#!/usr/bin/env bash
# Checks a published release the way a customer site sees it: no token, only public URLs.
#
#   bin/release-check.sh [version]    default: Plugin::VERSION
#
# Fails unless releases/latest is that version, ZIP and .sig are public downloads below the repository's release
# URL (the only place GiteaUpdater accepts a package from), and the downloaded ZIP passes the signature check against
# the key built into the plugin.
#
# Environment: LIT_MCP_GITEA (default https://git.loosen-it.de), only to try the script against another server.
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$root"

gitea="${LIT_MCP_GITEA:-https://git.loosen-it.de}"
repo="janniclas.loosen/WP-LIT-MCP"
version="${1:-$(sed -n "s/.*const VERSION = '\(.*\)';/\1/p" src/Plugin.php)}"
name="wp-lit-mcp-$version.zip"

fail() { echo "ABBRUCH: $*" >&2; exit 1; }

latest="$(curl -fsS "$gitea/api/v1/repos/$repo/releases/latest")" \
    || fail "releases/latest ist ohne Anmeldung nicht abrufbar (noch kein veröffentlichtes Release? Repo nicht öffentlich?)"
tag="$(jq -r .tag_name <<<"$latest")"
[[ "$tag" == "v$version" ]] || fail "releases/latest liefert '$tag', erwartet v$version"

asset_url() { jq -r --arg n "$1" '.assets[] | select(.name == $n) | .browser_download_url' <<<"$latest"; }
zip_url="$(asset_url "$name")"
sig_url="$(asset_url "$name.sig")"
for url in "$zip_url" "$sig_url"; do
    [[ "$url" == "$gitea/$repo/releases/download/"* ]] || fail "Asset-URL fehlt oder liegt woanders: '$url'"
done

work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT
curl -fsSL "$zip_url" -o "$work/$name" || fail "ZIP nicht ohne Anmeldung ladbar: $zip_url"
curl -fsSL "$sig_url" -o "$work/$name.sig" || fail "Signatur nicht ohne Anmeldung ladbar: $sig_url"
php bin/release-sign.php verify "$work/$name" "$work/$name.sig" >/dev/null \
    || fail "Das heruntergeladene Release besteht die Signaturprüfung nicht"

echo "Release v$version in Ordnung: öffentlich ladbar, Signatur gültig"