#!/usr/bin/env bash
set -euo pipefail

# Simplified GitHub Auth Script
# Usage: github-auth.sh [repo]
#   If repo is not provided, uses default repo from env or prompts

# Source environment from ~/.bashrc
if [ -f ~/.bashrc ]; then
    source ~/.bashrc
fi

# Use defaults or environment variables
GITHUB_APP_ID="${GITHUB_APP_ID:-3002333}"
GITHUB_APP_KEY_PATH="${GITHUB_APP_PRIVATE_KEY_PATH:-~/.github/data-service-code-assist.pem}"
GITHUB_APP_KEY_PATH="${GITHUB_APP_KEY_PATH/#\~/$HOME}"
INSTALLATION_ID="${GITHUB_APP_INSTALLATION_ID:-113867057}"

# Expand path
GITHUB_APP_KEY_PATH=$(eval echo "$GITHUB_APP_KEY_PATH")

if [ ! -f "$GITHUB_APP_KEY_PATH" ]; then
    echo "Error: Private key not found at $GITHUB_APP_KEY_PATH" >&2
    exit 1
fi

# Generate JWT using Python
JWT_TOKEN=$(python3 -c "
import jwt
import time
with open('$GITHUB_APP_KEY_PATH') as f:
    private_key = f.read()
payload = {
    'iss': '$GITHUB_APP_ID',
    'iat': int(time.time()),
    'exp': int(time.time()) + 600
}
print(jwt.encode(payload, private_key, algorithm='RS256'))
")

# Get installation access token
RESPONSE=$(curl -s -X POST \
    -H "Authorization: Bearer $JWT_TOKEN" \
    -H "Accept: application/vnd.github+json" \
    "https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" \
    -d '{"permissions":{"contents":"write","pull_requests":"write"}}')

TOKEN=$(echo "$RESPONSE" | python3 -c "import sys, json; print(json.load(sys.stdin).get('token', ''))")

if [ -z "$TOKEN" ]; then
    echo "Error: Failed to get token" >&2
    echo "$RESPONSE" >&2
    exit 1
fi

# Output token
echo "$TOKEN"