#!/usr/bin/env bash
# init-scan.sh — Initialize an insight scan: create output directories,
# resolve scan metadata (username, scan ID, repo name), check prerequisites,
# and output everything as JSON for the orchestrator to distribute to analyzers.
#
# Usage:
#   bash init-scan.sh [--root <dir>] [--username <name>]
#
# Defaults:
#   --root      current working directory
#   --username  derived from git config → whoami → "unknown-user"
#
# Output: JSON to stdout (or to --out <path> if given).

set -euo pipefail

# ── CLI parsing ──────────────────────────────────────────────────────

ROOT="$(pwd)"
USERNAME_INPUT=""
OUT=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --root)     ROOT="$2"; shift 2 ;;
    --username) USERNAME_INPUT="$2"; shift 2 ;;
    --out)      OUT="$2"; shift 2 ;;
    -h|--help)
      echo "Usage: bash init-scan.sh [--root <dir>] [--username <name>] [--out <path>]"
      exit 0
      ;;
    *) echo "Unknown option: $1" >&2; exit 1 ;;
  esac
done

# ── Resolve username ─────────────────────────────────────────────────

USERNAME="${USERNAME_INPUT:-}"
if [ -z "$USERNAME" ]; then
  USERNAME=$(git -C "$ROOT" config user.name 2>/dev/null \
    | tr '[:upper:]' '[:lower:]' \
    | sed -E 's/[[:space:]]+/-/g; s/[^a-z0-9._-]//g; s/^[-.]+|[-.]+$//g' || true)
fi
[ -z "$USERNAME" ] && USERNAME=$(whoami | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]//g')
[ -z "$USERNAME" ] && USERNAME="unknown-user"

# ── Generate scan metadata ───────────────────────────────────────────

SCAN_ID="scan-$(date +%Y%m%d-%H%M%S)"
DATE=$(date +%Y%m%d)
INSIGHTS_DIR="$ROOT/.tessl-insights-poc"

# Repo name from git remote
REPO_NAME=$(git -C "$ROOT" remote get-url origin 2>/dev/null \
  | sed 's/.*[:/]\([^/]*\/[^/]*\)\.git$/\1/' \
  | sed 's/.*[:/]\([^/]*\/[^/]*\)$/\1/' || true)
[ -z "$REPO_NAME" ] && REPO_NAME=$(basename "$ROOT")

# ── Create output directories ────────────────────────────────────────

mkdir -p "$INSIGHTS_DIR/reports/agent-logs"

# ── Check prerequisites ──────────────────────────────────────────────

check_cmd() { command -v "$1" >/dev/null 2>&1 && echo "true" || echo "false"; }

HAS_GIT=$(check_cmd git)
HAS_NODE=$(check_cmd node)
HAS_PYTHON=$(check_cmd python3)
HAS_GH=$(check_cmd gh)
HAS_JQ=$(check_cmd jq)

# Check gh authentication with a real API probe (gh auth status also fails
# inside Cursor's macOS sandbox because the keychain is unreachable, even
# when the token is valid). gh_auth_reason distinguishes the three states
# so the orchestrator can surface actionable guidance.
GH_AUTH="false"
GH_AUTH_REASON="unchecked"
if [ "$HAS_GH" = "true" ]; then
  GH_INIT_ERR="$(mktemp -t init-gh.XXXXXX.err)"
  if gh api user --jq .login >/dev/null 2>"$GH_INIT_ERR"; then
    GH_AUTH="true"
    GH_AUTH_REASON="ok"
  elif grep -qiE 'keyring|token.*invalid|secret storage' "$GH_INIT_ERR"; then
    GH_AUTH_REASON="sandboxed_keychain"
  elif grep -qiE '401|unauthori[sz]ed|bad credentials' "$GH_INIT_ERR"; then
    GH_AUTH_REASON="unauthenticated"
  else
    GH_AUTH_REASON="probe_failed"
  fi
  rm -f "$GH_INIT_ERR"
fi

# Check if inside a git repo
IS_GIT_REPO="false"
git -C "$ROOT" rev-parse --git-dir >/dev/null 2>&1 && IS_GIT_REPO="true"

# ── Build output paths ───────────────────────────────────────────────

SC_PATH="$INSIGHTS_DIR/reports/source-code.json"
GH_PATH="$INSIGHTS_DIR/reports/git-history.json"
GHD_PATH="$INSIGHTS_DIR/reports/github-data.json"
AL_PATH="$INSIGHTS_DIR/reports/agent-logs/${USERNAME}-${DATE}.json"
AC_PATH="$INSIGHTS_DIR/reports/agent-context.json"
CI_PATH="$INSIGHTS_DIR/reports/context-inventory.json"

# ── Output JSON ──────────────────────────────────────────────────────

JSON=$(cat <<EOF
{
  "scan_id": "$SCAN_ID",
  "repo_name": "$REPO_NAME",
  "username": "$USERNAME",
  "date": "$DATE",
  "root": "$ROOT",
  "insights_dir": "$INSIGHTS_DIR",
  "output_paths": {
    "source_code": "$SC_PATH",
    "git_history": "$GH_PATH",
    "github_data": "$GHD_PATH",
    "agent_logs": "$AL_PATH",
    "agent_context": "$AC_PATH",
    "context_inventory": "$CI_PATH"
  },
  "prerequisites": {
    "git": $HAS_GIT,
    "is_git_repo": $IS_GIT_REPO,
    "gh": $HAS_GH,
    "gh_authenticated": $GH_AUTH,
    "gh_auth_reason": "$GH_AUTH_REASON",
    "node": $HAS_NODE,
    "python3": $HAS_PYTHON,
    "jq": $HAS_JQ
  }
}
EOF
)

if [ -n "$OUT" ]; then
  echo "$JSON" > "$OUT"
  echo "Scan initialized: $OUT" >&2
else
  echo "$JSON"
fi