# Interactive: encrypt a Git token with Windows DPAPI (CurrentUser).
# Run in the user's own terminal. Never print the token.

param(
    [switch]$Force
)

$ErrorActionPreference = 'Stop'
. (Join-Path $PSScriptRoot 'common.ps1')

Ensure-GitSkillsHome

if ((Test-Path -LiteralPath $script:TokenPath) -and -not $Force) {
    $answer = Read-Host 'Encrypted token already exists. Overwrite? (y/N)'
    if ($answer -notmatch '^[Yy]$') {
        Write-StatusLine -Key 'status' -Value 'unchanged'
        exit 0
    }
}

$secure = Read-Host 'Paste Gitea access token (input hidden)' -AsSecureString
if ($secure.Length -lt 1) {
    throw 'Token is empty.'
}

$plain = $null
try {
    $plain = ConvertFrom-SecureStringPlain -Secure $secure
    if ([string]::IsNullOrWhiteSpace($plain)) {
        throw 'Token is empty.'
    }
    $protected = Protect-SecretString -PlainText $plain
    [System.IO.File]::WriteAllBytes($script:TokenPath, $protected)
}
finally {
    $plain = $null
    $protected = $null
}

Write-StatusLine -Key 'status' -Value 'saved'
Write-StatusLine -Key 'path' -Value $script:TokenPath
Write-Output 'token=hidden'