# Agent-safe: refresh HTTPS/SSH auth for a remote URL. Never prints the token.
# Does not require being inside a git work tree (used by clone).

param(
    [Parameter(Mandatory = $true)]
    [string]$RemoteUrl,
    [string]$RemoteName = ''
)

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

if ($RemoteUrl -match '@.+@' -or $RemoteUrl -match '://[^/:]+:[^@/]+@') {
    $safeUrl = '<redacted-embedded-credentials>'
} else {
    $safeUrl = $RemoteUrl.Trim()
}

$parsed = Parse-GitRemoteUrl -RemoteUrl $RemoteUrl
$protocol = [string]$parsed.Protocol
$hostName = [string]$parsed.Host

$helper = (Invoke-GitSkillsNative -FilePath git -ArgumentList @('config', '--global', '--get', 'credential.helper') | Out-String).Trim()
if ([string]::IsNullOrWhiteSpace($helper)) {
    Invoke-GitSkillsNative -FilePath git -ArgumentList @('config', '--global', 'credential.helper', 'manager') | Out-Null
    $helper = 'manager'
}

$tokenPresent = Test-Path -LiteralPath $script:TokenPath
$inject = 'skipped'
if ($tokenPresent) {
    & (Join-Path $PSScriptRoot 'inject-credential.ps1') -RemoteUrl $RemoteUrl
    if ($LASTEXITCODE -ne 0) {
        Write-StatusLine -Key 'status' -Value 'failed'
        Write-StatusLine -Key 'reason' -Value 'inject_failed'
        exit 1
    }
    $inject = 'ok'
}
elseif ($protocol -eq 'http' -or $protocol -eq 'https') {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'token_missing'
    exit 1
}

$ssh = 'skipped'
if ($protocol -eq 'ssh') {
    $email = ''
    $gitProfile = Get-GitSkillsProfile
    if ($gitProfile) { $email = [string]$gitProfile.userEmail }
    & (Join-Path $PSScriptRoot 'ensure-ssh.ps1') -Email $email -NoGenerate -Quiet
    if ($LASTEXITCODE -ne 0) {
        Write-StatusLine -Key 'status' -Value 'failed'
        Write-StatusLine -Key 'reason' -Value 'ssh_failed'
        exit 1
    }
    $ssh = 'ok'
}

Write-StatusLine -Key 'status' -Value 'ready'
if (-not [string]::IsNullOrWhiteSpace($RemoteName)) {
    Write-StatusLine -Key 'remote' -Value $RemoteName
}
Write-StatusLine -Key 'url' -Value $safeUrl
Write-StatusLine -Key 'protocol' -Value $protocol
Write-StatusLine -Key 'host' -Value $hostName
if ($null -ne $parsed.Port) {
    Write-StatusLine -Key 'port' -Value "$($parsed.Port)"
}
Write-StatusLine -Key 'credential_host' -Value ([string]$parsed.CredentialHost)
Write-StatusLine -Key 'credential_helper' -Value $helper
Write-StatusLine -Key 'inject' -Value $inject
Write-StatusLine -Key 'ssh' -Value $ssh
Write-Output 'token=hidden'