# Orchestrate Gitea SSH + GPG key verification challenges.
# Challenge tokens come from /user/settings/keys Verify page (short-lived).
# Never store them. Never confuse with the HTTPS access token in token.dpapi.

param(
    [string]$GpgToken,
    [string]$SshToken,
    [string]$KeyId,
    [string]$KeyPath,
    [switch]$GpgOnly,
    [switch]$SshOnly
)

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

function Resolve-DefaultGpgKeyId {
    $ensure = Join-Path $PSScriptRoot 'ensure-gpg.ps1'
    $gitProfile = Get-GitSkillsProfile
    $name = if ($gitProfile) { [string]$gitProfile.userName } else { '' }
    $email = if ($gitProfile) { [string]$gitProfile.userEmail } else { '' }
    $prev = $ErrorActionPreference
    $ErrorActionPreference = 'Continue'
    try {
        $out = & powershell -NoProfile -ExecutionPolicy Bypass -File $ensure -Name $name -Email $email 2>&1 | Out-String
    }
    finally {
        $ErrorActionPreference = $prev
    }
    if ($out -match 'key_id=([0-9A-Fa-f]+)') {
        return $Matches[1]
    }
    return $null
}

$doGpg = -not $SshOnly
$doSsh = -not $GpgOnly
if (-not $doGpg -and -not $doSsh) {
    Write-StatusLine -Key 'status' -Value 'failed'
    Write-StatusLine -Key 'reason' -Value 'nothing_to_verify'
    exit 1
}

$failed = $false

if ($doGpg) {
    if ([string]::IsNullOrWhiteSpace($GpgToken)) {
        Write-StatusLine -Key 'gpg' -Value 'need_token'
        Write-Output 'ask=Open Gitea Settings > SSH/GPG keys > GPG Verify, paste the page challenge token here (NOT the HTTPS access token)'
    }
    else {
        if ([string]::IsNullOrWhiteSpace($KeyId)) {
            $KeyId = Resolve-DefaultGpgKeyId
        }
        if ([string]::IsNullOrWhiteSpace($KeyId)) {
            Write-StatusLine -Key 'gpg' -Value 'failed'
            Write-StatusLine -Key 'reason' -Value 'gpg_key_id_missing'
            $failed = $true
        }
        else {
            Write-StatusLine -Key 'gpg_key_id' -Value $KeyId
            & (Join-Path $PSScriptRoot 'verify-gpg-challenge.ps1') -Token $GpgToken -KeyId $KeyId
            if ($LASTEXITCODE -ne 0) {
                $failed = $true
            }
            else {
                Write-Output 'gpg_next=Paste the BEGIN/END PGP SIGNATURE block back into Gitea GPG Verify, then click Verify'
            }
        }
    }
}

if ($doSsh) {
    if ([string]::IsNullOrWhiteSpace($SshToken)) {
        Write-StatusLine -Key 'ssh' -Value 'need_token'
        Write-Output 'ask=Open Gitea Settings > SSH/GPG keys > SSH Verify, paste that page challenge token here (different from GPG token)'
    }
    else {
        $sshInvoke = @{
            Token = $SshToken
        }
        if (-not [string]::IsNullOrWhiteSpace($KeyPath)) {
            $sshInvoke['KeyPath'] = $KeyPath
        }
        & (Join-Path $PSScriptRoot 'verify-ssh-challenge.ps1') @sshInvoke
        if ($LASTEXITCODE -ne 0) {
            $failed = $true
        }
        else {
            Write-Output 'ssh_next=Paste the BEGIN/END SSH SIGNATURE block back into Gitea SSH Verify, then click Verify'
        }
    }
}

if ($failed) {
    Write-StatusLine -Key 'status' -Value 'failed'
    exit 1
}

$gpgPending = $doGpg -and [string]::IsNullOrWhiteSpace($GpgToken)
$sshPending = $doSsh -and [string]::IsNullOrWhiteSpace($SshToken)
if ($gpgPending -or $sshPending) {
    Write-StatusLine -Key 'status' -Value 'waiting_for_tokens'
    exit 0
}

Write-StatusLine -Key 'status' -Value 'signatures_ready'
Write-Output 'done=Signatures generated. After user pastes them on Gitea and clicks Verify, check new commits for verified status.'
exit 0