#!/usr/bin/env bash

set -euo pipefail

if [ "$#" -ne 5 ]; then
  echo "usage: $0 <out-dir> <package-owner> <package-version> <receipt-sha256> <token-file>" >&2
  exit 2
fi

out_dir=$1
package_owner=$2
package_version=$3
expected_receipt=$4
token_file=$5

if [[ ! $expected_receipt =~ ^[0-9a-f]{64}$ ]]; then
  echo "candidate receipt must be a lowercase SHA-256 digest" >&2
  exit 2
fi

case "$out_dir" in
  ''|/|.)
    echo "refusing unsafe output directory: $out_dir" >&2
    exit 2
    ;;
esac

: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
[ -r "$token_file" ] || { echo "package read token is unavailable" >&2; exit 1; }

package_read_token=$(<"$token_file")
[ -n "$package_read_token" ] || { echo "package read token is empty" >&2; exit 1; }
package_root="${GITHUB_SERVER_URL%/}/api/packages/$package_owner/generic/redflag-release/$package_version"

package_curl() {
  curl --config <(printf 'silent\nshow-error\nheader = "Authorization: token %s"\n' "$package_read_token") "$@"
}

[ ! -e "$out_dir" ] && [ ! -L "$out_dir" ] || {
  echo "candidate output already exists; choose a fresh directory" >&2
  exit 1
}
mkdir -p "$out_dir"
package_curl -f -o "$out_dir/files.sha256" "$package_root/files.sha256"

actual_receipt=$(sha256sum "$out_dir/files.sha256" | awk '{print $1}')
if [ "$actual_receipt" != "$expected_receipt" ]; then
  echo "candidate receipt mismatch" >&2
  exit 1
fi

names=$(python3 "$(dirname "$0")/release-contract.py" names "$out_dir")
while IFS= read -r name; do
  package_curl -f -o "$out_dir/$name" "$package_root/$name"
done <<< "$names"
python3 "$(dirname "$0")/release-contract.py" receipt "$out_dir" >/dev/null

echo "Verified package candidate $package_version receipt $actual_receipt"