#requires -Version 5.1
<#
.SYNOPSIS
    Build the ImpTune container locally and push it to the Gitea container registry.

.DESCRIPTION
    Builds the Docker image from the repo Dockerfile, tags it for the Gitea
    registry (git.arescom.fr by default), logs in, and pushes one or more tags.

    Login credentials are read, in order of precedence:
      1. -Username / -Password parameters
      2. $env:GITEA_USER / $env:GITEA_TOKEN
      3. Interactive prompt (token is read as a SecureString)

    Use a Gitea access token (Settings -> Applications) with package read/write
    scope as the password — not your account password.

.EXAMPLE
    ./scripts/publish.ps1
    Build and push :latest plus the short git SHA.

.EXAMPLE
    ./scripts/publish.ps1 -Tag v1.2.0
    Build and push :v1.2.0 (and :latest unless -NoLatest).

.EXAMPLE
    $env:GITEA_USER = "kawa"; $env:GITEA_TOKEN = "xxxx"; ./scripts/publish.ps1 -SkipLogin:$false
#>
[CmdletBinding()]
param(
    # Registry host (Gitea instance).
    [string]$Registry = "git.azuze.fr",

    # Owner / organisation that holds the package.
    [string]$Owner = "kawa",

    # Image name.
    [string]$Image = "imptune",

    # Primary tag. Defaults to the short git SHA.
    [string]$Tag,

    # Also push :latest. On by default.
    [switch]$NoLatest,

    # Registry username. Falls back to $env:GITEA_USER then a prompt.
    [string]$Username,

    # Registry token/password. Falls back to $env:GITEA_TOKEN then a prompt.
    [string]$Password,

    # Skip the build step and only push existing local tags.
    [switch]$NoBuild,

    # Skip docker login (assume already authenticated).
    [switch]$SkipLogin
)

$ErrorActionPreference = "Stop"

function Invoke-Checked {
    param([Parameter(Mandatory)][string]$Exe, [Parameter(Mandatory)][string[]]$Args)
    Write-Host "  > $Exe $($Args -join ' ')" -ForegroundColor DarkGray
    & $Exe @Args
    if ($LASTEXITCODE -ne 0) {
        throw "'$Exe $($Args -join ' ')' failed with exit code $LASTEXITCODE."
    }
}

# Resolve repo root (parent of this script's folder) so the script works from anywhere.
$repoRoot = Split-Path -Parent $PSScriptRoot
Push-Location $repoRoot
try {
    # --- Tag resolution -------------------------------------------------------
    if (-not $Tag) {
        try { $Tag = (git rev-parse --short HEAD).Trim() } catch { }
        if (-not $Tag) { $Tag = "latest" }
    }

    $base   = "$Registry/$Owner/$Image"
    $tags   = @("$base`:$Tag")
    if (-not $NoLatest -and $Tag -ne "latest") { $tags += "$base`:latest" }

    Write-Host "ImpTune container publish" -ForegroundColor Cyan
    Write-Host "  registry : $Registry"
    Write-Host "  image    : $base"
    Write-Host "  tags     : $($tags -join ', ')"
    Write-Host ""

    # --- Build ----------------------------------------------------------------
    if (-not $NoBuild) {
        Write-Host "Building image..." -ForegroundColor Cyan
        $buildArgs = @("build")
        foreach ($t in $tags) { $buildArgs += @("-t", $t) }
        $buildArgs += "."
        Invoke-Checked docker $buildArgs
        Write-Host ""
    }

    # --- Login ----------------------------------------------------------------
    if (-not $SkipLogin) {
        if (-not $Username) { $Username = $env:GITEA_USER }
        if (-not $Username) { $Username = Read-Host "Gitea username for $Registry" }

        if (-not $Password) { $Password = $env:GITEA_TOKEN }
        if (-not $Password) {
            $secure   = Read-Host "Gitea token/password for $Username" -AsSecureString
            $Password = [System.Net.NetworkCredential]::new("", $secure).Password
        }

        Write-Host "Logging in to $Registry as $Username..." -ForegroundColor Cyan
        # Pass the token via stdin so it never lands in process args or history.
        $Password | docker login $Registry --username $Username --password-stdin
        if ($LASTEXITCODE -ne 0) { throw "docker login failed (exit $LASTEXITCODE)." }
        Write-Host ""
    }

    # --- Push -----------------------------------------------------------------
    Write-Host "Pushing..." -ForegroundColor Cyan
    foreach ($t in $tags) { Invoke-Checked docker @("push", $t) }

    Write-Host ""
    Write-Host "Done. Pushed:" -ForegroundColor Green
    foreach ($t in $tags) { Write-Host "  $t" -ForegroundColor Green }
}
finally {
    Pop-Location
}