#!/usr/bin/env bash

set -euo pipefail

if [ "$#" -ne 3 ]; then
  echo "usage: $0 <candidate-dir> <package-owner> <package-version>" >&2
  exit 2
fi

candidate_dir=$1
package_owner=$2
package_version=$3

: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
: "${PACKAGE_WRITE_TOKEN:?PACKAGE_WRITE_TOKEN is required}"

package_root="${GITHUB_SERVER_URL%/}/api/packages/$package_owner/generic/redflag-release/$package_version"

package_curl() {
  curl --config <(printf 'silent\nshow-error\nheader = "Authorization: token %s"\n' "$PACKAGE_WRITE_TOKEN") "$@"
}

upload_one() {
  local file=$1
  local name code existing response
  name=$(basename "$file")
  response=$(mktemp)
  code=$(package_curl -o "$response" -w '%{http_code}' \
    -X PUT --upload-file "$file" "$package_root/$name")
  case "$code" in
    201)
      echo "Staged $name"
      ;;
    409)
      existing=$(mktemp)
      package_curl -f -o "$existing" "$package_root/$name"
      if ! cmp -s "$file" "$existing"; then
        rm -f "$existing" "$response"
        echo "existing package file differs: $name" >&2
        exit 1
      fi
      rm -f "$existing"
      echo "Reused byte-identical $name"
      ;;
    *)
      echo "package upload failed for $name: HTTP $code" >&2
      exit 1
      ;;
  esac
  rm -f "$response"
}

payload_names=$(python3 "$(dirname "$0")/release-contract.py" receipt "$candidate_dir")
while IFS= read -r name; do
  upload_one "$candidate_dir/$name"
done <<< "$payload_names"

# Publish the receipt last. A reader that can fetch it can require every named
# payload and reject a partial upload.
upload_one "$candidate_dir/files.sha256"