapisu; pouzije dostupny lokalny SSH pristup."
    exit 0
    ;;
  *) echo "Neznamy parameter." >&2; exit 64 ;;
esac
if [[ $# -gt 1 && -z "$local_key" ]]; then
  echo "Prilis vela parametrov." >&2
  exit 64
fi

if ! "$check_only" && [[ -z "$local_key" ]]; then
  : "${ZPWIKI_SYNC_SSH_KEY:?Chyba Actions secret ZPWIKI_SYNC_SSH_KEY}"
fi
export GIT_TERMINAL_PROMPT=0 LC_ALL=C
# Ignore URL rewrites and hooks in machine-wide/user Git configuration.
# The only write transport below is the explicit, fixed fork URL.
export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null

export ZPWIKI_KNOWN_HOSTS_FILE="$script_root/ssh_known_hosts"
if [[ ! -s "$ZPWIKI_KNOWN_HOSTS_FILE" ]]; then
  echo "Chyba doveryhodny subor ssh_known_hosts vedla skriptu." >&2
  exit 1
fi

work="$(mktemp -d /tmp/zpwiki-fork-sync.XXXXXXXX)"
trap 'rm -rf "$work"' EXIT

if [[ -n "$local_key" ]]; then
  export ZPWIKI_SSH_KEY_FILE="$local_key"
elif [[ -n "${ZPWIKI_SYNC_SSH_KEY:-}" ]]; then
  key_text="${ZPWIKI_SYNC_SSH_KEY//$'\r'/}"
  printf '%s\n' "${key_text%$'\n'}" > "$work/id_ed25519"
  unset key_text
  chmod 600 "$work/id_ed25519"
  export ZPWIKI_SSH_KEY_FILE="$work/id_ed25519"
fi
unset ZPWIKI_SYNC_SSH_KEY

cat > "$work/ssh" <<'SH'
#!/usr/bin/env bash
set -euo pipefail
options=(-F /dev/null -o BatchMode=yes -o StrictHostKeyChecking=yes
         -o ConnectTimeout=15 -o ServerAliveInterval=15 -o ServerAliveCountMax=2
         -o "UserKnownHostsFile=$ZPWIKI_KNOWN_HOSTS_FILE")
if [[ -n "${ZPWIKI_SSH_KEY_FILE:-}" ]]; then
  options+=(-o IdentitiesOnly=yes -i "$ZPWIKI_SSH_KEY_FILE")
fi
exec ssh "${options[@]}" "$@"
SH
chmod 700 "$work/ssh"
# mktemp's fixed /tmp template contains no shell metacharacters.
export GIT_SSH_COMMAND="$work/ssh" GIT_SSH_VARIANT=ssh

git_cmd() {
  git -c core.hooksPath=/dev/null "$@"
}

git_cmd clone --quiet --bare --single-branch --branch master --no-tags \
  "$fork_url" "$work/wiki.git"
cd "$work/wiki.git"
git_cmd fetch --quiet --no-tags "$upstream_url" \
  refs/heads/master:refs/remotes/upstream/master

fork="$(git_cmd rev-parse refs/heads/master)"
upstream="$(git_cmd rev-parse refs/remotes/upstream/master)"
echo "Fork master: $fork"
echo "KEMT master: $upstream"

if git_cmd merge-base --is-ancestor "$upstream" "$fork"; then
  echo "Fork uz obsahuje vsetky zmeny hlavnej wiki. Bez zapisu."
  exit 0
fi
if ! git_cmd merge-base --is-ancestor "$fork" "$upstream"; then
  echo "CHYBA: Vetvy sa rozisli. Fork nebol prepisany." >&2
  exit 1
fi
if "$check_only"; then
  echo "Fork potrebuje fast-forward aktualizaciu. Kontrola nic nezmenila."
  exit 0
fi

# Normal push also rejects a concurrent divergent update on the server.
git_cmd push "$fork_url" "$upstream:refs/heads/master"
echo "Fork bol aktualizovany na $upstream."