#!/usr/bin/env bash
# Checks a published release the way a customer site sees it: no token, only public URLs.
#
#   bin/release-check.sh [version]    default: Plugin::VERSION
#
# Fails unless releases/latest is that version, the ZIP is a public download below the repository's release URL (the
# only place GiteaUpdater accepts a package from), and the downloaded ZIP is the plugin in that version with its
# autoloader.
#
# Environment: LIT_MCP_GITEA (default https://git.loosen-it.de), only to try the script against another server.
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$root"

gitea="${LIT_MCP_GITEA:-https://git.loosen-it.de}"
repo="janniclas.loosen/WP-LIT-MCP"
version="${1:-$(sed -n "s/.*const VERSION = '\(.*\)';/\1/p" src/Plugin.php)}"
name="wp-lit-mcp-$version.zip"

fail() { echo "ABBRUCH: $*" >&2; exit 1; }

latest="$(curl -fsS "$gitea/api/v1/repos/$repo/releases/latest")" \
    || fail "releases/latest ist ohne Anmeldung nicht abrufbar (noch kein veröffentlichtes Release? Repo nicht öffentlich?)"
tag="$(jq -r .tag_name <<<"$latest")"
[[ "$tag" == "v$version" ]] || fail "releases/latest liefert '$tag', erwartet v$version"

zip_url="$(jq -r --arg n "$name" '.assets[] | select(.name == $n) | .browser_download_url' <<<"$latest")"
[[ "$zip_url" == "$gitea/$repo/releases/download/"* ]] || fail "Asset-URL fehlt oder liegt woanders: '$zip_url'"

work="$(mktemp -d)"
trap 'rm -rf "$work"' EXIT
curl -fsSL "$zip_url" -o "$work/$name" || fail "ZIP nicht ohne Anmeldung ladbar: $zip_url"
entries="$(bsdtar -tf "$work/$name")" || fail "Das heruntergeladene ZIP ist kein gültiges ZIP"
grep -qx 'wp-lit-mcp/vendor/autoload_packages.php' <<<"$entries" || fail "Im ZIP fehlt der Autoloader (vendor/)"
[[ "$(bsdtar -xOf "$work/$name" wp-lit-mcp/wp-lit-mcp.php | sed -n 's/^ \* Version: //p')" == "$version" ]] \
    || fail "Das ZIP enthält nicht Version $version"

echo "Release v$version in Ordnung: öffentlich ladbar, Plugin und Autoloader im ZIP"